joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8e0
Capabilities:
Create process on windows
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x14]
push str._fonts_system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, 0x41bbd0
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x118]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x40d9bc
test byte [esp + 0x118], 0x10
jne 0x40d99a
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
mov ebx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x25c]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40d9b1
lea eax, [esp + 0x14]
push eax
call fcn.004084e0
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d94f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x25c]
test eax, eax
je 0x40da01
test ebx, ebx
je 0x40da01
push 4
push 0x4190e0
push 0x41bc04
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40da0e
push 5
push 0
push 0
push str.http:__dl.360safe.com_killer_ati2evxx.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x248
ret
pop edi
pop esi
pop ebp
mov dword [0x41d740], 1
xor eax, eax
pop ebx
add esp, 0x248
ret
Function at 0x40e480
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x420
lea eax, [esp + 8]
push ebx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40e605
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x14]
push eax
call ebx
test al, 0x10
jne 0x40e605
push 0
lea ecx, [esp + 0x11c]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40e605
push ebp
push esi
push edi
mov edi, str.360
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x124]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x124]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
pop edi
pop esi
cmp eax, 0xffffffff
pop ebp
je 0x40e605
lea ecx, [esp + 4]
push ecx
push 0x416b3c
push 1
push 0
push 0x416b4c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40e605
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0x416b5c
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
mov eax, dword [esp + 4]
jl 0x40e5ff
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
lea eax, [esp + 0x14]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov byte [eax], 0
mov eax, dword [esp + 0xc]
add esp, 8
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x118]
push 0x104
lea edx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_mbstowcs]
mov eax, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0x21c]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebx
add esp, 0x420
ret
Function at 0x40e610
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push edi
xor edi, edi
call fcn.004082f0
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40e68f
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x13c]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e67e
inc edi
test ebp, ebp
je 0x40e67e
mov eax, dword [esp + 0x18]
push eax
push 0
push 1
call esi
test eax, eax
je 0x40e67e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e647
pop esi
pop ebp
test ebx, ebx
je 0x40e69a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
add esp, 0x128
ret

Function at 0x40e6f0
Capabilities:
Delete registry value
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.AppInit_Dlls
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
xor ebp, ebp
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40e77f
cmp dword [esp + 0x10], 1
jne 0x40e77f
lea eax, [esp + 0x18]
push str.helps.dll
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e77f
mov eax, dword [esp + 0x120]
mov ebp, 1
test eax, eax
jne 0x40e76a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret
push str.AppInit_Dlls
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 2
mov ecx, 0x41d8a8
call fcn.00412080
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
je 0x40e824
mov ebx, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea esi, [edi + 0x108]
push 0x5c
push esi
call ebx
add esp, 8
test eax, eax
jne 0x40e7cf
push 0x2f
push esi
call ebx
add esp, 8
test eax, eax
jne 0x40e7d0
mov eax, esi
jmp 0x40e7d0
inc eax
push str.helps.dll
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e804
mov eax, dword [esp + 0x120]
test eax, eax
je 0x40e75a
push 1
push edi
mov ecx, 0x41d8a8
call fcn.00411720
mov ebp, 1
lea edx, [esp + 0x10]
mov ecx, 0x41d8a8
push edx
push 2
call fcn.00412080
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
jne 0x40e7ad
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40e840
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x218
lea eax, [esp]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerDisallowRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e917
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
mov ebx, 0x104
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x134]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
call edi
test eax, eax
jne 0x40e90c
lea ecx, [esp + 0x20]
push str.360safe.exe
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e8ee
mov eax, dword [esp + 0x22c]
test eax, eax
je 0x40e8f1
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x124]
push edx
push eax
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40e880
inc esi
jmp 0x40e880
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x218
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x218
ret

Function at 0x40e930
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push str.CLSID9C194C3F_615E_47EC_8552_88BB30DFF968
push 0x80000000
call fcn.00406120
add esp, 8
test eax, eax
jne 0x40e993
push str.hngind.TFlashExecuteHook
push 0x80000000
call fcn.00406120
add esp, 8
test eax, eax
jne 0x40e993
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp]
push str.hngind.dll
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp]
push edx
call fcn.00406220
add esp, 4
test eax, eax
je 0x40e99d
mov dword [0x41d920], 1
add esp, 0x104
ret

