joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50147c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x50151b
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x501517
mov eax, dword [eax + 0x20]
test eax, eax
je 0x501517
cmp dword [ebx], eax
jne 0x501517
mov eax, dword [ebx + 4]
sub eax, 1
je 0x5014f1
sub eax, 1
je 0x5014c1
sub eax, 1
jne 0x501517
mov edi, 0x428e
jmp 0x5014f6
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x5014f6
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x58d988]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x5014f6
add edi, 3
jmp 0x5014f6
mov edi, 0x3ea0
push edi
mov ecx, 0x5ea378
call fcn.0041c280
test eax, eax
je 0x50151b
mov eax, dword [0x5ea378]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x501510
call fcn.0041f587
int3

Function at 0x50b413
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00568865
pop ecx
test eax, eax
jne 0x50b455
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004228f2
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x50b41b
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x5123d2
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 8
mov eax, 0x580153
call fcn.0055399f
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x5124be
mov esi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x5124be
cmp esi, 0x43
je 0x512414
cmp esi, 0x2d
jne 0x5124be
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5124be
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00409980
movzx eax, byte [edi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [edi + 0xe5]
push eax
movzx eax, byte [edi + 0xe4]
push eax
lea eax, [ebp - 0x10]
push 0x5af610
push eax
call fcn.00407410
mov esi, dword [ebp - 0x10]
add esp, 0x14
lea eax, [esi - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5124ac
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x5124ac
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
call fcn.0041fd9d
push ebx
mov ecx, edi
call fcn.0050f858
call fcn.0055396d
ret 4
Function at 0x5544b6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5544f5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5544f5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5544f5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5544f5
cmp dword [ecx + 0x74], 0xe
jbe 0x5544f5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x554cf8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x554dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x554d28
xor esi, esi
jmp 0x554dc9
cmp eax, 3
je 0x554d39
push 0
push edi
call fcn.00554dd1
test eax, eax
jne 0x554d21
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x554db6
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x554d52
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x554d4b
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x554db6
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.00554cf8
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x554dc8
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x554db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x554da3
xor esi, esi
inc esi
jmp 0x554dc8
test esi, esi
jle 0x554dc8
movzx esi, si
or esi, 0x80070000
jmp 0x554dc8
xor esi, esi
jmp 0x554dc8
mov esi, 0x80070003
push esi
push 0x72
push str.c:_agent_work66_s_srclibsdutildirutil.cpp
call fcn.00438885
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x554dd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x554df5
test al, 0x10
je 0x554df5
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x554df2
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x5571a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x5571c8
jl 0x5571bf
test edi, edi
jne 0x5571c8
xor eax, eax
xor edx, edx
jmp 0x557289
cmp dword [ebx + 0x38], 0
je 0x5571dd
push eax
push edi
push dword [ebp + 8]
call fcn.0055728f
jmp 0x557289
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x557224
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x557224
cmp eax, edi
jb 0x5571fe
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00557fb0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x55722a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x55727e
mov ecx, ebx
call fcn.00556971
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x557269
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00568e02
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x55727e
jmp 0x55723c
test edx, edx
je 0x55727e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00568e02
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x55737e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x5573a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00557463
jmp 0x55745e
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x5573c6
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x5573cb
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x55742b
jg 0x5573e0
test esi, esi
je 0x55742b
test ecx, ecx
jl 0x557426
jg 0x5573ea
test eax, eax
je 0x557426
cmp edi, ecx
jg 0x5573fc
jl 0x5573f4
cmp esi, eax
jae 0x5573fc
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00557fb0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x55742e
mov ecx, dword [ebp + 8]
jmp 0x557438
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x557452
jg 0x557438
test esi, esi
je 0x557452
cmp dword [ebx + 0x4c], 0
je 0x557452
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00566bce
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x5731f3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00573069

Function at 0x57c480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x57c4ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x57c4ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f49a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0043d8ac
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x402536
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.0042135e
push 0x451ca0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00423977
push edi
push esi
call fcn.0043d77f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420923
mov esp, ebp
pop ebp
ret 4

Function at 0x402970
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43f4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x454710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00403020
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.004028a0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4029e1
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0042135e
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x402a0a
push dword [esp + 0xc]
call fcn.0040ea58
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403b20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x403b41
mov eax, dword [esi]
jmp 0x403b43
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call ebx
test eax, eax
jne 0x403c11
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004226e0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x403b7c
mov eax, dword [esi]
jmp 0x403b7e
mov eax, esi
push edi
add eax, 8
push 0x44c54c
push eax
call fcn.00421926
push 0x44c54c
push eax
call fcn.00421926
mov edi, eax
add esp, 0x10
test edi, edi
je 0x403c03
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004226e0
add esp, 0xc
mov ecx, esi
call fcn.00404300
mov ecx, edi
sub ecx, eax
sar ecx, 1
push ecx
mov ecx, esi
call fcn.00404300
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00421bb9
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
call ebx
lea eax, [edi + 2]
push 0x44c54c
push eax
call fcn.00421926
mov edi, eax
add esp, 8
test edi, edi
jne 0x403ba1
cmp dword [esi + 0x14], 8
pop edi
jb 0x403c0c
mov esi, dword [esi]
push 0
push esi
call ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00420923
mov esp, ebp
pop ebp
ret
Function at 0x404020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 1
push 0x44c3c0
push dword [edi + 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00404870
test eax, eax
jne 0x404052
mov eax, str.SOFTWAREHNCHWP9.0HwpFrameAppState
jmp 0x404072
push 2
push 0x44c3c4
push dword [edi + 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00404870
test eax, eax
jne 0x4040f6
mov eax, str.SOFTWAREHNCHWP9.6HwpFrameAppState
lea ecx, [ebp - 0xc]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4040f6
cmp dword [edi + 0x30], 8
mov dword [ebp - 8], eax
lea eax, [edi + 0x1c]
jb 0x40409b
mov eax, dword [eax]
push str.hwpx
push eax
call fcn.004211b9
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
mov edx, 1
lea eax, [ebp - 8]
cmove ecx, edx
push 4
push eax
push 4
push str.HwpxFormatDefaults
push 0x44c548
push dword [ebp - 0xc]
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420923
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00420923
mov esp, ebp
pop ebp
ret

Function at 0x404110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 1
push 0x44c3c0
push dword [edi + 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00404870
test eax, eax
jne 0x404145
mov eax, str.SOFTWAREHNCHWP9.0HwpFrameAppState
jmp 0x404165
push 2
push 0x44c3c4
push dword [edi + 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00404870
test eax, eax
jne 0x4041f5
mov eax, str.SOFTWAREHNCHWP9.6HwpFrameAppState
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4041e2
cmp dword [edi + 0x30], 8
lea eax, [edi + 0x1c]
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 4
jb 0x40419c
mov eax, dword [eax]
push str.hwpx
push eax
call fcn.004211b9
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
mov edx, 1
lea eax, [ebp - 0x10]
cmove ecx, edx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.HwpxFormatDefaults
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420923
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420923
mov esp, ebp
pop ebp
ret
Function at 0x40de50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4400c8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
push 1
push 0x44cad0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00404310
cmp word [esi], 0
jne 0x40dec1
xor ecx, ecx
jmp 0x40ded5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dec6
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.0040e410
push 0xd
push 0x44cad4
lea ecx, [ebp - 0x2c]
call fcn.00404310
push str.hwpx
push esi
call fcn.004211b9
add esp, 8
test eax, eax
jne 0x40df1e
push 4
push str.hwpx
lea ecx, [ebp - 0x2c]
call fcn.0040e410
push 1
push 0x44cad0
lea ecx, [ebp - 0x2c]
call fcn.0040e410
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e300
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x60]
push ecx
push 0xf003f
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e012
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
lea ecx, [eax*2 + 1]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 1
push 0
push 0
push dword [ebp - 0x60]
call edi
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40e00d
xor eax, eax
mov dword [ebp - 0x48], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x5c], ax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x4c], 0
push eax
call fcn.00404510
push 9
push str.ShellNew
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.0040e410
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push 0
cmovae eax, dword [ebp - 0x5c]
push 0
push 1
push str.NullFile
push eax
push dword [ebp - 0x60]
call edi
push dword [ebp - 0x64]
call esi
cmp dword [ebp - 0x48], 8
jb 0x40e00d
push dword [ebp - 0x5c]
call fcn.0040ea58
add esp, 4
push dword [ebp - 0x60]
call esi
cmp dword [ebp - 0x18], 8
jb 0x40e023
push dword [ebp - 0x2c]
call fcn.0040ea58
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x40e048
push dword [ebp - 0x44]
call fcn.0040ea58
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420923
mov esp, ebp
pop ebp
ret 4
Function at 0x40e070
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440111
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], 0
mov word [ebp - 0x45c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x460], 7
mov dword [ebp - 0x464], eax
mov word [ebp - 0x474], ax
push 1
push 0x44cad0
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 1
call fcn.00404310
cmp word [esi], 0
jne 0x40e10a
xor ecx, ecx
jmp 0x40e11f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e110
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x45c]
call fcn.0040e410
cmp dword [ebp - 0x448], 8
lea ecx, [ebp - 0x478]
push ecx
push 0xf003f
lea eax, [ebp - 0x45c]
cmovae eax, dword [ebp - 0x45c]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e2cc
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004226e0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.004226e0
add esp, 0x18
mov dword [ebp - 0x428], 0x104
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x104
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], 0x104
push eax
push 1
push 0
push 0
push dword [ebp - 0x478]
mov dword [ebp - 0x42c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x21c], 0
je 0x40e2cc
xor eax, eax
mov dword [ebp - 0x430], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x444], ax
lea ecx, [ebp - 0x444]
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x434], 0
push eax
call fcn.00404510
push 1
push 0x44c54c
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 2
call fcn.0040e410
cmp word [ebp - 0x21c], 0
jne 0x40e26a
xor ecx, ecx
jmp 0x40e282
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e273
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x444]
call fcn.0040e410
cmp dword [ebp - 0x430], 8
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
cmp dword [ebp - 0x430], 8
jb 0x40e2cc
push dword [ebp - 0x444]
call fcn.0040ea58
add esp, 4
cmp dword [ebp - 0x448], 8
jb 0x40e2e3
push dword [ebp - 0x45c]
call fcn.0040ea58
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420923
mov esp, ebp
pop ebp
ret 4
Function at 0x40ea22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test edx, edx
je 0x40ea2c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61

Function at 0x40eafc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040e74e
push eax
push esi
push dword [ebp + 8]
call fcn.0040e703
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40ebd9

Function at 0x40ef8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
test dword [edx + 0x6dfffffc], edi