joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482a10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004525c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00452640
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00452640
lea ecx, [esi + 0xc]
call fcn.004722ce
lea ecx, [esi + 0x10]
call fcn.004722ce
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00454e70
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00454e70
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00454e70
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00472343
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00472343
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4536b8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x482c38
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4536c8
call fcn.00453be0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4537ab
cmp byte [edi], 0
je 0x4537ab
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4536ed
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004523e0
test eax, eax
jne 0x45370d
push 0x4f0800
lea ecx, [esi + 0x38]
call fcn.004724cc
jmp 0x4537ab
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00452430
test eax, eax
jne 0x45373c
mov ecx, esi
call fcn.00452530
push edi
add esi, 0x38
push 0x4f07dc
push esi
call fcn.0046feba
add esp, 0xc
jmp 0x4537ab
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00454460
test eax, eax
je 0x4537a4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00453880
test eax, eax
jne 0x4537c0
push edi
lea eax, [esi + 0x38]
push 0x4f07b8
push eax
call fcn.0046feba
add esp, 0xc
mov ecx, esi
call fcn.00453be0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x453868
mov ecx, dword [0x4f0d00]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0046feba
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004524e0
test eax, eax
jne 0x45382a
push 0x4f079c
lea ecx, [esi + 0x38]
call fcn.004724cc
jmp 0x45383a
push 0xfa
mov ecx, esi
call fcn.00454460
test eax, eax
jne 0x453857
mov ecx, esi
call fcn.00453be0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00472343
jmp 0x4537ab
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00472343
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x456a30
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x456ad3
test eax, eax
jbe 0x456ad3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x456ad3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x456a7e
xor esi, esi
jmp 0x456a84
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x456aaf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00405c60
add esi, eax
push esi
mov ebx, esi
call fcn.00405c60
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x456a90
pop ebp
test edi, edi
pop edi
jne 0x456ad3
test ebx, ebx
je 0x456ad3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004623a0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x456c15
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x456d2d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456d2d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00473d8f
mov esi, eax
test esi, esi
je 0x456d2d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x456d2d
mov ecx, esi
call fcn.00456b80
cmp edi, eax
jge 0x456d2d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x456cb3
mov dword [esp + 0x34], 1
jmp 0x456d0e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x456d2d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00456170
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x474733
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47476b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004727ea
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004727c2
jmp 0x474777
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x475e24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x475e66
call fcn.0047bbca
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x475e66
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x475e5d
xor eax, eax
jmp 0x475e6e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00475e74
pop edi
pop esi
pop ebx
ret 4

Function at 0x47c0fa
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47c128
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x47c146
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047c060
jmp 0x47c146
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c146
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047c060
test edi, edi
mov eax, edi
jne 0x47c130
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
mov eax, dword [edx]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push eax
mov dword [esp + 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409ec4
mov ecx, dword [esp + 4]
cmp ecx, 1
je 0x409ea4
cmp ecx, 2
jne 0x409ec4
mov eax, dword [esp]
cmp eax, 1
jb 0x409eb9
mov word [esi + eax*2 - 2], 0
xor eax, eax
add esp, 8
ret
mov word [esi], 0
xor eax, eax
add esp, 8
ret
test eax, eax
mov word [esi], 0
jne 0x409ed2
mov eax, 0xb
add esp, 8
ret

Function at 0x409ee0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, eax
mov edx, edi
call fcn.00409e70
test eax, eax
je 0x409f1e
mov eax, dword [edi]
push ebx
push 2
push 0x43a78c
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov ebx, 0x104
mov eax, 0x43a78c
mov edx, esi
call fcn.00409520
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x40a390
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x43f], 0
push edi
mov edi, dword [esp + 0xc]
je 0x40a3a8
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 0x43c], 0
je 0x40a3cb
xor eax, eax
cmp byte [edi], al
je 0x40a3c0
add eax, 1
cmp byte [eax + edi], 0
jne 0x40a3b7
push eax
add esi, 0xc
mov ecx, edi
call fcn.0040a6b0
pop edi
pop esi
ret 4

