joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f8a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00427f40
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x40f908
xor eax, eax
movzx ecx, word [ebp + eax - 0x44]
mov word [eax + 0x48d998], cx
add eax, 2
test cx, cx
jne 0x40f8e1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x410d10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x280c
call fcn.0042cd90
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1006]
push ecx
mov word [ebp - 0x1008], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x2006]
push eax
mov word [ebp - 0x2008], dx
call fcn.00427f40
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x806]
push edx
mov word [ebp - 0x808], cx
call fcn.00427f40
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x2806]
push ecx
mov word [ebp - 0x2808], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1806]
push eax
mov word [ebp - 0x1808], dx
call fcn.00427f40
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push 0x48e1d8
push 0x3fe
lea ecx, [ebp - 0x1008]
push ecx
push 0x43c324
push 0x440974
push 0x440780
call esi
push 0x48e1d8
push 0x3fe
lea edx, [ebp - 0x2008]
push edx
push 0x43c324
push str.Passphrase
push 0x440780
call esi
lea eax, [ebp - 0x1008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410e13
sub eax, edx
sar eax, 1
je 0x410f8d
lea ecx, [ebp - 0x2008]
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410e31
sub ecx, esi
sar ecx, 1
je 0x410f8d
cmp eax, 0x90
jbe 0x410f86
cmp ecx, 0x90
jbe 0x410f86
lea edi, [ebp - 0x2808]
lea esi, [ebp - 0x2008]
call fcn.00407400
lea edi, [ebp - 0x808]
lea esi, [ebp - 0x1008]
call fcn.00407400
mov eax, edi
push 0x5c
push eax
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x410eff
xor eax, eax
jmp 0x410ea0
movzx ecx, word [ebp + eax - 0x808]
mov word [ebp + eax - 0x1808], cx
add eax, 2
test cx, cx
jne 0x410ea0
lea ecx, [ebp - 0x1808]
push 0x5c
push ecx
call fcn.00421cfc
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x808]
push 0x5c
push eax
call fcn.00421cfc
add eax, 2
lea edx, [ebp - 0x808]
add esp, 0x10
sub edx, eax
jmp 0x410ef0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410ef0
lea eax, [ebp - 0x2808]
lea edx, [eax + 2]
jmp 0x410f10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410f10
sub eax, edx
lea ecx, [ebp - 0x1808]
push ecx
sar eax, 1
push eax
lea edx, [ebp - 0x808]
push edx
push str.DispatchRange
push 0x48d198
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x48d198
call fcn.00406870
add esp, 4
push 0x488870
lea edi, [ebp - 0x2808]
lea ebx, [ebp - 0x808]
call fcn.0040ec10
add esp, 4
test eax, eax
je 0x410faa
mov eax, 1
mov dword [0x48786c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
push 0x4409f8
jmp 0x410f92
push 0x440998
push 0x48d198
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x48d198
call fcn.00406870
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x410fc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x280c
call fcn.0042cd90
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1006]
push ecx
mov word [ebp - 0x1008], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x2006]
push eax
mov word [ebp - 0x2008], dx
call fcn.00427f40
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x806]
push edx
mov word [ebp - 0x808], cx
call fcn.00427f40
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x2806]
push ecx
mov word [ebp - 0x2808], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1806]
push eax
mov word [ebp - 0x1808], dx
call fcn.00427f40
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push 0x48e1d8
push 0x3fe
lea ecx, [ebp - 0x1008]
push ecx
push 0x43c324
push 0x440974
push 0x440abc
call esi
push 0x48e1d8
push 0x3fe
lea edx, [ebp - 0x2008]
push edx
push 0x43c324
push str.Passphrase
push 0x440abc
call esi
lea eax, [ebp - 0x1008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4110c3
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x411218
lea eax, [ebp - 0x2008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4110e6
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x411218
lea edi, [ebp - 0x2808]
lea esi, [ebp - 0x2008]
call fcn.00407400
lea edi, [ebp - 0x808]
lea esi, [ebp - 0x1008]
call fcn.00407400
mov eax, edi
push 0x5c
push eax
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x41119f
