joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089a1
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x264
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], edx
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov esi, eax
mov dword [esp + 0x18], 0x30
push 0xa
xor eax, eax
mov dword [esp + 0x20], 0x43
pop ecx
lea edi, [esp + 0x20]
mov dword [esp + 0x14], esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x529a90]
mov edi, eax
mov ebp, 0x110
lea eax, [esp + 0x48]
push ebp
push eax
push 0x2a
call fcn.00420e3f
test eax, eax
jne 0x408a31
movzx edx, word [0x51ea54]
lea eax, [esp + 0x48]
push ebp
push eax
xor edx, 0x2525
mov ecx, 0x51ea56
call fcn.00412531
pop ecx
pop ecx
and dword [esp + 0x24], 0
lea eax, [esp + 0x18]
mov ebp, dword [sym.imp.USER32.dll_InsertMenuItemW]
xor ecx, ecx
push eax
inc ecx
push ecx
push 0xffffffffffffffff
push edi
mov dword [esp + 0x38], ecx
call ebp
mov ecx, dword [0x529a90]
lea eax, [esp + 0x48]
push 0x110
push eax
push 0x6a
call fcn.00420e3f
test eax, eax
jne 0x408a8c
movzx edx, word [0x51f34a]
lea eax, [esp + 0x48]
push 0x110
push eax
xor edx, 0x2525
mov ecx, 0x51f34c
call fcn.00412531
pop ecx
pop ecx
and dword [esp + 0x24], 0
lea eax, [esp + 0x18]
push eax
push 1
push 0xffffffffffffffff
push edi
mov dword [esp + 0x38], 2
call ebp
movsx eax, word [esp + 0x16]
xor ebp, ebp
push ebp
push ebx
push ebp
push eax
movsx eax, si
push eax
push 0x180
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp esi, 1
jne 0x408ade
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.0040a32f
jmp 0x408b81
cmp esi, 2
jne 0x408b81
push 0x6037ef45
mov edx, 0x5566fe8f
mov ecx, 0x9b0bcc2d
call fcn.004012ef
lea edx, [esp + 0x4c]
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x408b02
lea eax, [esp + 0x58]
push eax
call fcn.0042c47c
pop ecx
mov esi, eax
mov edx, 0xa3eaf26
mov eax, dword [esp + 0x10]
movzx ecx, ax
push ecx
push 0x3f6fbeee
mov ecx, 0xc4539db8
call fcn.004012ef
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, 0xc48c8c4d
mov ecx, 0xae1be37
push 1
push ebp
push eax
push 0xf1dd9d87
call fcn.004012ef
pop ecx
push eax
push 0xe3f59807
mov edx, 0xd6a489c1
mov ecx, 0x18c9bbb7
call fcn.004012ef
pop ecx
push eax
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x264
ret
Function at 0x408b9a
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, 0x7059188c
push 0x7a577576
mov ecx, 0xc0ef89d7
call fcn.004013ad
pop ecx
lea edx, [esp + 0x14]
push 2
sub edx, eax
pop ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebp
test cx, cx
jne 0x408bd2
lea esi, [esp + 0x14]
xor ebx, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, ebp
cmp ax, bx
jne 0x408be9
sub esi, ecx
mov edx, 0x915a8e47
push 0x9b54e384
mov ecx, 0x21ec1f70
sar esi, 1
call fcn.004013ad
lea edx, [esp + 0x18]
lea edx, [edx + esi*2]
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebp
test cx, cx
jne 0x408c15
test edi, edi
je 0x408cf0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x408d00
push 0x80
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x14]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebp
cmp ax, bx
jne 0x408c60
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x18]
push eax
push 1
push ebx
push ebx
push dword [esp + 0x24]
call esi
lea eax, [esp + 0x14]
push 0x5c
push eax
call fcn.004bacf8
pop ecx
pop ecx
test eax, eax
je 0x408ce4
xor ecx, ecx
mov word [eax + 2], cx
lea ecx, [esp + 0x14]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebp
cmp ax, bx
jne 0x408caa
sub ecx, edx
mov edx, 0x44ff4771
sar ecx, 1
lea eax, [ecx*2 + 2]
mov ecx, 0xf449d6ac
push eax
lea eax, [esp + 0x18]
push eax
push 1
push ebx
push 0x4ef12abb
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408d00
lea eax, [esp + 0x14]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x108
ret
Function at 0x408d19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov edx, 0xcb66daef
mov ecx, 0x7bd04b7e
push esi
push eax
push 1
xor esi, esi
push esi
push 0xc168b76e
call fcn.004013ad
pop ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x408d55
xor eax, eax
jmp 0x408df8
lea eax, [ebp - 4]
mov edx, 0xc9dc0578