Function at 0x40a780
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4431e0]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push esi
lea esi, [eax + 8]
add eax, 0x210
push eax
push esi
lea eax, [esp + 0xc]
push str._s_s
push eax
mov eax, 0x104
call fcn.00409f80
add esp, 0x10
push 0x80
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.0041f01a
add esp, 0x20c
ret 4
Function at 0x40b050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x435ec9
mov eax, dword fs:[0]
push eax
sub esp, 0xda8
mov eax, dword [0x4431e0]
xor eax, esp
mov dword [esp + 0xda0], eax
push ebx
push esi
push edi
mov eax, dword [0x4431e0]
xor eax, esp
push eax
lea eax, [esp + 0xdb8]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0xdc0], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0xdc0], 2
lea eax, [esp + 0x14]
push eax
call fcn.0040e880
lea ecx, [esp + 0x4c]
push ecx
call fcn.00410720
mov byte [esp + 0xdc0], 3
lea edi, [esp + 0x4c]
call fcn.00412030
mov edi, eax
lea eax, [esp + 0x488]
call fcn.004120f0
mov edx, dword [esp + 0x50]
push esi
push esi
push 0x474
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea esi, [esp + 0x560]
call fcn.00413ab0
test edi, edi
jne 0x40b13c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x43b1ec
mov ecx, esi
mov edx, 0x43b1dc
call fcn.0040fc40
add esp, 4
jmp 0x40b23b
mov edx, dword [esp + 0x50]
xor ecx, ecx
cmp byte [ebp + 0xc], cl
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x50]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [0x446d04], 8
mov eax, dword [0x446cf0]
jae 0x40b177
mov eax, 0x446cf0
mov edx, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x5a4], edx
mov ebx, 0x400
lea edx, [esp + 0x5ac]
mov dword [esp + 0x59c], 0x43bd74
mov dword [esp + 0x5a0], ecx
mov dword [esp + 0x5a8], 0
call fcn.00409520
mov byte [esp + 0xdc0], 4
lea edi, [esp + 0x5ac]
lea esi, [esp + 0x59c]
call fcn.0041a520
mov esi, eax
test esi, esi
je 0x40b1ea
push 0x43b1ec
mov ecx, esi
mov edx, str.StartListening
call fcn.0040fc40
add esp, 4
jmp 0x40b228
lea edi, [esp + 0x14]
call fcn.0040e7e0
mov esi, eax
mov eax, dword [esp + 0x5a8]
test eax, eax
je 0x40b20d
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x5a0]
push ecx
lea edx, [esp + 0x5b0]
push edx
call dword [sym.imp.USER32.dll_UnregisterClassW]
call fcn.0040e660
mov byte [esp + 0xdc0], 3
mov dword [esp + 0x59c], 0x43bd74
mov byte [esp + 0xdc0], 2
lea ecx, [esp + 0x4c]
call fcn.00410ad0
mov dword [esp + 0xdc0], 0xffffffff
lea eax, [esp + 0x14]
push eax
call fcn.0040b290
mov eax, esi
mov ecx, dword [esp + 0xdb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xda0]
xor ecx, esp
call fcn.0041f01a
mov esp, ebp
pop ebp
ret
Function at 0x40c170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x433e30
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4431e0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 0x414]
call dword [0x44302c]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x410]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
mov byte [ebp - 4], 1
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x40c1f6
call fcn.0040bca0
mov edi, eax
jmp 0x40c31b
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40c20f
call fcn.0040bca0
jmp 0x40c312
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40c228
call fcn.0040bca0
jmp 0x40c312
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x20], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40c269
mov byte [ebp - 4], 0
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x40c250
lea eax, [ebp]
call fcn.0040d6a0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x18]
call fcn.0040bc80
mov eax, 0x8007000e
jmp 0x40c338
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
ja 0x40c283
cmp eax, 0xffffffff
jbe 0x40c28d
push 0x80070057
call fcn.0040e040
cmp eax, 0x400
jbe 0x40c2a6
lea edx, [ebp]
push edx
call fcn.0040d710
mov dword [ebp - 4], 1
jmp 0x40c2c8
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x40c2c8
mov ebx, dword [ebp]
test ebx, ebx
jne 0x40c2d6
mov edi, 0x8007000e
jmp 0x40c314
call dword [0x44302c]
push edi
push ebx
push edi
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40c2f7
call fcn.0040bca0
jmp 0x40c312
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x418]
push eax
mov ecx, dword [ebp]
lea edx, [ebp - 0x28]
call fcn.0040c360
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x40c32f
lea eax, [ebp]
call fcn.0040d6a0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0041f01a
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d6b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x40d6c3
push 0x80004005
call fcn.0040e040
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40d6d0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40d850
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x43365b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4431e0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4431e0]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x244]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x23c], esi
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push esi
push ebx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x40d982
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x40d8de
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
cmp eax, esi
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x14], ecx
jne 0x40d982
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x24]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x40]
push edx
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
jne 0x40d962
jmp 0x40d920
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.0040d850
mov ebx, eax
cmp ebx, esi
jne 0x40d9cc
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
je 0x40d920
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40d975
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov edx, dword [ebp]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40d9a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0041f01a
add esp, 0x22c
ret 4
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40d9ea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, ebx
jmp 0x40d9a2
Function at 0x413270
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
push esi
je 0x41327d
lea esi, [eax - 0x43c]
jmp 0x41327f
xor esi, esi
cmp byte [eax + 0x1c], 0
je 0x4132b3
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x4132a4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4132b8
test edi, edi
jne 0x4132b3
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4132b8
cmp edi, 1
je 0x4132d1
mov ecx, ebx
shr ecx, 0x10
movsx edx, cx
movsx eax, bx
push edx
push eax
add esi, 0x43c
push esi
call fcn.004132e0
xor eax, eax
pop esi
ret

