joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409bb9
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040a4cd
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x409cc7
cmp ebx, edx
jge 0x409c0e
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x409c10
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409bf3
cmp ecx, edx
jne 0x409c18
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x409bdf
cmp eax, 0xa
jg 0x409cc7
mov dword [ebp - 4], 0x41dec0
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x41dfe0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x409c73
add eax, edx
dec edi
jne 0x409c71
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x409cc7
cmp ebx, edx
jge 0x409cb0
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x409cb2
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409c94
cmp ecx, edx
jne 0x409cb9
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x409c86
cmp dword [ebp + 8], 0xa
jle 0x409c2c
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409cce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x41aec0]
xor dl, byte [eax + ebx*4 + 0x41b6c0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x41bac0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x41b2c0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x409cf6
inc eax
cmp eax, edi
jl 0x409ce9
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040a4cd
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x409ce7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40be0d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push 0x400
lea eax, [ebp - 0x820]
push eax
call fcn.00413135
cmp byte [0x424925], 0
jne 0x40be9b
push 6
push dword [0x41609c]
lea eax, [ebp - 0x820]
push eax
call fcn.004072cf
push eax
call fcn.0040efb8
test eax, eax
jne 0x40be9b
push 0x4145e8
call fcn.00413122
lea eax, [ebp - 0x820]
push eax
call fcn.0040a826
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x81e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0040a4a0
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40bf66
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
mov byte [0x424911], 1
cmp dword [0x424920], ebx
je 0x40bf8e
push 0x7d
call fcn.00409b0b
push eax
push 2
push dword [0x424920]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x424920]
mov dword [0x424914], ebx
mov byte [0x424910], 1
cmp eax, ebx
je 0x40bfef
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x424934], ebx
jne 0x40bfbd
cmp byte [0x424924], bl
je 0x40bfc5
cmp dword [0x424918], ebx
jne 0x40bfe7
push ebx
push 1
push 0x111
push dword [0x424920]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40bfe7
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040af16
cmp dword [0x424920], ebx
jne 0x40bfdb
cmp byte [0x424950], bl
pop ebx
je 0x40bffd
jmp fcn.0040be0d
ret

Function at 0x40c039
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
xor ebx, ebx
cmp byte [0x424958], bl
je 0x40c0b9
cmp word [str.C:UsersADMINI1AppDataLocalTempZebra_ZD_PrnInst], bx
je 0x40c0b9
push esi
push str.C:UsersADMINI1AppDataLocalTempZebra_ZD_PrnInst
lea esi, [ebp - 0x808]
call fcn.0040bffe
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40c0b9
push dword [ebp + 8]
call fcn.0040a826
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x808]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4
Function at 0x3a92058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.03a921a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x3a9207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3a9206a
add dl, dl
jne 0x3a92089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3a920dc
xor eax, eax
add dl, dl
jne 0x3a92096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3a9217d
add dl, dl
jne 0x3a920a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3a920b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3a920bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3a920c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x3a920d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x3a92075
mov eax, 1
add dl, dl
jne 0x3a920ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3a920f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3a920e1
sub eax, ebx
mov ebx, 1
jne 0x3a92128
mov ecx, 1
add dl, dl
jne 0x3a9210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3a92119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3a92105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3a92075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x3a9213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3a9214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3a92136
cmp eax, 0x7d00
jae 0x3a9216d
cmp eax, 0x500
jb 0x3a92168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3a92075
cmp eax, 0x7f
ja 0x3a92170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3a92075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x3a9219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x3a92075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x10f46058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10f461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10f4607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f4606a
add dl, dl
jne 0x10f46089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f460dc
xor eax, eax
add dl, dl
jne 0x10f46096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f4617d
add dl, dl
jne 0x10f460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10f460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10f46075
mov eax, 1
add dl, dl
jne 0x10f460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f460e1
sub eax, ebx
mov ebx, 1
jne 0x10f46128
mov ecx, 1
add dl, dl
jne 0x10f4610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f46119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f46105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f46075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10f4613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f4614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f46136
cmp eax, 0x7d00
jae 0x10f4616d
cmp eax, 0x500
jb 0x10f46168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f46075
cmp eax, 0x7f
ja 0x10f46170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f46075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10f4619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10f46075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4076c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095f0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072b0
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x407756
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407820
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077aa
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40774f
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077c6
call fcn.0040d306
mov dword [eax], 0x16
call fcn.0040d23a
jmp 0x4077d5
push 0x1034
push edi
push eax
call fcn.00408e00
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b11
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407989
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x49642325
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x409945b2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x258
push esi
push edi
mov esi, dword [esp + 0x268]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x264]
mov dword [esp + 0x1c], 0x44
test edi, edi
je 0x40104e
test esi, esi
je 0x40104e
push esi
push edi
lea eax, [esp + 0x68]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea esi, [esp + 0x60]
xor edi, edi
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4010e3
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esp + 0x26c]
test edi, edi
je 0x4010a3
mov edx, dword [esp + 0xc]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [edi], eax
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [0x41b38c]
mov eax, dword [ecx]
test eax, eax
je 0x4010d5
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [0x41b38c]
push 0x85
push 0
push 0
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
mov eax, 1
pop esi
add esp, 0x258
ret
test esi, esi
mov dword [esp + 8], 0
jne 0x4010f3
lea esi, [esp + 8]
test edi, edi
jne 0x4010fb
lea edi, [esp + 8]
push esi
push edi
push 0x100b
call fcn.0040c000
add esp, 0xc
xor eax, eax
pop edi
pop esi
add esp, 0x258
ret

