joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408bc8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x408c07
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x402508
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x408c1d
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push 0x402508
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408c9f
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
mov ecx, dword [ebp - 0x210]
call fcn.00408ac0
cmp dword [ebp + 0x10], 0
je 0x408c5e
cmp dword [ebp + 0x14], 0
jne 0x408c55
test eax, eax
je 0x408c93
push 0x18
push 0x402aec
jmp 0x408c84
cmp dword [ebp + 0x14], 0
jne 0x408c7e
test eax, eax
jne 0x408c93
lea eax, [ebp - 0x20c]
push eax
push 0x402aec
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x408c93
push esi
push 0x401d54
push 1
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 0x10

Function at 0x408cb5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x90]
xor edi, edi
push eax
push 1
push edi
push 0x402730
push reloc.SHLWAPI.dll_ParseURLW
mov ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x408d7d
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x90]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
test esi, esi
jne 0x408d7d
xor ecx, ecx
lea eax, [ebp - 0x8c]
push ecx
push eax
push ecx
push 2
push ecx
push ecx
push ecx
push 0x402730
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x408d75
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 0x8c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x408ff4
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
mov edi, ecx
lea ecx, [ebp - 0x20c]
push edx
push edi
mov edx, 0x104
call fcn.0040d512
lea ecx, [ebp - 0x20c]
call fcn.0040a985
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x409698
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push ebx
push esi
push edi
push 0x4024a0
push 0x402878
push 0x104
push eax
mov esi, edx
call fcn.00407674
add esp, 0x10
mov dword [ebp - 0x214], 4
lea eax, [ebp - 0x214]
mov ebx, 0x4024f0
mov edi, SysReAllocStringLen
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x210]
and eax, esi
or eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 4
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 4

Function at 0x4097e8
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x41e004]
xor eax, esp
mov dword [esp + 0x41c], eax
push 0
push 0x10
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40985e
lea ecx, [esp + 8]
call fcn.0040974d
push 0x104
lea eax, [esp + 0x214]
push eax
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x40985e
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0xc]
call fcn.0040d79f
lea ecx, [esp + 8]
call fcn.0040974d
lea eax, [esp]
mov dword [esp], 0x208
push eax
lea eax, [esp + 0x214]
push eax
lea eax, [esp + 0xc]
push eax
push 0x40215c
push 0x402198
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4098b1
push 0x104
lea eax, [esp + 0x214]
push eax
push 0x11
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4098e0
push 0
push 2
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4098e0
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0xc]
call fcn.0040d79f
lea ecx, [esp + 8]
call fcn.0040974d
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x4098f7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
cmp dword [ebp + 8], esi
jbe 0x40994a
push 0
push dword [ebx + esi*4]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x409944
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [ebp - 0x20c]
push 0
call fcn.0040954a
inc esi
cmp esi, dword [ebp + 8]
jb 0x40991a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 8
Function at 0x409962
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test esi, esi
je 0x4099a4
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x40999e
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 2
pop edx
call fcn.0040954a
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
add edi, 0x10
dec esi
jne 0x409972
pop edi
pop esi
pop ebp
ret 8

