joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba40
Capabilities:
Get common file path

Disassembly:
mov dword [edi + 4], eax
pop edi
pop esi
ret
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x210], ecx
call fcn.0041b790
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x60]
call eax
test al, al
je 0x41bb2e
call fcn.00453a17
test al, al
je 0x41ba92
or eax, 0x5594fe93
pushal
inc eax
and dword [esi], eax
inc eax
mov byte [0xd232efa2], al
push ecx
sub al, 0x36
sti
in eax, 0x87
nop
push esi
call fcn.004537aa
test al, al
je 0x41bab3
jge 0x41ba2c
dec esi
mov edi, 0x9e1dab71
lcall 0xf720, 0xb85419ef
mov ebp, 0x1b4fec95
aam 0x46
invalid
call fcn.00453834
test al, al
je 0x41bad4
adc dword [ebx - 0x78056875], ecx
xor ebx, dword [ebp + 0x60ec7f58]
mov ah, ch
fistp dword [edi + 0x6a]
outsb dx, byte [esi]
sti
and al, 0x24
push ebp
xor al, 0x4a
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41bb13
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c420
call fcn.004539d2
test al, al
je 0x41bb2e
dec esp
ret 0xfd8f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x41deb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0ffa
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00453b70
test al, al
je 0x41def6
and byte [edi + edx + 0x162dc99c], dl
dec ecx
add eax, 0xb2a3dfea
cmp al, 0xe2
cmp esp, esp
push ss
lea eax, [ebp - 0x58]
push eax
call fcn.0045d58b
add esp, 4
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x41df11
mov eax, dword [eax]
push 0x5e9978
push str.7681e
push str.OISet
push eax
lea eax, [ebp - 0x40]
push 0x5e9c5c
push eax
call fcn.0046803b
add esp, 0x18
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x41df4b
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp dword [ebp - 0x30], eax
je 0x41e066
mov eax, dword [0x67d4e4]
test eax, eax
jne 0x41df9d
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x41df92
mov ecx, eax
call fcn.00444f40
jmp 0x41df94
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x67d4e4], eax
mov ecx, eax
call fcn.00474b54
push eax
lea ecx, [ebp - 0x28]
call fcn.00404170
mov byte [ebp - 4], 4
call fcn.00453aa1
test al, al
je 0x41dfd5
sub al, 0xf6
into
invalid
call fcn.00453903
test al, al
je 0x41dff3
pop ss
xchg ebx, eax
in al, 0x8f
movups xmm6, xmmword [edi + 0x4b]
mov edi, edx
mov eax, dword [0xc1d33797]
scasd eax, dword es:[edi]
push esp
sbb eax, dword [esi + 0x1e]
call fcn.00453a5c
test al, al
je 0x41e00e
dec esi
leave
and eax, 0x43fc45a2
invalid
push 0xc
push str.WWordMgr.exe
lea ecx, [ebp - 0x28]
call fcn.00405d30
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00454bbd
add esp, 8
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41e066
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402ce0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41e07b
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x41f3e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1227
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x678390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41f431
mov eax, dword [esi]
jmp 0x41f433
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x2c], 8
mov dword [ebp - 4], ecx
jb 0x41f450
mov eax, dword [esi + 0x18]
jmp 0x41f453
lea eax, [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ecx
cmp dword [esi + 0x44], 8
jb 0x41f46d
mov eax, dword [esi + 0x30]
jmp 0x41f470
lea eax, [esi + 0x30]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f48a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x60]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4a4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x78]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4be
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x90]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4db