push eax
push esi
lea eax, [ebp - 0xc]
mov ecx, 0x796a954b
push eax
push esi
push 0xc3d268ba
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408ded
cmp dword [ebp - 4], esi
jbe 0x408ded
push edi
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov edx, 0xfaca1368
lea eax, [ebp - 4]
mov ecx, 0x4a7c83b7
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push 0xf0c47eaa
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408dec
jmp 0x408de2
push 0x4ee5d0
push edi
call fcn.004ba8f8
pop ecx
pop ecx
test eax, eax
je 0x408de9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 2
cmp word [edi], si
jne 0x408dc4
jmp 0x408dec
xor esi, esi
inc esi
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408dfd
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x424
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
push esi
push edi
mov ebx, 0x4ee5d0
mov edx, 0xd922b744
push ebx
push 0xd32cda93
mov ecx, 0x699427bf
xor edi, edi
call fcn.004013ad
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
push eax
lea eax, [esp + 0x230]
push eax
call esi
add esp, 0xc
mov edx, 0xbe4bcee4
mov ecx, 0xefd5e6d
push ebx
push 0xb445a30e
call fcn.004013ad
pop ecx
push eax
lea eax, [esp + 0x28]
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x14]
xor ebp, ebp
inc ebp
push eax
push ebp
push edi
lea eax, [esp + 0x2c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408f2e
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x24]
mov edx, 0x6f7e9fe0
push eax
lea eax, [esp + 0x20]
mov ecx, 0xdfc80ca5
push eax
push edi
push 0x6570f225
call fcn.004013ad
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop ecx
push eax
push dword [esp + 0x28]
call esi
test eax, eax
jne 0x408f24
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004ba8f8
pop ecx
pop ecx
test eax, eax
jne 0x408f24
push 4
pop ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x20]
mov edx, 0x6e354a6f
push eax
lea eax, [esp + 0x20]
mov ecx, 0xde83d900
push eax
push edi
push 0x643b27a6
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x28]
call esi
test eax, eax
jne 0x408f24
cmp dword [esp + 0x18], ebx
jne 0x408f24
cmp dword [esp + 0x1c], 3
cmove edi, ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x430]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x424
ret
Function at 0x408f49
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov ebx, 0x4ee5d0
mov esi, ecx
push ebx
push 0x1eb2c29
mov edx, 0xbe541c3
mov ecx, 0xbb53d2da
call fcn.004013ad
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
push eax
lea eax, [esp + 0x1c]
push eax
call edi
add esp, 0xc
test esi, esi
je 0x4090d4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x408fb6
xor eax, eax
jmp 0x4090e9
push ebp
push ebx
push 0xe674a3f4
mov edx, 0xec7ace23
mov ecx, 0x5ccc5df6
call fcn.004013ad
pop ecx
push eax
lea eax, [esp + 0x20]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call esi
xor ebp, ebp
mov edx, 0xf9758b64
mov ecx, 0x49c318ff
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push ebp
push 0xf37be6a1
call fcn.004013ad
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
push eax
push dword [esp + 0x24]
call edi
push ebx
call esi
mov edx, 0xe33b7c0b
mov ecx, 0x538def86
lea eax, [eax*2 + 2]
push eax
push ebx
xor ebx, ebx
inc ebx
push ebx
push ebp
push 0xe93511c8
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x24]
call edi
push 4
pop esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push esi
push ebp
push 0xee966aba
mov edx, 0xe4980778
mov ecx, 0x542e94d3
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x24]
call edi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 3
push eax
push esi
push ebp
push 0xa0e09df8
mov edx, 0xaaeef031
mov ecx, 0x1a586266
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x24]
call edi
mov dword [esp + 0x14], ebx
push esi
lea eax, [esp + 0x18]
mov edx, 0x51699591
push eax
push esi
push ebp
push 0x5b67f85b
mov ecx, 0xe1df07d0
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebp
jmp 0x4090e9
lea eax, [esp + 0x14]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x20c
ret
Function at 0x4091a8