xor eax, eax
jmp 0x411140
movzx ecx, word [ebp + eax - 0x808]
mov word [ebp + eax - 0x1808], cx
add eax, 2
test cx, cx
jne 0x411140
lea ecx, [ebp - 0x1808]
push 0x5c
push ecx
call fcn.00421cfc
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x808]
push 0x5c
push eax
call fcn.00421cfc
add eax, 2
lea edx, [ebp - 0x808]
add esp, 0x10
sub edx, eax
jmp 0x411190
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x411190
lea eax, [ebp - 0x2808]
lea edx, [eax + 2]
jmp 0x4111b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4111b0
sub eax, edx
lea ecx, [ebp - 0x1808]
push ecx
sar eax, 1
push eax
lea edx, [ebp - 0x808]
push edx
push str.ServerLog
push 0x48d198
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x48d198
call fcn.00406870
add esp, 4
push 0x487660
lea edi, [ebp - 0x2808]
lea ebx, [ebp - 0x808]
call fcn.0040ec10
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
push 0x440ad0
push 0x48d198
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x48d198
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x411250
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
call fcn.00427f40
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x411398
jne 0x4112c2
cmp dword [ebp - 0x118], 2
jb 0x411398
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0xf003f
xor edx, edx
cmp byte [ebp + 8], 1
push 0
push 0
sete dl
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerPower
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x128], edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x411398
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x134]
push ecx
push 0
push str.HiberbootEnabled
push edx
mov dword [ebp - 0x134], 4
mov dword [ebp - 0x138], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411359
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x128]
je 0x411378
mov ecx, dword [ebp - 0x124]
push 4
lea eax, [ebp - 0x128]
push eax
push 4
push 0
push str.HiberbootEnabled
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x4113b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00427f40
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x48bf60
lea edx, [ebp - 0x210]
push str._sPCScript.dat
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x411449
lea edx, [ebp - 0x210]
push edx
push 0x440bdc
push 0x48d198
call esi
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x458]
push eax
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x474]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPCScriptUpdateInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x480], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4114c9
push 0x440c40
push 0x48d198
call esi
push 0x48d198
call fcn.00406870
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x474]
push 8
lea edx, [ebp - 0x47c]
push edx
push 3
push 0
push str.ForceUpdateTime
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x474]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x488]
push edx
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x216]
movzx edx, word [ebp - 0x218]
push eax
movzx eax, word [ebp - 0x21a]
push ecx
movzx ecx, word [ebp - 0x21e]
push edx
movzx edx, word [ebp - 0x220]
push eax
push ecx
push edx
push 0x440c88
push 0x48d198
call esi
push 0x48d198
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x4120a0
Capabilities:
Delete directory

Disassembly:
push ecx
push 0
push 0
push str.C:UsersPublicSMR7WM7installTemp
call fcn.004084d0
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
pop ecx
ret
Function at 0x4128b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x48aeec]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1a
push 0x402
push eax
call esi
call fcn.00417c90
test eax, eax
jne 0x4128f5
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x48aeec]
push 0
push 0x1e
push 0x402
push ecx
call esi
push 0
call fcn.00418020
add esp, 4
call fcn.004184e0
mov edx, dword [0x48aeec]
push 0
push 0x1f
push 0x402
push edx
call esi
push str._Terminate_All_Process_.
call fcn.00406870
add esp, 4
call fcn.00419980
test al, al
je 0x4128e4
mov eax, dword [0x48aeec]
push 0
push 0x2d
push 0x402
push eax
call esi
call fcn.00403ad0
test eax, eax
jne 0x41297c
call fcn.00404850
test eax, eax
jne 0x41297c
call fcn.00404980
test eax, eax
jne 0x41297c
push str._Terminate_Driver_.