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xa8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4f8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f515
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xd8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f532
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push 0xc
push str.WanNengWBIME
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00402b90
push 5
push str.WHost
lea ecx, [esi + 0x18]
call fcn.00402b90
push 0xc
push str.WHostService
lea ecx, [esi + 0x30]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0x48]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0x60]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0x78]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0xc0]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0xd8]
call fcn.00402b90
push 0
push 0x5e9978
lea ecx, [esi + 0xa8]
call fcn.00402b90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f7f0
Capabilities:
Delete registry key

Disassembly:
push dword [edi]
call fcn.00402ce0
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x41f7a7
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x41f7bf
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402ce0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41f7dd
mov eax, dword [esi]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
pop edi
mov word [esi], ax
pop esi
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00453cc9
test al, al
je 0x41f81b
sal byte [ebx + ebx + 0x67], 0xd8
jp 0x41f78a
fdivr dword [bp + si - 0x7a]
invalid
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f8b1
call fcn.004537ef
test al, al
je 0x41f857
sbb al, 0x2c
aam 0x95
inc esp
mov al, 0xc
int1
xchg edx, eax
push esi
pop esp
mov esi, 0xa909f3fa
pop esi
scasd eax, dword es:[edi]
or byte [ebp + 0x34245e8], cl
add byte [eax + eax*8 - 0x1f27e38c], al
call fcn.00453aa1
test al, al
je 0x41f87c
fsub st(0)
dec eax
inc esi
sbb dh, ah
or al, 0x84
mov bh, bl
adc ch, byte [edx + 0x7203e7a4]
insd dword es:[edi], dx
cmp esp, edi
or edx, ecx
je 0x41f7fd
salc
add eax, 0x48e8fec7
inc esp
add eax, dword [eax]
call fcn.00453cc9
test al, al
je 0x41f89a
pop ebp
fdivr qword [esi - 0x3c]
mov ebx, 0xb2f2f0e
dec ebp
fist dword [0x76c49055]
loopne 0x41f83f
daa
cmp al, 0x68
adc byte [ebx + 0x75ff005e], bh
cld
push str.WHost
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420a40
Capabilities:
Query or enumerate registry value

Disassembly:
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00453b70
test al, al
je 0x420a62
shl ebx, cl
xchg ecx, eax
lds edx, [eax + 0x7df78c09]
push ds
inc ecx
invalid
call fcn.004538be
test al, al
je 0x420a82
arpl word [edx], bp
cmp dword [ecx], edx
fsubr st(2), st(0)
cli
inc ebx
pop esi
sub al, 0x4f
adc ebp, esi
fild dword [eax - 0x792a5a3e]
popfd
jne 0x420ae2
jp 0x420a6b
call fcn.004537aa
test al, al
and ebp, dword [0xc0840003]
je 0x420aaa
sub dword [ebx + 0x27], eax
jecxz 0x420a99
into
xor dword [ecx - 0x30761a95], 0xffffffc7
jbe 0x420a2c
xchg edx, eax
sbb ebp, ebx
scasd eax, dword es:[edi]
pop esp
salc
mov ebp, dword [0xdfc513ea]
je 0x420ada
mov dl, 0x8b
xor eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x420bee
add dword [eax], eax
add byte [ebp + 0x6850fc45], cl
lea eax, [ebp - 4]
push eax
push 0x20119
sbb dword [ecx], eax
add al, byte [eax]
push 0
push str.WHost
push dword [ebp - 8]
call esi
test eax, eax
jne 0x420bee
call fcn.00453720
test al, al
je 0x420b1c
mov ecx, dword [edx + 0x45]
xchg dword [edx], edi
ror byte [eax - 0x8096471], 0x7c
jmp 0x420b44
xor cl, byte [ecx + 0x26e4b3da]
sub cl, bl
mov bh, 0x69
enter 0x458d, 0xfffffffffffffff4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.00453834
test al, al
je 0x420b54
cmp ecx, dword [ecx]
pop es
or dword [edi], eax
xor edi, esp
dec edx
les edi, [eax + 0x64]
ja 0x420ba0
mov ch, 0x15
rcl byte [esi], cl
inc edx
mov ah, 0xe8
push ecx
sub al, 3
add byte [eax + eax*8 - 0x1aae98c], al