Function at 0x41a781
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x41a799
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x41a7cb
call ebx
test eax, eax
jne 0x41a816
cmp dword [esi + 0x14], 0
push edi
je 0x41a7d0
pop edi
pop esi
mov eax, 0xb7
pop ebx
ret 0xc
mov dword [esi + 8], eax
jmp 0x41a7b9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea edi, [esi + 0x18]
push edi
push ecx
push esi
push 0x40a090
push edx
push 0
call fcn.00421047
add esp, 0x18
test eax, eax
jne 0x41a81b
call ebx
test eax, eax
mov dword [edi], 0
jne 0x41a815
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x41a813
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
ret 0xc
mov dword [esi + 0x14], eax
jmp 0x41a7fe
Function at 0x41c910
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
push esi
je 0x41c91a
lea esi, [eax - 0x20]
jmp 0x41c91c
xor esi, esi
cmp byte [eax + 0x1c], 0
je 0x41c950
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x41c941
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41c955
test edi, edi
jne 0x41c950
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41c955
cmp edi, 1
je 0x41c96b
mov ecx, ebx
shr ecx, 0x10
movsx edx, cx
movsx eax, bx
push edx
push eax
add esi, 0x20
push esi
call fcn.0041c970
xor eax, eax
pop esi
ret

Function at 0x41e430
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
push esi
je 0x41e43a
lea esi, [eax - 0x20]
jmp 0x41e43c
xor esi, esi
cmp byte [eax + 0x1c], 0
je 0x41e470
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x41e461
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41e475
test edi, edi
jne 0x41e470
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41e475
cmp edi, 1
je 0x41e48b
mov ecx, ebx
shr ecx, 0x10
movsx edx, cx
movsx eax, bx
push edx
push eax
add esi, 0x20
push esi
call fcn.0041e490
xor eax, eax
pop esi
ret

Function at 0x41e998
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4431e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041e92d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00422aa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41e9e7
cmp dword [ebp - 0x1c], 5
jb 0x41e9ff
jmp 0x41e9fb
cmp dword [ebp - 0x10], 1
jne 0x41e9ff
cmp dword [ebp - 0x1c], 4
ja 0x41e9fb
jne 0x41e9ff
cmp dword [ebp - 0x18], 0
jbe 0x41e9ff
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x437424
call fcn.0040e080
test eax, eax
jge 0x41ea20
mov byte [0x4473e4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041f01a
add ebp, 0x78
leave
ret
Function at 0x41ec9f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x445ab4], 0
push esi
jne 0x41ec12
call fcn.0041eb3d
test eax, eax
je 0x41ec55
mov eax, dword [0x445ab4]
cmp eax, 1
jne 0x41ec33
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41ec55
pop esi
ret
push eax
call dword [0x445abc]
test eax, eax
jne 0x41ec9d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41ec59
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x445ab4]
call dword [0x445abc]
mov edi, eax
test edi, edi
je 0x41ec80
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41ec9c
lea edi, [esi + 0xff0]
push esi
push dword [0x445ab4]
call dword [0x445ab8]
add esi, 0x10
cmp esi, edi
jb 0x41ec86
mov eax, esi
pop edi
pop esi
ret
jmp 0x41ebff

Function at 0x41f01a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4431e0]
jne 0x41f024
repz ret
jmp fcn.00422e94