call fcn.00406870
add esp, 4
call fcn.00418970
call fcn.00419fe0
push 0x11c
lea ecx, [ebp - 0x128]
push 0
push ecx
call fcn.00427f40
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4129bc
call fcn.0041a640
mov eax, dword [0x48aeec]
push 0
push 0x31
push 0x402
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x4129e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe64
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x103
lea edx, [ebp - 0x113]
push 0
push edx
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0xe58], ecx
mov byte [ebp - 0x114], 0
call fcn.00427f40
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x513]
push 0
push eax
mov byte [ebp - 0x514], 0
call fcn.00427f40
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xd12]
push edx
mov word [ebp - 0xd14], cx
call fcn.00427f40
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
lea eax, [ebp - 0x114]
push str._s.EXE
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0xe54]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0xe60], ebx
cmp ebx, 0xffffffff
jne 0x412ab0
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00427f40
add esp, 0xc
lea ecx, [ebp - 0xe28]
push ecx
push esi
lea edx, [ebp - 0x114]
push str._s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
test eax, eax
jne 0x412b7d
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x514]
push 0x441590
push edx
call edi
lea eax, [ebp - 0xd14]
add esp, 0xc
push eax
lea ebx, [ebp - 0x514]
call fcn.0040d440
lea ecx, [ebp - 0xd14]
add esp, 4
push ecx
call fcn.00406870
add esp, 4
push 0x104
push 0
push 0x48e3e8
call fcn.00427f40
add esp, 0xc
xor eax, eax
jmp 0x412b50
mov cl, byte [ebp + eax - 0x114]
mov byte [eax + 0x48e3e8], cl
inc eax
test cl, cl
jne 0x412b50
mov edx, dword [ebp - 0xe58]
mov ecx, dword [ebp - 0xe5c]
push esi
call fcn.0040e340
mov ebx, dword [ebp - 0xe60]
add esp, 4
lea edx, [ebp - 0xe54]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412ab0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x413e10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x20c], 0
mov word [ebp - 0x204], ax
call fcn.00427f40
lea edx, [ebp - 0x204]
push str.SystemCurrentControlSetServicesWin_Win7
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x413eff
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x208]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x413ed0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x208]
push edx
push 0xf003f
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x413eff
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x413f10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x414af0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa6c
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa0e]
push eax
mov word [ebp - 0xa10], dx
call fcn.00427f40
add esp, 0xc
push 0x48b128
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call fcn.004237b8
add esp, 0xc
push str.wmcUpdater.exe__smr_stop
lea edx, [ebp - 0x210]
push 0x104
push edx
call fcn.00423743
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa10]
push 0x442938
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0xa10]
add esp, 0xc
push edx
call fcn.00406870
add esp, 4
push 0x44
lea eax, [ebp - 0xa68]
push 0
push eax
call fcn.00427f40
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0xa20]
push ecx
lea edx, [ebp - 0xa68]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0xa68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x414c26
mov ecx, dword [ebp - 0xa20]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xa1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0xa20]
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x4178c0
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
push 0x1fe
lea ecx, [ebp - 0x206]
xor eax, eax
push edi
push ecx
xor bl, bl
mov dword [ebp - 0x60c], edi
mov dword [ebp - 0x614], edi
mov word [ebp - 0x208], ax
call fcn.00427f40
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x606]
xor edx, edx
push edi
push eax
mov word [ebp - 0x608], dx
call fcn.00427f40
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea ecx, [ebp - 0x208]
push str.SystemCurrentControlSetServices_s
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x60c]
push edx
push 0x2001f
push 0
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4179e8
push esi
lea ecx, [ebp - 0x608]
push 0x445434
push ecx
call edi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.00406870
add esp, 4
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4179e6
push esi
lea eax, [ebp - 0x608]
push 0x445468
push eax
call edi
lea ecx, [ebp - 0x608]
add esp, 0xc
push ecx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov bl, 1
mov eax, dword [ebp - 0x60c]
push 4
lea edx, [ebp - 0x610]
push edx
push 4
push 0
push str.TestValue
push eax
mov dword [ebp - 0x610], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x417a55
push eax
lea ecx, [ebp - 0x608]
push 0x4454b8
push ecx
call edi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.00406870
mov eax, dword [ebp - 0x60c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x60c]
push str.TestValue
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
lea edx, [ebp - 0x608]
push 0x445500
push edx
call edi
lea eax, [ebp - 0x608]
add esp, 0xc
push eax
call fcn.00406870
mov ecx, dword [ebp - 0x60c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x417acc
lea edx, [ebp - 0x60c]
push edx
push 0xf003f
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417acc
mov ecx, dword [ebp - 0x60c]
lea eax, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00421294
mov esp, ebp
pop ebp
ret
Function at 0x417af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x206]
push ecx
mov word [ebp - 0x208], ax
call fcn.00427f40
add esp, 0xc
mov dword [ebp - 0x60c], 0
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SystemCurrentControlSetServicesWin_Win]
mov word [ebp + eax - 0x208], cx
add eax, 2
test cx, cx
jne 0x417b30
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417b9a
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x417b7c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x445548
call fcn.00406870
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x406]
push edx
mov word [ebp - 0x408], cx
call fcn.00427f40
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x606]
push ecx
mov dword [ebp - 0x610], 1
mov word [ebp - 0x608], ax
call fcn.00427f40
add esp, 0xc
mov dword [ebp - 0x614], 0x200
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x43b908]
mov word [ebp + eax - 0x408], cx
add eax, 2
test cx, cx
jne 0x417bf0
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x608]
push eax
mov eax, dword [ebp - 0x60c]
lea ecx, [ebp - 0x610]
push ecx
push 0
lea edx, [ebp - 0x408]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x417c45
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x417c67
push 0x445578
call fcn.00406870
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
push 0x4455ac
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00421294
mov esp, ebp
pop ebp
ret