sub al, 0xc1
aas
xor eax, dword [esi - 0xf]
lodsd eax, dword [esi]
jno 0x420b11
call fcn.004537aa
test al, al
je 0x420b73
push ebp
invalid
xor edi, dword [ebx + 0x7a0b4ab8]
lea esp, [ebx - 0x3ba74ef]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x420b83
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x420b8d
push eax
call esi
call fcn.00453b70
test al, al
je 0x420ba6
pushal
cdq
sub al, ah
add eax, 0xd90f52eb
mov dh, 0x70
xor al, 0x33
ja 0x420b50
call fcn.004538be
test al, al
je 0x420bc6
int1
lahf
push eax
mov cl, 0xc8
test byte [ebx], 0x5c
push esp
int3
call fcn.004537aa
test al, al
je 0x420bee
popfd
call 0x623423f5
dec ecx
hlt
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x421010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00453720
test al, al
je 0x42103b
in eax, 0x17
in eax, 0x7e
stc
ror dword [edx + 0x51], cl
mov byte [ecx + 0xc], cl
sahf
div dword [eax + 0x7d]
pop esp
cmpsd dword [esi], dword es:[edi]
das
stosb byte es:[edi], al
adc edi, esi
pop ds
invalid
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421174
call fcn.004538be
test al, al
je 0x421086
in eax, 0x59
shl dword [ebp + 0x4b], 1
mov dword [edi - 0x62], 0xc21418c2
int3
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.WHost
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4210bd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00453cc9
test al, al
je 0x4210e1
out 0xc3, eax
ror dword [esi], 0xca
pop esi
mov ebp, 0xe337699c
xor dword [edi + ecx*2], ebp
out dx, al
mov edx, 0xbcdbc5b
adc byte [edi], cl
and eax, 0x2cbbcb63
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
call fcn.004537ef
test al, al
je 0x421131
add bl, bl
imul ebp, dword [eax + 0x3c], 0x21
js 0x421137
sbb bl, byte [edx]
int1
test eax, 0xe6f61b43
or byte fs:[esi + 0x36], dl
call fcn.00453aa1
test al, al
je 0x421156
sal byte [esp + ebx - 0xd], 0xa1
add al, 0x7a
dec esp
mov dl, byte [ebp - 0x19]
ljmp 0xd570
mov eax, dword [0x8a4c7a04]
push ebp
out 0xea, eax
push cs
inc edi
ljmp 0x6293
call fcn.00453cc9
test al, al
je 0x421174
xor al, 0x87
in eax, 0x65
lock xor ch, byte [ebp - 0x1c]
aas
popfd
aad 0x4b
sub al, cl
call 0xe0e0a9f0
enter 0x5fb9, 0x5e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x421b80
Capabilities:
Encode data using xor

Disassembly:
pop es
add byte [eax], al
add byte [esi - 0x77], ah
sbb dword [eax + eax - 0x3e750000], 0xec8b55c3
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp esi, eax
je 0x421b77
push 0xffffffffffffffff
push 0
push eax
call fcn.00402a70
mov eax, esi
pop esi
pop ebp
ret 4
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00453aa1
pop ss
pop ds
add eax, dword [eax]
test al, al
je 0x421ba9
jbe 0x421b52
xor byte [ebx - 0x64c79aa4], ah
aas
sub byte [edx + eax*4], bh
dec edx
push cs
push ebp
jl 0x421b86
dec edx
xor edi, dword [esi]
popfd
dec esi
and dword [eax - 0x17e130ba], edi
push ebp
sbb eax, 0xc0840003
call fcn.00453903
test al, al
je 0x421bc7
lodsd eax, dword [esi]
mov word [esi - 0x814900f], es
push esp
and eax, 0x637a9c8c
mov esp, 0xf7937ee0
or al, 0x1f
mov bl, 0xe8
nop
push ds
add eax, dword [eax]
call fcn.00453a5c
test al, al
je 0x421be2
xor dword [ecx], edi
pop esp
dec esp
call 0x90008345
cmc
les ebp, [edx - 0x2c]
invalid
mov ecx, ebx
call fcn.00425f70
test eax, eax
setne al
mov byte [ebx + 6], al
test al, al
jne 0x421c04
mov ecx, ebx
call fcn.00423b90
test eax, eax
setne al
mov byte [ebx + 6], al
call fcn.00453c3f
test al, al
je 0x421c1d
pushfd
jp 0x421ba3
or byte [esi - 0x65], 0xbf
lahf
inc ebp
arpl word [eax + ebp*4 - 0x6d], sp
sar ebp, 1
ja 0x421c7d
pop edi
pop esi
mov eax, 1
pop ebx
ret
inc eax
sti
invalid
Function at 0x430e70
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x80c], 0
call fcn.00453cc9
test al, al
je 0x430ee0
pushfd
push ss
and al, dh
in eax, dx
mov ebp, 0x4e752de5
inc ebx
sbb al, 0x92
xor byte [ebx], ah
ja 0x430ed2
das
wait
call fcn.00453c3f
test al, al
je 0x430f04
inc esp
ja 0x430f26
retf
call fcn.00453bfa
test al, al
je 0x430f26
mov al, byte [0x93ad5a3c]
pop ebx
xchg ebp, eax
insd dword es:[edi], dx
dec esp
dec esi
and dh, byte [eax + ecx*2 + 0x2fe1940d]
xor byte [eax], bh
sbb edx, dword [edx - 0x7d451d6f]
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
call fcn.00453bfa
test al, al
je 0x430f6f
and al, 0xc5
stosd dword es:[edi], eax
and dword [edi], edi
out dx, al
or al, 0x88
and eax, 0x587aab66
mov ebx, 0x57aef5ba
imul byte [ebx - 0x20c2ced5]
cmp al, 0xd1
inc edx
clc
cmp dword [ebp - 0x810], 0
jne 0x430fe9
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.WanNengWB_Shell_Extension
lea eax, [ebp - 0x804]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430fd6
test dx, dx
je 0x430fd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430fd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x430fb0
xor eax, eax
jmp 0x430fdb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431034
mov dword [ebp - 0x80c], 1
call fcn.00453cc9
test al, al
je 0x43100d
mov byte [0x3a28b622], al
test al, 0x5a
pushfd
int1
jnp 0x43102b
inc edi
xchg dx, ax
iretd
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x80c], 0
jmp 0x43100d
Function at 0x434860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e29cb
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00453696
test al, al
je 0x4348ab
mov ss, word [edi + eax*2 - 0x79282f8a]
ret 0x164c
xor eax, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00483520
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00402b90
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp - 0x250], ebx
call fcn.00453903
test al, al
je 0x43494b
cdq
or eax, 0x9db49261
jbe 0x434961
sti
push eax
push ebx
push 0xe378c905
call fcn.00453c84
test al, al
je 0x43497a
mov dh, 3
pop esi
popfd
leave
mov ebp, 0x58507331
lahf
xor ebp, dword [eax - 0x33]
or eax, dword [eax - 0x6e]
int 0xb
inc eax
xchg edx, eax
cmp al, bl
mov bh, 0x59
cmp esi, dword [esi]
out dx, eax
fcom qword [eax - 0x5e0160b7]
sub eax, 0xb09d8b7e
std
invalid
call fcn.00453696
test al, al
je 0x4349a1
mov edi, 0xb1686bc2
test byte [ecx], bh
xor eax, 0x19be95d5
mov al, byte [0xf564499b]
ljmp 0xe8f
test ebx, ebx
jne 0x434a69
push 0x19
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402b90
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4349f0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434a10
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x434a69
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
call fcn.00453696
test al, al
je 0x434a86
rol byte [eax], 0x23
out 0x75, eax
inc eax
sbb ah, cl
ret 0x1c5a
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x434aa4
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x438b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00483520
push esi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00407e80
add esp, 0x18
call fcn.00453b70
test al, al
je 0x438bec
call 0xe05b9c4b
sbb dword [ebx], ebp
iretd
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x438c25
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 4
push eax
push 0
push 0
push str.Start
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453aa1
test al, al
je 0x438c8c
in al, dx
std
invalid
xchg edi, eax
cmp byte [ecx + 0x5807e538], al
jns 0x438c38
cmp ecx, ebp
clc
xchg edi, eax
or al, 0x9a
pop eax
retf 0x5ec4
call fcn.00453903
test al, al
je 0x438caa
and dword [eax], ecx
stosd dword es:[edi], eax
sahf
xor esp, dword [ebp - 0x5858473e]
sahf
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
dec ebp
jae 0x438d02
scasd eax, dword es:[edi]
inc esp
sal byte [edi - 0x61], 1
call fcn.00453a5c
test al, al
je 0x438cc5
and eax, 0x1bfb4c03
push ebx
retf
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x214], 2
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
cld