Function at 0x40e9b0
Capabilities:
Delete registry key
Get common file path

Disassembly:
sub esp, 0x104
call fcn.0040e930
test eax, eax
je 0x40ea16
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.CLSID9C194C3F_615E_47EC_8552_88BB30DFF968
push 0x80000000
call esi
push str.hngind.TFlashExecuteHook
push 0x80000000
call esi
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push str.hngind.dll
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 4]
push edx
call fcn.00406550
add esp, 4
mov dword [0x41d920], 1
pop esi
add esp, 0x104
ret
Function at 0x40f360
Capabilities:
Get disk information

Disassembly:
sub esp, 0x210
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ebp
push 0x100
push eax
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x128]
push 0x100
push ecx
push 0x41a2b4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x40f3a4
pop ebp
add esp, 0x210
ret
mov ecx, dword [esp + 0x224]
cmp ecx, 4
ja case.default.0x40f3b0
jmp dword [ecx*4 + 0x40f478]
mov ebp, str.0123456789ABCDEF
jmp 0x40f3d1
mov ebp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
jmp 0x40f3d1
mov ebp, str.abcdefghijklmnopqrstuvwxyz
jmp 0x40f3d1
mov ebp, str.0123456789abcdefghijklmnopqrstuvwxyz
test ebp, ebp
jne 0x40f3df
xor eax, eax
pop ebp
add esp, 0x210
ret
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
test ebx, ebx
jne 0x40f3ff
mov eax, dword [esp + 0x10]
xor edx, edx
mov esi, 7
div esi
mov ebx, edx
add ebx, 2
cmp ecx, 4
jne 0x40f419
mov eax, 0x51eb851f
mul dword [esp + 0x10]
mov eax, edx
xor edx, edx
shr eax, 5
div ebx
inc edx
mov ebx, edx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x224]
test ebx, ebx
jle 0x40f461
mov eax, dword [esp + 0x22c]
lea edi, [eax + 1]
imul edi, dword [esp + 0x10]
add edi, eax
mov eax, edi
xor edx, edx
div dword [esp + 0x14]
inc esi
mov dl, byte [edx + ebp]
mov byte [esi + ecx - 1], dl
mov edx, dword [esp + 0x10]
add edi, edx
cmp esi, ebx
jl 0x40f447
mov byte [esi + ecx], 0
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
add esp, 0x210
ret
Function at 0x40f6c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [0x41db98]
push ebp
push esi
mov esi, dword [0x41db94]
push edi
cmp esi, ebx
je 0x40f6fc
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40f6e9
push eax
call fcn.00406550
add esp, 4
mov ebx, dword [0x41db98]
add esi, 4
cmp esi, ebx
jne 0x40f6d7
mov esi, dword [0x41db94]
mov ebp, ebx
mov dword [esp + 0x10], ebx
cmp ebp, ebx
je 0x40f781
mov eax, dword [esi]
mov ebx, dword [ebp]
cmp eax, ebx
je 0x40f76d
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x40f723
mov ecx, dword [0x419034]
add eax, 0xfffffff4
cmp eax, ecx
jne 0x40f72a
mov eax, dword [ebx - 0xc]
test eax, eax
jge 0x40f757
mov edi, dword [ebx - 8]
mov ecx, esi
push edi
call fcn.00404c70
test eax, eax
je 0x40f76d
mov ecx, dword [esi]
push edi
lea eax, [edi + 1]
push ebx
push eax
push ecx
call fcn.00403ff0
mov edx, dword [esi]
add esp, 0x10
mov dword [edx - 8], edi
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x40f76d
mov ecx, esi
call fcn.00404d10
mov eax, dword [ebp]
mov dword [esi], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
add ebp, 4
add esi, 4
cmp ebp, eax
jne 0x40f706
mov ebx, dword [0x41db98]
cmp esi, ebx
mov edi, esi
je 0x40f7bb
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [edi]
mov edx, dword [0x419034]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40f7b4
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x40f7b4
mov edx, dword [edi]
sub edx, 0xc
push edx
call fcn.00413190
add esp, 4
add edi, 4
cmp edi, ebx
jne 0x40f78d
mov eax, dword [str.about:blank]
mov ecx, dword [0x419f7c]
mov edx, dword [0x419f80]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0xb
push eax
push 1
push str.Start_Page
mov dword [0x41db98], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push str.softwaremicrosoftinternet_explorermain
push 0x80000001
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call esi
lea ecx, [esp + 0x14]
push 0xb
push ecx
push 1
push str.Start_Page
push str.softwaremicrosoftinternet_explorermain
push 0x80000002
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4100b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Driverswsfit32.sys
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x410103
mov eax, dword [str.SYSTEMCurrentControlSetServiceswsfit32]
push eax