Function at 0x4099af
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
lea eax, [ebp - 0x61c]
push esi
push ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x409ac3
push ebx
push ecx
push 0x401e14
lea eax, [ebp - 0x61c]
mov ebx, 0x104
push eax
mov edx, ebx
lea ecx, [ebp - 0x20c]
call fcn.0040d512
push esi
push esi
push 2
pop edx
lea ecx, [ebp - 0x20c]
call fcn.0040954a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x414]
push eax
push 0x2db
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x414]
push eax
call esi
push ecx
lea eax, [ebp - 0x414]
mov edx, 0x104
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040d512
push 0
push 0
push 2
pop edx
lea ecx, [ebp - 0x20c]
call fcn.0040954a
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x2dd
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
call esi
push ecx
lea eax, [ebp - 0x414]
mov edx, 0x104
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040d512
push 0
push 0
push 2
pop edx
lea ecx, [ebp - 0x20c]
call fcn.0040954a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x409c39
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x409c78
push 1
push esi
xor edx, edx
lea ecx, [ebp - 0x20c]
call fcn.0040954a
test esi, esi
je 0x409c85
call fcn.00409b4f
test al, al
je 0x409c8c
mov edx, esi
call fcn.00409ba5
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 4
Function at 0x409cff
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409daa
push 0x402360
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.0040875f
test eax, eax
js 0x409daa
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x260]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x260], esi
lea edi, [ebp - 0x21c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x409daa
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x409dbf
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x409e3b
cmp dword [ebp - 0x28], 0
je 0x409e3b
push edi
lea eax, [ebp - 0x28]
mov edi, SysReAllocStringLen
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, 2
jne 0x409e3a
lea eax, [ebp - 0x28]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x409e3a
push 7
pop ecx
mov byte [ebp - 0x24], al
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
push 0x1e
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push eax
push 3
push 0
push 0x40285c
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x409e4f
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x18], edx
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
lea eax, [ebp - 8]
mov ebx, ecx
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x409fa4
push edi
push 2
pop edx
cmp dword [ebp - 4], esi
jbe 0x409f25
mov eax, dword [ebp - 8]
test eax, eax
je 0x409f25
inc eax
xor ecx, ecx
mov dword [ebp - 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov edi, eax
pop ecx
test edi, edi
je 0x409f22
cmp dword [ebp - 4], esi
jbe 0x409f1a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x409f14
and dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409f14
push dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
call fcn.00409e4f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [ebp - 4]
jb 0x409ec6
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push 2
pop edx
cmp dword [ebp - 0x10], 0
jbe 0x409fa3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409fa3
inc eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x409fa3
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x409f9b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [edi - 1]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x409f98
mov eax, dword [ebp + 8]
cmp dword [ebp - 0xc], eax
jb 0x409f98
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x409f98
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec edi
jne 0x409f56
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a067
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x20c]
call fcn.00419cf0
mov esi, eax
test esi, esi
js 0x40a166
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a0c5
call fcn.0040e299
mov esi, eax
test esi, esi
js 0x40a164
push ebx
push ebx
push 4
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a0df
mov esi, ebx
jmp 0x40a0e6
call fcn.0040e299
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
js 0x40a164
cmp dword [ebp - 0x414], 0x4020000
je 0x40a164
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a119
call fcn.0040e299
mov esi, eax
test esi, esi
js 0x40a164
mov edx, 0x100
lea ecx, [ebp - 0x40c]
call fcn.00419d52
mov esi, eax
test esi, esi
js 0x40a164
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], ebx
push eax
sub esp, 0xc
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x20c]
push eax
call fcn.00418a9b
mov esi, eax
test esi, esi
js 0x40a164
mov ecx, dword [ebp - 0x410]
call fcn.00418cd3
mov esi, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x40a435
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
test ecx, ecx
je 0x40a465
push 0x402b08
push 0x4023d8
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40a4b0
push ecx
push ecx
lea ecx, [ebp - 0x20c]
call fcn.0040b515
test al, al
je 0x40a4b0
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a47f
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x402b08
push 0x4023d8
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x40a80d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 2
push esi
push esi
push esi
push 0x402308
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a861
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push esi
push 0x4022d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40aa95
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x60]
mov dword [ebp - 8], edx
push 0
push eax
mov ebx, ecx
mov dword [ebp - 4], 0x57
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x60], esi
lea edi, [ebp - 0x18]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [ebp - 0x30], ax
inc eax
mov dword [ebp - 0x34], eax
test ebx, ebx
je 0x40ab4e
or dword [ebp - 0x28], 0xffffffff
xor esi, esi
or dword [ebp - 0x20], 0xffffffff
push esi
push 0x80
push 2
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push esi
push 0x40000000
push ebx
mov dword [ebp - 0x6c], 0xc
mov dword [ebp - 0x68], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x40aba6
push 2
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x20]
push eax
call esi
push eax
push dword [ebp - 0x24]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x40ab8c
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
or dword [ebp - 0x34], 0x100
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 0x10
push 1
push esi
push esi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40ab9d
push 0x2bf20
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40abad
cmp eax, 0x102
jne 0x40abbe
mov dword [ebp - 4], esi
jmp 0x40abc7
push dword [ebp - 0x24]
or dword [ebp - 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x24], 0xffffffff
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
mov dword [ebp - 4], eax
jmp 0x40ab9d
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x40abc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
or edi, 0xffffffff
cmp ebx, edi
je 0x40ac02
cmp dword [ebp - 0x24], edi
je 0x40abeb
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x20], edi
je 0x40abf8
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x28], edi
je 0x40ac02
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 4]
jmp 0x40ab9f
Function at 0x40ac0c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ecx]
xor ebx, ebx
push edi
jmp 0x40ad1d
push 1
push 0x32
lea eax, [ebp - 0x288]
push eax
push 0x32
push 0x402b38
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x40ad1d
push 0x64
lea eax, [ebp - 0xf8]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x13
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 0x63
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x288]
push 0x402ba0
push eax
call dword [sym.imp.msvcrt.dll_swscanf_s]
add esp, 0x18
cmp eax, 2
jne 0x40ad1d
push 1
push 0xb
lea eax, [ebp - 0x2c]
push eax
push 0xb
push 0x402bb0
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x40ad1d
push 0x402bc8
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x40ad1d
lea eax, [ebp - 0xf8]
mov edi, 0x200
push eax
push 0x402bd8
lea eax, [ebp - 0x688]
push edi
push eax
call fcn.00407674
add esp, 0x10
test eax, eax
js 0x40ad1d
push edi
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jae 0x40ad15
lea edx, [ebp - 0xa88]
xor ecx, ecx
call fcn.0040aa95
jmp 0x40ad18
push 0x57
pop eax
test eax, eax
jne 0x40ad1d
inc ebx
push esi
lea eax, [ebp - 0x288]
push 0xc8
push eax
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0xc
test eax, eax
jne 0x40ac2d
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x40b43a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 1
push eax
push 0
push 2
push dword [0x403c30]
call dword [sym.imp.iertutil.dll_Ordinal_654]
mov esi, eax
test esi, esi
js 0x40b4ff
push 0x104
lea eax, [ebp - 0x20c]
mov esi, 0x80004005
push eax
push 0x402ee4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40b4df
push 0x401cdc
lea eax, [ebp - 0x20c]
push eax
push 0x402ef8
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00407674
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40b4df
push dword [0x403f60]
lea edx, [ebp - 0x414]
call fcn.0040c648
mov esi, eax
test esi, esi
jns 0x40b4ff
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push 4
push eax
push 0
push 2
push dword [0x403c30]
call dword [sym.imp.iertutil.dll_Ordinal_654]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x40b515
Capabilities:
Get common file path
Get program files directory
Get system information on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x210], ebx
je 0x40b58b
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x402f58
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x40b5ee
push 0x402f9c
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
test eax, eax
js 0x40b5ee
mov edx, edi
jmp 0x40b5da
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push ebx
push 0x26
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40b5ee
push 0x402fb8
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
test eax, eax
js 0x40b5ee
push 0x402f9c
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
test eax, eax
js 0x40b5ee
mov edx, 0x104
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00407605
test eax, eax
js 0x40b5ee
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 8