joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402bdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x412014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c54
xor eax, eax
push ebp
push 0x402c4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c54
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x412014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x412014], ax
mov esp, ebp
pop ebp
ret

Function at 0x4035b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x403611
cmp word [0x414218], 0xd7b2
jne 0x4035d9
cmp dword [0x414220], 0
jbe 0x4035d9
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41205c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403638
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x412020], 0
jne 0x40362d
push 0
push 0x412054
push 0x41205c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40432c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40455c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4043af
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40455c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4043af
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404578
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404438
xor eax, eax
push ebp
push 0x404431
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404174
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404416
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404598
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404416
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404438
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404552
cmp byte [ebp - 0xd], 0
jne 0x40447f
cmp byte [ebp - 0x12], 0
je 0x404552
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404498
dec ebx
cmp byte [ebx], 0x2e
je 0x4044a7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404497
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404552
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4044e4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404552
cmp byte [ebp - 0xd], 0
je 0x404552
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404552
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4046e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40474e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403980
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004027d0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404738
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404755
lea eax, [ebp - 0x10]
call fcn.0040372c
ret

Function at 0x4051a8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
cmp bl, 0x90
jne 0x4051ed
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
push esp
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4051dd
and byte [esp + 0x90], 0xfe
jmp 0x4051e5
or byte [esp + 0x90], 1
push esp
call sub.user32.dll_SetKeyboardState
jmp 0x405227
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4120cc], edx
jae 0x40521c
mov ecx, 1
mov edx, eax
mov eax, ebx
call fcn.0040519c
jmp 0x405227
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0040519c
add esp, 0x100
pop ebx
ret

Function at 0x405230
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4120cc], edx
jae 0x40525f
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0040519c
pop ebx
ret
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.0040519c
pop ebx
ret

Function at 0x406da8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406de1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040381c
jmp 0x406dea
mov eax, ebx
mov edx, esi
call fcn.00403780
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406df4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406e15
mov al, byte [esp]
jmp 0x406e17
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40749c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407314
mov eax, dword [0x4132c0]
cmp byte [eax], 0
je 0x407518
mov eax, dword [0x413218]
call fcn.004026e0
call fcn.004025ec
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040629c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x407560
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40754e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4131f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404138
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x407f0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407f70
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403980
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406170
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f77
lea eax, [ebp - 0xc]
call fcn.0040372c
ret

Function at 0x408f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403bac
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408f29
test al, 0x10
je 0x408f2d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40906c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4090ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040372c
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
mov ecx, 0xff
xor edx, edx
call fcn.0040381c
mov eax, dword [ebp - 0x10]
call fcn.00403bac
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00403bac
push eax
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4090e9
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403780
mov edx, dword [ebp - 0xc]
dec edx
mov eax, ebx
call fcn.00403cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409106
lea eax, [ebp - 0x10]
call fcn.0040372c
ret
Function at 0x409110
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b9c
xor eax, eax
push ebp
push 0x409196
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4091a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x409180
mov eax, dword [ebp - 4]
call fcn.004039ac
inc eax
push eax
lea eax, [ebp - 4]
call fcn.00403c04
push eax
push 1
push 0
push 0x4091dc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov bl, 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40919d
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4091e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040372c
push esp
push 0x20019
push 0
push 0x40925c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x409251
mov dword [esp + 4], 0x200
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x40927c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409248
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x200
call fcn.00403980
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x208
pop ebx
ret

Function at 0x409284
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40930b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x40931c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4092f5
push 0x409354
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jne 0x4092ec
lea eax, [ebp - 8]
call fcn.004091e4
cmp dword [ebp - 8], 0
je 0x4092ea
mov eax, dword [ebp - 8]
call fcn.00409110
mov ebx, eax
jmp 0x4092ec
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409312
lea eax, [ebp - 8]
call fcn.0040372c
ret
Function at 0x40935c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b9c
mov eax, dword [ebp - 8]
call fcn.00403b9c
xor eax, eax
push ebp
push 0x4093f3
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 8]
push 0x40940c
push 0x409418
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403a6c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00408a40
test al, al
jne 0x4093d6
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403bac
push eax
mov eax, dword [ebp - 4]
call fcn.00403bac
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4093d8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093fa
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403750
ret