push 0x80000002
call fcn.00406120
add esp, 8
test eax, eax
jne 0x410103
add esp, 0x104
ret
mov eax, 1
add esp, 0x104
ret
Function at 0x410140
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.C:Program_FilesCommon_FilesMicrosoft_Shared_apgefvc.exe
or ecx, 0xffffffff
xor eax, eax
mov bl, byte [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], bl
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4101a3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret
test al, 2
mov esi, 1
jne 0x4101b0
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x41026e
mov edi, str.C:Program_FilesCommon_FilesSystem_nluoyvq.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov byte [esp + 0x11c], bl
push ecx
call fcn.00406d10
push 0
lea edx, [esp + 0x124]
push 0
push edx
call fcn.00406d10
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
xor esi, esi
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x410234
push 0x32
call edi
inc esi
cmp esi, 0x1e
jb 0x41021f
lea ecx, [esp + 0x10]
push ecx
call fcn.00410370
add esp, 4
lea edx, [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x114]
push eax
call ebx
lea ecx, [esp + 0x10]
mov esi, eax
push ecx
call fcn.00410280
lea edx, [esp + 0x118]
push edx
call fcn.00410280
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x410280
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
lea eax, [esp]
push ebx
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410357
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x34], ebx
call edi
test eax, eax
jne 0x41033f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x124]
push ecx
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
jne 0x41033c
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x41033c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
jmp 0x4102c5
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218
ret
xor eax, eax
pop ebx
add esp, 0x218
ret
Function at 0x410370
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ebp, ebp
push eax
push 0x2001f
push ebp
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x4104b3
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x1c]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4104a8
lea edx, [esp + 0x24]
lea eax, [esp + 0x128]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x128]
push ecx
push 0x2001f
push 0
push edx
push 0x80000002
call edi
test eax, eax
jne 0x41047b
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
push 0
push str.debugger
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410470
mov ecx, dword [esp + 0x230]
lea edx, [esp + 0x24]
push ecx
push edx
mov ebp, 1
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x410484
mov eax, dword [esp + 0x14]
push str.debugger
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x1c]
jmp 0x4103b4
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x21c
ret
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x410660
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x410677
xor edi, edi
jmp 0x4106a4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004140a0
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x410785
cmp dword [ebp + 8], 2
jl 0x410785
mov esi, dword [eax + 4]
push 0x2c
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x4106d6
mov word [eax], 0
lea ecx, [ebp - 0x208]
push ecx
push str..dll
push esi
call fcn.004107a0
add esp, 0xc
test eax, eax
je 0x410785
lea edx, [ebp - 0x208]
test edx, edx
jne 0x410701
xor esi, esi
jmp 0x41073c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004140a0
mov esi, esp
push 0
push 0
push edi
push esi
lea ecx, [ebp - 0x208]
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0xc]
mov edx, esi
mov edi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x41076b
mov byte [eax], cl
inc eax
dec edi
jne 0x410748
dec eax
mov byte [eax], 0
mov eax, 1
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x410770
dec eax
mov byte [eax], 0
mov eax, 1
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esp, [ebp - 0x214]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push str.Rundll32.exe
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov esi, dword [esp + 0x10c]
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41084b
mov eax, 1
pop esi
add esp, 0x104
ret
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00407430
add esp, 0x10
pop esi
add esp, 0x104
ret