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ecx
push eax
xor ebx, ebx
mov edx, 0x75c3c928
push 3
push ebx
push 0x7fcda4a9
mov ecx, 0xc5755b55
mov dword [ebp - 0x10], ebx
call fcn.004013ad
pop ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4091ea
xor eax, eax
jmp 0x40931d
lea eax, [ebp - 4]
mov edx, 0x81e92d20
push eax
push ebx
lea eax, [ebp - 0xc]
mov ecx, 0x315fbfbf
push eax
push ebx
push 0x8be740e2
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ecx
test eax, eax
je 0x409221
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40922e
cmp dword [ebp - 0xc], 7
jne 0x409312
mov eax, dword [ebp - 4]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0xc]
mov edx, 0x3eb9ec64
push eax
push ebx
push 0x34b781a6
mov ecx, 0x8e0f7edf
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
test eax, eax
push 2
pop eax
cmovne ecx, eax
push 0x4ee5d0
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 4]
lea eax, [eax*2 + 8]
push eax
push 8
call edi
push eax
call esi
mov edi, dword [ebp - 0x14]
mov esi, eax
lea eax, [ebp - 0x10]
mov edx, edi
push eax
push ecx
mov ecx, dword [ebp - 0x18]
push esi
call fcn.00409101
add esp, 0xc
cmp dword [ebp - 0x10], ebx
jbe 0x4092e0
add eax, eax
mov edx, 0xcc6e0ae3
push eax
push esi
push 7
push ebx
push 0xc6606721
mov ecx, 0x7cd89844
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4092ff
push 0x21ecd4db
mov edx, 0x2be2b919
mov ecx, 0x9b542c5a
call fcn.004013ad
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call fcn.00404d44
push edi
call fcn.00404d44
pop ecx
pop ecx
xor ebx, ebx
pop edi
inc ebx
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409322
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, edx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5c
mov edx, 0xc6cf681f
mov ecx, 0x7679fd70
lea esi, [esi + eax*2]
pop eax
push 0xccc105d9
mov word [esi], ax
call fcn.004013ad
lea edx, [esi + 2]
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409354
lea edx, [esi + 0x12]
mov ecx, str.xreveal.sys
sub edx, ecx
pop esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40936e
xor eax, eax
inc eax
ret
Function at 0x4093e9
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea edx, [ebp - 0x20c]
mov esi, ecx
call fcn.00409322
xor edx, edx
movzx eax, word [ebp + edx - 0x20c]
lea edx, [edx + 2]
mov word [ebp + edx - 0x416], ax
test ax, ax
jne 0x40940c
lea eax, [ebp - 0x414]
push 0x2e
push eax
call fcn.004bacf8
pop ecx
pop ecx
push 0x74
pop ecx
push 0x6d
mov word [eax + 2], cx
pop ecx
mov word [eax + 4], cx
push 0x70
pop ecx
mov word [eax + 6], cx
xor ecx, ecx
mov word [eax + 8], cx
test esi, esi
je 0x4094e4
push 0x104
lea eax, [ebp - 0x61c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push 0x5c
push eax
call fcn.004bacf8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4094fc
push str.xreveal.sys
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
test esi, esi
je 0x4094fc
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x20c]
push 0
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
jne 0x4094fc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
jmp 0x4094fc
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b94b6
mov esp, ebp
pop ebp
ret
Function at 0x40a8fe
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40a975
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a965
xor eax, eax
jmp 0x40a974
push esi
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b94b6
mov esp, ebp
pop ebp
ret

Function at 0x40a983
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov edx, 0xcc809773
push 0x9947371e
mov ecx, 0x6ea8e0aa
call fcn.004014a8
lea edx, [ebp - 0x108]
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40a9b6
test esi, esi
je 0x40a9f1
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9cd
sub ecx, edx
mov byte [ebp + ecx - 0x108], 0x2f
lea ecx, [ebp + ecx - 0x107]
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x40a9e7
push 0x104
lea eax, [ebp - 0x310]
xor esi, esi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 5
push esi
push esi
lea eax, [ebp - 0x310]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b94b6
mov esp, ebp
pop ebp
ret

Function at 0x40aa36
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp + 0x94], eax
push edi
xor edi, edi
mov dword [ebp - 0x80], 0x114
push 0x10c
lea eax, [ebp - 0x78]
mov dword [ebp - 0x7c], edi
push edi
push eax
call fcn.004bea90
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jae 0x40aab9
push esi
mov esi, dword [0x529aa4]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
test eax, eax
je 0x40aaab
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 4]
inc edi
sub eax, dword [esi]
sar eax, 2
cmp edi, eax
jb 0x40aa93
mov eax, dword [esi]
sub esp, 0xc
mov dword [esi + 4], eax
call fcn.0040c95e
pop esi
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
pop edi
call fcn.004b94b6
lea esp, [ebp + 0x98]
pop ebp
ret
Function at 0x40ab03
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0xf0e34a43
mov edx, 0x14961135
mov ecx, 0xb69b53f9
call fcn.00401215
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x407b90
push 0xee89a436
mov edx, 0xafcff50
mov ecx, 0xa8f1bdb6
call fcn.004011f4
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x529b6c], eax
xor edx, edx
mov ecx, fcn.00407c17
call fcn.00407d45
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push eax
push 0x407590
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x529b44], eax
pop esi
pop ecx
ret
push esi
mov esi, ecx
push 0x18
mov dword [0x529aa0], esi
call fcn.004b9c6e
pop ecx
test eax, eax
je 0x40ab30
mov ecx, dword [0x529a94]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 0x16], cl
jmp 0x40ab32
xor eax, eax
mov dword [0x529a8c], eax
mov eax, dword [0x529a98]
mov eax, dword [eax + 0x14]
shr eax, 6
and al, 1
movzx eax, al
push eax
call fcn.0040cc53
push esi
call fcn.0040e4d4
pop esi
jmp 0x407b4a
Function at 0x40ab59
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor edx, edx
mov ecx, 0xd0fa13e5
push edi
mov dword [ebp - 0x29c], edx
mov edx, 0x72d26412
push 0x2715c46d
call fcn.004014c9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40abe3
push 0xef7c70ce
mov edx, 0xbabbd0ac
mov ecx, 0x1893a745
call fcn.004014a8
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40abe3
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2a8]
push ecx
lea ecx, [ebp - 0x2ac]
push ecx
call eax
mov eax, dword [ebp - 0x29c]
and eax, 0xfffffff
mov dword [ebp - 0x29c], eax
jmp 0x40abe9
mov eax, dword [ebp - 0x29c]
xor esi, esi
cmp eax, 0x55f0
jb 0x40ad8c
lea eax, [ebp - 0x294]
mov edx, 0x87ce7d10
push eax
push 0x20019
push esi
push 0xd209dd44
mov ecx, 0x25e60a17
call fcn.004014c9
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ad8c
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x298], 0x40
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
mov edi, esi
push eax
lea eax, [ebp - 0x88]
push eax
push esi
jmp 0x40ad6c
lea eax, [ebp - 0x2a0]
inc edi
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ad53
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0x208
push eax
lea eax, [ebp - 0x290]
mov edx, 0xdfa5a526
push eax
lea eax, [ebp - 0x2b8]
mov ecx, 0x7d8dd26d
push eax
push esi
push 0x8a62055c
call fcn.004014c9
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esi, [ebp - 0x290]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x40accc
sub esi, ecx
sar esi, 1
cmp esi, 0xc
jbe 0x40ad45
push 0x9675d2f5
mov edx, 0xc3b2728d
mov ecx, 0x619a05e6
call fcn.004014c9
pop ecx
push eax
lea eax, [ebp + esi*2 - 0x2a8]
push eax
call fcn.004ba8f8
pop ecx
xor esi, esi
pop ecx
test eax, eax
jne 0x40ad47
push 4
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 1
push eax
push 4
push esi
push 0x3a0f60a4
mov edx, 0x6fc8c0da
mov ecx, 0xcde0b65d
call fcn.004014c9
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40ad47
xor esi, esi
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2b4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40ac56
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x529a8c]
cmp dword [eax + 8], esi
je 0x40ad9d
call fcn.0040cf58
jmp 0x40ada8
push esi
xor edx, edx
xor ecx, ecx
call fcn.0041ddd9
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b94b6
mov esp, ebp
pop ebp
ret