Function at 0x4012f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401391
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ecx
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401386
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x401377
cmp eax, 2
jbe 0x401386
cmp eax, 4
ja 0x401386
mov edx, dword [esp + 4]
mov esi, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
lea ecx, [esp + 0xc]
push ecx
call fcn.0040d42d
add esp, 4
mov esi, eax
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4013a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20006
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40140a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4013dd
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4013f8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
sbb esi, esi
push eax
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x401450
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40149e
pop edi
pop esi
add esp, 0x110
ret
push ebx
push esi
xor ebx, ebx
call fcn.0040d4a1
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push edi
push esi
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4014f5
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push 0x4180c8
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4014f5
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x124]
mov ebx, 1
mov edx, dword [eax + 0xc]
mov dword [ecx], edx
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
push edi
call fcn.0040d438
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x110
ret

Function at 0x401860
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401889
test al, 0x10
jne 0x4018e9
push edi
push 0x1001
call fcn.0040bfe0
add esp, 8
xor eax, eax
pop edi
pop esi
ret
push 0x5c
push edi
call fcn.0040d560
mov esi, eax
add esp, 8
test esi, esi
je 0x4018bc
push edi
mov byte [esi], 0
call fcn.00401860
add esp, 4
mov byte [esi], 0x5c
test eax, eax
je 0x4018ff
mov al, byte [esi + 1]
test al, al
jne 0x4018bc
pop edi
mov eax, 1
pop esi
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4018f1
mov ecx, dword [0x41b370]
push 0
push 0
push edi
push 0x646b6d40
call fcn.0040c8a0
push 1
push edi
call fcn.00401740
add esp, 8
pop edi
mov eax, 1
pop esi
ret
push edi
push 0x1001
call fcn.0040c000
add esp, 8
pop edi
xor eax, eax
pop esi
ret
Function at 0x401910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x401ba0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x404
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401bcf
xor eax, eax
add esp, 0x404
ret
push esi
push edi
mov edi, dword [esp + 0x410]
push 0x5c
push edi
call fcn.0040d560
mov esi, eax
add esp, 8
test esi, esi
je 0x401bec
inc esi
jmp 0x401bee
mov esi, edi
mov ecx, dword [0x41b38c]
push edi
add ecx, 0x64c
lea edx, [esp + 0x10]
push ecx
push str._s_regsvr32.exe__s___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 8]
inc eax
lea ecx, [esp + 0xc]
push eax
push ecx
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x404
ret
Function at 0x403550
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push esi
push edi
push eax
push 0x416358
push 1
push 0
mov esi, ecx
push 0x416348
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jl 0x40361c
mov eax, dword [esi + 0xc]
push eax
push eax
call fcn.0040c350
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
add esp, 8
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esi + 0x14]
cmp byte [eax], 0
je 0x4035ab
mov ecx, dword [esp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov esi, dword [esi + 0x1c]
cmp byte [esi], 0
je 0x4035be
mov eax, dword [esp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x416378
mov edx, dword [eax]
push eax
call dword [edx]
mov edi, eax
test edi, edi
jl 0x403612
mov eax, dword [esp + 0x21c]
lea edx, [esp + 0x10]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
test edi, edi
pop edi
pop esi
setge al
add esp, 0x210
ret 4
Function at 0x403bb0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x415029
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 2]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea edx, [esp + 0xa]
lea ecx, [esi + 0x10]
push edx
mov dword [esp + 0x1c], ebx
call fcn.00405ce0
mov al, byte [esp + 0xa]
mov dword [esi + 0x24], ebx
mov byte [esi + 0x20], al
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea edx, [esp + 0xa]
lea ecx, [esi + 0x30]
push edx
mov byte [esp + 0x1c], 2
call fcn.00405ce0
lea eax, [esp + 0xb]
lea ecx, [esi + 0x40]
push eax
mov byte [esp + 0x1c], 3
call fcn.00405ce0
mov cl, byte [esp + 0xb]
mov dl, byte [esp + 0xb]
mov al, byte [esp + 0xb]
mov byte [esi + 0x50], cl
mov cl, byte [esp + 0xb]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x60], dl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], al
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x80], cl
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0xc38], ebx
mov dword [esi + 0xc3c], ebx
mov byte [esi + 0x82c], bl
mov byte [esi + 0x930], bl
mov byte [esi + 0xc44], bl
mov byte [esi + 0xa34], bl
mov byte [esi + 0xab4], bl
mov byte [esi + 0xb34], bl
mov dword [esi + 0xc40], ebx
mov dword [esi + 0xc48], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret