joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af00
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61499b
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x40b018
mov eax, dword [esi + 8]
mov dword [esp + 8], edi
cmp eax, edi
mov dword [esp + 0xc], edi
jle 0x40b018
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
mov eax, dword [eax + ebx + 4]
push edx
push edi
push 0xf003f
push edi
push 0x6d0c38
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40afaa
lea ecx, [esp + 0x20]
call fcn.004ac190
push 1
push str.Cannot_open__create__registry_subkey_during_CBrowsersIntegration::Save__._r_n
lea ecx, [esp + 0x28]
mov dword [esp + 0x240], edi
call fcn.004ac2b0
lea ecx, [esp + 0x20]
mov dword [esp + 0x238], 0xffffffff
call fcn.004ac2a0
jmp 0x40aff0
mov ecx, dword [esi + 4]
xor eax, eax
mov edx, dword [ecx + ebx]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push 0x6a0840
push edx
call ebp
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, dword [eax + ebx + 8]
mov eax, dword [esp + 0x18]
push 4
push 0
push 0x6a083c
push eax
mov dword [esp + 0x30], ecx
call ebp
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x40af47
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, edi
pop ebx
je 0x40b018
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x40d220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
xor esi, esi
push eax
mov eax, dword [ecx + 0x14]
push 1
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d275
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.found
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d275
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
test eax, eax
je 0x40d284
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x40e0d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ecx
push ebp
push esi
push edi
push str.shell32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x40e128
push ebx
push str.SHGetFolderPathW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40e11c
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push ebp
push edi
push edi
push 0x1c
push edi
call ebx
test eax, eax
jne 0x40e116
mov edi, 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
pop ebx
jne 0x40e179
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e179
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push ebp
push eax
push eax
push str.Local_AppData
push edx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e16e
mov edi, 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x40eea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x614c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov word [esp + 0x20], bx
mov eax, dword [0x6cc708]
mov dword [esp + 0x30], ebx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
push ebx
lea edx, [esp + 0x20]
push ecx
push edx
push str.SoftwareMozillaMozilla_Firefox
mov byte [esp + 0x40], 1
call fcn.0040ebf0
add esp, 0x10
test eax, eax
je 0x40ef61
mov eax, dword [0x6cc708]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 2
cmp eax, ebx
jne 0x40ef13
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push 1
push ecx
push eax
call fcn.0040ea70
add esp, 0xc
test eax, eax
je 0x40ef53
mov edx, dword [esp + 8]
push 0x2e
push edx
call fcn.005e63d0
add esp, 8
cmp eax, ebx
je 0x40ef53
mov byte [eax], bl
mov eax, dword [esp + 8]
push eax
call fcn.005e6653
add esp, 4
cmp eax, 0x34
jle 0x40ef53
mov esi, 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.00602ad6
call fcn.00446350
test eax, eax
je 0x40f013
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x14], bx
lea ecx, [esp + 0xc]
push 1
lea edx, [esp + 0x14]
push ecx
push edx
push str.SoftwareMozillaMozilla_Firefox
mov byte [esp + 0x40], 3
call fcn.0040ebf0
add esp, 0x10
test eax, eax
je 0x40f005
mov eax, dword [0x6cc708]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], 4
cmp eax, ebx
jne 0x40efb7
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push 1
push ecx
push eax
call fcn.0040ea70
add esp, 0xc
test eax, eax
je 0x40eff7
mov edx, dword [esp + 8]
push 0x2e
push edx
call fcn.005e63d0
add esp, 8
cmp eax, ebx
je 0x40eff7
mov byte [eax], bl
mov eax, dword [esp + 8]
push eax
call fcn.005e6653
add esp, 4
cmp eax, 0x34
jle 0x40eff7
mov esi, 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 3
call fcn.00602ad6
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00401070
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x40f570
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x64
lea eax, [esp + 0x6c]
push esi
xor esi, esi
push eax
push ecx
push esi
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f66f
push edi
mov ecx, 0x19
lea edi, [esp + 8]
mov edx, dword [esp + 0x74]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x70]
lea ecx, [esp + 8]
push eax
push ecx
push esi
push esi
push str.CurrentVersion
push edx
mov dword [esp + 0x88], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x40f664
lea eax, [esp + 4]
push 0x2e
push eax
mov esi, 1
call fcn.005e63d0
add esp, 8
test eax, eax
je 0x40f5f0
mov byte [eax], 0
lea ecx, [esp + 4]
push ecx
call fcn.005e6653
add esp, 4
test eax, eax
je 0x40f664
mov edx, dword [esp + 0x84]
cmp eax, 0x34
mov dword [edx], eax
jle 0x40f618
mov eax, dword [esp + 0x80]
jmp 0x40f65e
cmp eax, 0x1a
jle 0x40f639
mov ecx, dword [esp + 0x7c]
mov dword [ecx], 1
mov ecx, dword [esp + 0x70]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x64
ret
cmp eax, 7
jle 0x40f65a
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x70]
push ecx
mov dword [edx], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x64
ret
mov eax, dword [esp + 0x74]
mov dword [eax], 1
mov ecx, dword [esp + 0x70]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x64
ret
Function at 0x4103a0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x614dcc
push eax
mov dword fs:[0], esp
sub esp, 0xb4
lea eax, [esp + 0xc]
push ebx
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4103f5
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
add esp, 0xc0
ret
push esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], ebx
mov word [esp + 0xc], bx
mov esi, dword [0x6d12b0]
mov dword [esp + 0xc4], ebx
cmp esi, ebx
jne 0x410419
mov esi, 0x6d12b4
mov ecx, 0x6a012c
test ecx, ecx
je 0x410553
cmp esi, ebx
je 0x410553
mov edx, str.idmmzcc5
test edx, edx
je 0x410553
push ebp
push edi
push ebx
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov word [esp + 0x2c], bx
call fcn.00402e00
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0xd0], 1
call fcn.0040e5a0
push str.idmmzcc5
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd0], 2
call fcn.0040e5a0
lea ecx, [esp + 0x10]
mov byte [esp + 0xcc], 3
call fcn.00401070
mov eax, dword [esp + 0x2c]
cmp eax, ebx
mov edi, eax
jne 0x41049c
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x38]
call fcn.00402400
push eax
call fcn.005e639f
push edi
mov ebp, eax
call fcn.005e639f
add esi, ebp
lea esi, [eax + esi + 3]
lea ebp, [esi + esi]
push ebp
call fcn.005feedc
mov edi, eax
add esp, 0xc
cmp edi, ebx
mov dword [esp + 0x10], edi
je 0x41051f
mov ecx, ebp
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x38]
call fcn.00402400
push eax
lea ecx, [esp + 0x30]
call fcn.00402400
push eax
lea ecx, [esp + 0x28]
call fcn.00402400
push eax
mov eax, dword [esp + 0x1c]
push esi
push eax
call fcn.005e632f
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xcc], 2
call fcn.00401070
lea ecx, [esp + 0x2c]
mov byte [esp + 0xcc], 1
call fcn.00401070
lea ecx, [esp + 0x20]
mov byte [esp + 0xcc], bl
call fcn.00401070
pop edi
pop ebp
lea edx, [esp + 0x3c]
push 0x6a0dc4
push edx
call fcn.005e6569
lea eax, [esp + 0x44]
push eax
call fcn.005e639f
add esp, 0xc
cmp eax, ebx
jle 0x41058e
lea ecx, [esp + 0x3c]
mov dx, word [ecx]
add ecx, 2
xor dx, 0x4d
sub edx, 0xff
dec eax
mov word [ecx - 2], dx
jne 0x410577
mov esi, dword [esp + 8]
cmp esi, ebx
je 0x41059a
mov eax, esi
jmp 0x4105a2
lea eax, [esp + 0xc]
lea esi, [esp + 0xc]
push eax
call fcn.005e639f
mov edx, dword [esp + 0x18]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x3c]
push eax
push esi
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
jne 0x4105ce
mov ebx, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0xb8]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret
Function at 0x412260
Capabilities:
Shutdown system
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x614f96
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0xd4
test eax, eax
je 0x4122dd
push 0
lea ecx, [esp + 0x18]
call fcn.0050ce70
lea ecx, [esp + 0x14]
mov dword [esp + 0xdc], 0
call fcn.005fead6
mov eax, 0x631e74
lea ecx, [esp + 0x70]
mov dword [esp + 0xdc], 1
mov dword [esp + 0xbc], eax
mov dword [esp + 0xac], eax
call fcn.005fd27d
lea ecx, [esp + 0x14]
mov dword [esp + 0xdc], 0xffffffff
call fcn.005fe717
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41232f
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x412cb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
add ecx, 4
push ebx
push ebp
push esi
push edi
push str.IEXPLORE
call fcn.0040d1c0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WS2_32.dll_accept
call ebp
test eax, eax
jne 0x412d83
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412d51
test ebx, ebx
je 0x412d78
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x412d48
test cl, cl
je 0x412d44
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x412d48
add eax, 2
add esi, 2
test cl, cl
jne 0x412d24
xor eax, eax
jmp 0x412d4d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412d78
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WS2_32.dll_bind
call ebp
test eax, eax
jne 0x412e3d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.DownloadUI
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412e0b
test ebx, ebx
je 0x412e32
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x412e02
test cl, cl
je 0x412dfe
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x412e02
add eax, 2
add esi, 2
test cl, cl
jne 0x412dda
xor eax, eax
jmp 0x412e07
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412e32
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x413540
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x108
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragemicrosoft.microsoftedge_8wekyb3d8bbweMicrosoftEdgeExtensionsStoredatastoreConfig
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4135d6
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
push edi
xor ebx, ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push ebx
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x4135ae
mov edi, str.IDMIntegrationModule_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push str.IDMIntegrationModule_
push eax
call fcn.005e9bc0
add esp, 0xc
test eax, eax
je 0x4135b5
inc ebx
test esi, esi
je 0x413572
jmp 0x4135c7
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.00413500
add esp, 8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x413620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x6d12f4]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.bShInstEdgeExtTip
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret

Function at 0x413660
Capabilities:
Create process on windows
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x615121
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push 0
lea ecx, [esp + 8]
call fcn.004e6ce0
lea ecx, [esp + 4]
mov dword [esp + 0x100], 0
call fcn.005fead6
mov ecx, dword [0x6d12f4]
lea eax, [esp]
push 4
push eax
push 4
push 0
push str.bShInstEdgeExtTip
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00413540
push 0
push 0
push 0
push str.ms_windows_store:__review__PFNTonecInc.IDMIntegrationModule_e7b5mm5d3r6v2
push 0x6a005c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xe0]
mov dword [esp + 0x100], 4
mov dword [esp + 0xe8], 0x631e74
call fcn.005044b0
lea ecx, [esp + 0xd8]
mov byte [esp + 0x100], 3
call fcn.005044b0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x100], 2
call fcn.0060a5e5
lea ecx, [esp + 0x60]
mov byte [esp + 0x100], 1
call fcn.0060a5e5
lea ecx, [esp + 4]
mov dword [esp + 0x100], 0xffffffff
call fcn.005fe717
mov ecx, dword [esp + 0xf8]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x104
ret
Function at 0x414e60
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
call fcn.00446350
neg eax
sbb eax, eax
lea ecx, [esp + 8]
and eax, 0x100
push ecx
add eax, 0xf003f
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x414ec6
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push 0x6a1b20
push eax
mov dword [esp + 0x24], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0x6d0c38
push 0
push 0x69ffa4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414f17
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.AdvIntDriverEnabled2
push ecx
mov dword [esp + 0x24], 1
call esi
mov edx, dword [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 8
ret
Function at 0x4155d0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xa0
push esi
lea eax, [esp + 0x10]
push edi
mov edi, ecx
push eax
xor esi, esi
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41561c
cmp dword [esp + 0x24], 2
jne 0x41561c
cmp dword [esp + 0x18], 6
jb 0x41562a
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov esi, 1
push str..IDMWFP
jmp 0x41563e
mov eax, dword [edi + 0x1c]
pop edi
pop esi
add esp, 0xa0
ret 4
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x41566d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xac]
pop edi
mov eax, 1
pop esi
mov dword [ecx], 1
add esp, 0xa0
ret 4
call fcn.00446350
mov edi, dword [esp + 0xac]
neg eax
sbb eax, eax
mov dword [edi], 0
and eax, 0x100
add eax, 0x20019
test esi, esi
je 0x4156a0
lea edx, [esp + 8]
push edx
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMWFP
jmp 0x4156ad
lea ecx, [esp + 8]
push ecx
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415705
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push 0x6a1b20
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4156fa
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x4156fa
cmp eax, 2
je 0x4156fa
mov dword [edi], 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret 4
Function at 0x416bd0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
lea eax, [esp + 8]
push eax
mov dword [esi + 0x34], ebp
call fcn.00416f90
add esp, 4
test eax, eax
jne 0x416c32
mov eax, dword [0x6d12c4]
test eax, eax
je 0x416c29
mov eax, dword [esi + 0x48]
mov cl, byte [eax + 0x3b]
test cl, cl
jne 0x416c29
mov cl, byte [eax + 0x3d]
test cl, cl
jne 0x416c29
cmp dword [esp + 8], 5
jne 0x416c22
mov ecx, esi
call fcn.0041b010
cmp dword [esp + 8], 5
jne 0x416c22
cmp dword [esi + 0x68], 1
jne 0x416c29
mov ecx, dword [esi + 0x48]
mov byte [ecx + 0x40], 1
mov ecx, esi
call fcn.004185e0
jmp 0x416c57
mov eax, dword [esi + 0x48]
mov cl, byte [eax + 0x3b]
test cl, cl
jne 0x416c57
mov cl, byte [eax + 0x3d]
test cl, cl
jne 0x416c57
push 0
push 0
push 0
push 0
push 0
push 0x416a20
call fcn.006030d4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x416d16
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x416d16
mov eax, dword [0x6d12f4]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.IDMBIIEXPLORE
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416cc3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push eax
push 0x6a083c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebp
pop ecx
ret 8
mov edx, dword [0x6d12f4]
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6d0c38
push 0
push str.IDMBIIEXPLORE
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x416d16
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
push 0x6a083c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebp
pop ecx
ret 8
Function at 0x416f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61552b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], 0
call esi
mov edi, dword [ebp + 8]
test eax, eax
mov dword [edi], eax
jne 0x41711a
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push eax
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push edx
call esi
test eax, eax
jne 0x41711a
mov edx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push 0
push str.NoExplorer
push edx
mov dword [ebp - 0x20], 4
call ebx
test eax, eax
jne 0x41711a
cmp dword [ebp - 0x1c], 1
jne 0x41711a
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00446350
test eax, eax
je 0x4170ce
lea edx, [ebp - 0x18]
push edx
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.WS2_32.dll_bind
call esi
test eax, eax
mov dword [edi], eax
jne 0x41711a
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push ecx
call esi
test eax, eax
jne 0x41711a
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + 8]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push 0
push str.NoExplorer
push ecx
mov dword [ebp + 8], 4
call ebx
test eax, eax
jne 0x41711a
cmp dword [ebp - 0x1c], 1
jne 0x41711a
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x18]
push eax
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret