joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423880
Capabilities:
Check if file exists
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x441690
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4513e0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov eax, dword [0x4513e0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov byte [esp + 0x54], 1
push 0x80000002
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
cmp ebp, ebx
jne 0x423a0e
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov eax, edi
call fcn.0041f4d0
test eax, eax
jne 0x42392c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42392c
push edi
lea eax, [esp + 0x14]
push eax
mov edx, 0x44698c
call fcn.0041f370
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov eax, edi
call fcn.0041f4d0
test eax, eax
je 0x4239f3
cmp byte [esp + 0x4c], bl
je 0x42397c
push 1
push 0x44a9ac
lea ecx, [esp + 0x20]
call fcn.00403430
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x423960
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00403430
jmp 0x42399b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x423981
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x20]
call fcn.004035b0
cmp dword [esp + 0x30], 8
mov edx, dword [esp + 0x1c]
jae 0x4239aa
lea edx, [esp + 0x1c]
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4239b0
mov ecx, dword [esp + 0x10]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 2
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4239f3
push ebx
push 0x1388
push 2
push 0x44a9b0
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x4239fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x423a0a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x30], 8
jb 0x423a22
mov edx, dword [esp + 0x1c]
push edx
call fcn.00429d64
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
je 0x423a42
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004289ca
add esp, 0x38
ret
Function at 0x426060
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
call fcn.00405500
test eax, eax
jne 0x4260b8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x426120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.B32CB6D5_61BD_49c8_AA8A_8B790D3B9008
push 0
push 0
push 0
mov dword [0x453d08], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
add esp, 8
ret

Function at 0x4260c0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
call fcn.00405500
test eax, eax
jne 0x426118
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x426170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.B32CB6D5_61BD_49c8_AA8A_8B790D3B9008
push 0
push 0
push 0
mov dword [0x453d08], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
add esp, 8
ret
Function at 0x4289ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4513e0]
jne 0x4289d4
repz ret
jmp fcn.0043043a

Function at 0x43148b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x451540]
je 0x4314a6
inc edi
cmp edi, 0x17
jb 0x431497
cmp edi, 0x17
jae 0x431626
push ebp
push 3
call fcn.0043b72b
cmp eax, 1
pop ecx
je 0x4315f2
push 3
call fcn.0043b72b
test eax, eax
pop ecx
jne 0x4314da
cmp dword [0x4513c0], 1
je 0x4315f2
cmp ebx, 0xfc
je 0x431625
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x453478
push ebp
call fcn.00429c32
add esp, 0xc
test eax, eax
je 0x431510
push esi
push esi
push esi
push esi
push esi
call fcn.00429d73
add esp, 0x14
push 0x104
mov esi, 0x453491
push esi
push 0
mov byte [0x453595], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x431554
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00429c32
add esp, 0xc
test eax, eax
je 0x431554
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00429d73
add esp, 0x14
push esi
call fcn.0042c5c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x431599
push esi
call fcn.0042c5c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45378c
push 0x44550c
sub ecx, eax
push ecx
push eax
call fcn.004381ed
add esp, 0x14
test eax, eax
je 0x431599
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00429d73
add esp, 0x14
jmp 0x43159b
xor esi, esi
push 0x445508
push ebx
push ebp
call fcn.00433772
add esp, 0xc
test eax, eax
je 0x4315bb
push esi
push esi
push esi
push esi
push esi
call fcn.00429d73
add esp, 0x14
push dword [edi*8 + 0x451544]
push ebx
push ebp
call fcn.00433772
add esp, 0xc
test eax, eax
je 0x4315dd
push esi
push esi
push esi
push esi
push esi
call fcn.00429d73
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043b56e
add esp, 0xc
jmp 0x431625
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x431625
cmp ebp, 0xffffffff
je 0x431625
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x451544]
push dword [esi]
call fcn.0042c5c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43b56e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004327f1
xor ebx, ebx
cmp dword [0x453a34], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43b644
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43b724
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43b724
push eax
call fcn.00432783
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x453a34], eax
call esi
push eax
call fcn.00432783
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x453a38], eax
call esi
push eax
call fcn.00432783
mov dword [0x453a3c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004300b6
test eax, eax
pop ecx
pop ecx
je 0x43b612
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429d73
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43b644
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00432783
cmp eax, ebx
pop ecx
mov dword [0x453a44], eax
je 0x43b644
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00432783
pop ecx
mov dword [0x453a40], eax
mov eax, dword [0x453a40]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43b6c9
cmp dword [0x453a44], ecx
je 0x43b6c9
push eax
call fcn.004327fa
push dword [0x453a44]
mov esi, eax
call fcn.004327fa
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43b6c9
cmp edi, ebx
je 0x43b6c9
call esi
cmp eax, ebx
je 0x43b696
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43b696
test byte [ebp - 0x18], 1
jne 0x43b6c9
lea eax, [ebp - 0x10]
push eax
call fcn.004300ed
test eax, eax
pop ecx
je 0x43b6b1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429d73
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43b6c0
or dword [ebp + 0x10], 0x200000
jmp 0x43b704
or dword [ebp + 0x10], 0x40000
jmp 0x43b704
mov eax, dword [0x453a38]
cmp eax, dword [ebp - 8]
je 0x43b704
push eax
call fcn.004327fa
cmp eax, ebx
pop ecx
je 0x43b704
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43b704
mov eax, dword [0x453a3c]
cmp eax, dword [ebp - 8]
je 0x43b704
push eax
call fcn.004327fa
cmp eax, ebx
pop ecx
je 0x43b704
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x453a34]
call fcn.004327fa
cmp eax, ebx
pop ecx
je 0x43b724
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43b726
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10ce4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10ce41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10ce407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ce406a
add dl, dl
jne 0x10ce4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ce40dc
xor eax, eax
add dl, dl
jne 0x10ce4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ce417d
add dl, dl
jne 0x10ce40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ce40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ce40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ce40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10ce40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10ce4075
mov eax, 1
add dl, dl
jne 0x10ce40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ce40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ce40e1
sub eax, ebx
mov ebx, 1
jne 0x10ce4128
mov ecx, 1
add dl, dl
jne 0x10ce410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10ce4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ce4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ce4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10ce413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10ce414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ce4136
cmp eax, 0x7d00
jae 0x10ce416d
cmp eax, 0x500
jb 0x10ce4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ce4075
cmp eax, 0x7f
ja 0x10ce4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ce4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10ce419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10ce4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x10050054
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
mov ecx, 0x12bb0a05
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x9301a4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301aa
pop ebp
sub ebp, 6
sub ebp, 0x5301a4
jmp 0x930208
jmp 0x930211
mov eax, 0x5301a4
add eax, ebp
add eax, 0x93
mov ecx, 0x638
mov edx, 0xf83ce6fd
xor byte [eax], dl
inc eax
dec ecx
jne 0x930228
jmp 0x93023b
xchg edi, eax
mov ebp, 0xfdedfd95
std
xchg ebp, eax
std
xor ecx, edx
std
jl 0x930256
arpl bx, di
xchg esi, eax
jb 0x9302ca
or eax, 0x7296fb63
into
cmp eax, 0x856802ad
add ch, byte [eax - 0x7b]
mov esp, 0x76adfdb4
xor byte [esi + 0x74], dh
sar ebp, 0xfd
std
jl 0x9302a3
add eax, 0xfefdfdfd
xor byte [ebp - 5], al
std
std
std
inc edi
aad 0xfd
std
std
or bl, byte [edi]
invalid
fscale
jbe 0x93031f
cmc
std
std
std
jbe 0x930315
int1
std
std
std
jbe 0x930323
in eax, dx
std
std
std
cmp al, 0x14
dec esp
invalid
aas
int1
std
jbe 0x93033d
fyl2xp1
std
std
std
xchg ebp, eax
sub ecx, ebx
hlt
ret 0xfdff
std
std
std
jbe 0x930339
cmc
std
std
std
into
xor al, 0x7c
nop dword [ebp - 0x37]
pop ds
inc ebp
leave
xchg edx, eax
jl 0x930316
pop ds
inc ebp
leave
xchg edx, eax
into
das
jle 0x930324
adc eax, 0x79f2b5f8
mov bl, 0xfd
clc
mov ch, 0xf2
jns 0x9302c7
std
std
std
bnd jne 0x9302cf
std
std
std
wait
jbe 0x930301
loope 0x9302e5
les edi, [ebp + 6]
jge 0x930329
adc eax, 0xfde779f2
bnd jns 0x93030e
std
std
std
jge 0x930332
adc al, 0xf2
jns 0x93031c
std
std
std
wait
jl 0x93033c
add bl, al
bnd jns 0x930323
jns 0x930323
std
std
std
mov esp, 0x2023114
add dl, ah
mov cl, 0xc4
cld
jle 0x930386
clc
jle 0x930362
stc
adc al, 0x40
add al, byte [edx]
add dl, ah
test eax, 0x3c7effc4
sti
jle 0x930373
stc
jle 0x930374
clc
adc al, 0x56
add al, byte [edx]
add ah, byte [eax - 0x57020ec1]
jbe 0x93037d
stosd dword es:[edi], eax
stosb byte es:[edi], al
test al, 0x76
mov cl, dh
jbe 0x9302f4
xor ch, 1
dec edi
jge 0x9303f0
cmc
add dword [edi + 0x7d], ecx
ja 0x930375
sti
jl 0x9303b7
cmp edi, esp
cld
std
std
std
jne 0x93037c
jl 0x9303be
cld
std
std
std
inc esi
invalid
mov ebx, 0x7ef22fef
xchg edi, eax
std
std
std
into
cmp eax, 0x78f22fff
clc
bnd js 0x9303b2
std
std
std
ja 0x9303aa
jmp 0x93037b
mov ebx, 0x7ef22fef
xlatb
cld
std
std
jmp [edi]
mov ebx, 0x3dee2fef
jmp [edi]
Function at 0x40168d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00437ff0
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4016e1
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
je 0x4016f1
mov eax, dword [ebp - 0x70]
dec eax
dec eax
jne 0x4016f1
cmp dword [ebp - 0x7c], 6
jb 0x4016f1
inc eax
jmp 0x4016f3
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
pop esi
call fcn.00437ed4
add ebp, 0xa0
leave
ret

Function at 0x401ac3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3004
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x5c], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x401b77
test byte [esi + 0x58], 8
je 0x401b77
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
call fcn.00437ff0
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push eax
call fcn.00438154
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x3004], ax
lea eax, [ebp - 0x3002]
push eax
call fcn.00437ff0
lea eax, [ebp - 0x1004]
push eax
push edi
lea eax, [ebp - 0x3004]
push 0x451880
push eax
call fcn.0040174f
add esp, 0x34
cmp byte [esi + 0x5d], 0
lea eax, [ebp - 0x3004]
push eax
je 0x401b71
mov ecx, esi
call fcn.0040190c
jmp 0x401b77
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437ed4
leave
ret

Function at 0x401ed3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f5b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401f3f
push str.UACCheck___RegQueryValueEx__EnableLUA___Fail___
push str._SOM_
push 0x46f390
call fcn.00401ac3
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x401f5b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp - 4], esi
je 0x401f5b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x40276d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
cmp byte [0x46f408], bl
jne 0x402829
push ebx
call fcn.0043887b
push eax
call fcn.00438af7
pop ecx
pop ecx
xor edi, edi
push 4
push 0x1000
mov esi, 0x10000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi*4 + 0x46f3fc], eax
cmp eax, ebx
je 0x4028e8
mov ecx, edi
dec ecx
je 0x40280d
dec ecx
jne 0x40281c
xor esi, esi
call fcn.00438b09
mov ecx, dword [0x46f404]
mov byte [ecx + esi], al
inc esi
cmp esi, 0x10000
jb 0x4027d1
mov eax, dword [0x46f404]
mov byte [eax], 8
mov eax, dword [0x46f404]
mov byte [eax + 1], 8
mov eax, dword [0x46f404]
mov byte [eax + 2], 7
mov eax, dword [0x46f404]
mov byte [eax + 3], 5
jmp 0x40281c
push esi
push 0xff
push eax
call fcn.00437ff0
add esp, 0xc
inc edi
cmp edi, 3
jb 0x4027a4
mov byte [0x46f408], 1
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
sub dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], ebx
sbb dword [ebp - 0x14], eax
cmp dword [ebp - 8], ebx
je 0x402856
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x46f3fc
cmp dword [ebp - 4], ebx
je 0x402876
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call edi
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x2c], ebx
jb 0x4028c6
ja 0x402887
cmp dword [ebp + 0xc], ebx
jbe 0x4028c6
mov eax, dword [ebp + 0xc]
sub eax, esi
mov ecx, 0x10000
cmp eax, ecx
jbe 0x402897
mov eax, ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
je 0x402906
add esi, dword [ebp - 0x10]
adc dword [ebp - 0x24], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x24], eax
jb 0x402887
ja 0x4028c6
cmp esi, dword [ebp + 0xc]
jb 0x402887
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
cmp dword [ebp - 4], 3
jb 0x402860
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x402840
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
cmp edi, ebx
jbe 0x402906
push 0x8000
push ebx
push dword [esi*4 + 0x46f3fc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc esi
cmp esi, edi
jb 0x4028ee
xor eax, eax
jmp 0x4028e3
Function at 0x402e2a
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00412651
test eax, eax
jne 0x402e58
push str._SCWIPEOUTMGR__Unused_WipeOut_Function
call fcn.0040bf32
pop ecx
xor eax, eax
jmp 0x402f46
push ebx
call fcn.004383c0
cmp eax, 0xff
pop ecx
lea eax, [ebp - 0x20c]
jbe 0x402e84
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x402e93
push str._SCWIPEOUTMGR__Short_Path_Name_NOT_Found
jmp 0x402e4b
push ebx
push 0x104
push eax
call fcn.00438df7
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x402eb5
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [ebp - 0x45c], 0
push 0x24c
lea eax, [ebp - 0x458]
push 0
push eax
call fcn.00437ff0
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x402ef5
push str._SCWIPEOUTMGR__FindFirstFileW_::_Return_INVALID_HANDLE_VALUE
jmp 0x402e4b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x43c]
mov eax, 0x186a0
cmp ecx, eax
ja 0x402f14
cmp dword [ebp - 0x440], 0
jbe 0x402f16
mov ecx, eax
push esi
push ecx
push dword [ebp - 0x440]
lea eax, [ebp - 0x20c]
push eax
call fcn.00402b56
mov esi, eax
add esp, 0xc
test esi, esi
je 0x402f43
push 0
push ebx
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437ed4
leave
ret

Function at 0x402f52
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
mov ebx, ecx
call fcn.00437ff0
add esp, 0xc
push 0x800
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SCWipeOut.dll
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x403003
push str._SCWIPEOUTMGR__GetModuleHandleW_NULL
call fcn.0040bf32
pop ecx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x403003
push str._SCWIPEOUTMGR__LoadLibraryW_NULL
call fcn.0040bf32
pop ecx
call fcn.00402e2a
test eax, eax
jne 0x403032
push str._SCWIPEOUTMGR__Call_DELETEFILE1
call fcn.0040bf32
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403032
push str.SCFileWipeOutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40302e
push str._SCWIPEOUTMGR__GetProcAddress_NULL
call fcn.0040bf32
pop ecx
call fcn.00402e2a
test eax, eax
jne 0x403032
push str._SCWIPEOUTMGR__Call_DELETEFILE2
jmp 0x402ff4
push ebx
call eax
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00437ed4
leave
ret