Function at 0x4095e4
Capabilities:
Persist via ginadll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409705
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x409714
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4096ef
mov dword [ebp - 0x10], 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x40974c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4096e4
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x210]
mov ecx, 0x200
call fcn.00403980
mov eax, dword [ebp - 0xc]
call fcn.004094e8
test al, al
jne 0x4096e4
mov eax, dword [ebp - 0xc]
mov edx, 0x40975c
call fcn.00403af8
je 0x4096e4
mov eax, esi
call fcn.00409428
test al, al
jne 0x4096e4
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x40976c
push 0
push 0x409770
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4096e4
mov eax, dword [ebp - 0xc]
call fcn.004039ac
inc eax
push eax
lea eax, [ebp - 0xc]
call fcn.00403c04
push eax
push 1
push 0
push 0x40974c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40970c
lea eax, [ebp - 0xc]
call fcn.0040372c
ret
Function at 0x409804
Capabilities:
Persist via ginadll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor eax, eax
mov dword [ebp - 0x20c], eax
xor eax, eax
push ebp
push 0x4098bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4098cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4098a2
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0x409904
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409899
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x200
call fcn.00403980
mov edx, dword [ebp - 0x20c]
mov eax, 0x409914
call fcn.00403af8
jne 0x409899
mov ebx, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4098c2
lea eax, [ebp - 0x20c]
call fcn.0040372c
ret

Function at 0x409924
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409a11
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x140
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x144]
mov ecx, 0x140
call fcn.00403980
lea eax, [ebp - 0x148]
call fcn.00408f50
lea eax, [ebp - 0x148]
mov edx, 0x409a28
call fcn.004039b4
mov eax, dword [ebp - 0x148]
call fcn.00408f10
test al, al
je 0x4099eb
lea eax, [ebp - 0x14c]
call fcn.00408f50
lea eax, [ebp - 0x14c]
mov edx, 0x409a28
call fcn.004039b4
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.0040935c
test al, al
je 0x4099eb
mov eax, esi
call fcn.004095e4
test al, al
je 0x4099eb
mov eax, 0x409a28
call fcn.00409110
test al, al
je 0x4099eb
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a18
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00403750
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x409b9c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b9c
xor eax, eax
push ebp
push 0x409c73
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x409c84
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x409c52
mov dword [ebp - 0xc], 0x200
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x409cbc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409c49
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20c]
mov ecx, 0x200
call fcn.00403980
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00403af8
jne 0x409c49
push 0x409cbc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jne 0x409c49
mov bl, 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409c7a
lea eax, [ebp - 0x210]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x40a288
Capabilities:
Delete file
Delete registry key
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40a44e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
call sub.kernel32.dll_GetVersion_1
mov ebx, eax
and ebx, 0xff
push 0x104
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00403980
push dword [ebp - 0x118]
push 0x40a468
push 0x40a47c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403a6c
mov eax, dword [ebp - 4]
call fcn.00403bac
push eax
call sub.kernel32.dll_DeleteFileA
push 0x40a488
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x40a4bc
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x40a4ec
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
je 0x40a351
push 0
push 0x40a518
push 0x40a4ec
push 0
call sub.user32.dll_MessageBoxA_1
cmp ebx, 4
jbe 0x40a42d
lea eax, [ebp - 8]
push eax
push 0x40a534
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x40a389
push 0
push 0x40a584
push 0x40a534
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x40a42d
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x40a5a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40a424
lea eax, [ebp - 0x114]
mov ecx, 0x40a5b8
mov edx, dword [ebp - 0x10]
call fcn.00409ab0
test eax, eax
jle 0x40a41f
lea edx, [eax + 7]
mov ecx, dword [ebp - 0x10]
sub ecx, edx
lea edx, [ebp + eax - 0x10d]
lea eax, [ebp + eax - 0x114]
call fcn.00404d98
sub dword [ebp - 0x10], 7
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x40a5a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40a41f
push 0
push 0x40a5c0
push 0x40a534
push 0
call sub.user32.dll_MessageBoxA_1
mov esi, 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a455
lea eax, [ebp - 0x118]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x40a944
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40aa14
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
call sym.dwlGina3.dll_wlIsNTSystem
dec eax
jne 0x40a9f1
lea eax, [ebp - 0xc]
mov edx, 0x40aa30
call fcn.004037c4
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403bac
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x40a9b1
mov dword [ebp - 0x20], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
test bl, bl
je 0x40a9fe
push 0
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_ExitWindowsEx
mov esi, eax
jmp 0x40a9fe
push 0
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_ExitWindowsEx
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aa1b
lea eax, [ebp - 0xc]
call fcn.0040372c
ret

Function at 0x40aa44
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40aae6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, 0x40aafc
call fcn.004037c4
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x40ab04
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40aad0
mov eax, dword [ebp - 8]
call fcn.004039ac
inc eax
push eax
lea eax, [ebp - 8]
call fcn.00403c04
push eax
push 1
push 0
push 0x40ab3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x40aac7
push 0x40ab3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov ebx, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aaed
lea eax, [ebp - 8]
call fcn.0040372c
ret