joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fa0
Capabilities:
Identify system language via api
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43037d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x4090f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
push str.Software_s
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x1c]
add esp, 0xc
mov ebx, section..data
nop
mov edi, dword [ebx]
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push esi
push 0x80000001
mov ecx, 0x4449b8
mov dword [ebp - 0x14], 0
call fcn.00408a50
cmp al, 1
je 0x40904f
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x4449b8
push eax
push edi
push esi
push 0x80000002
call fcn.00408a50
cmp al, 1
jne 0x409056
mov edi, dword [ebp - 0x14]
test edi, edi
jne 0x4090af
add ebx, 4
cmp ebx, 0x44000c
jne 0x409010
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 0xf8]
test ebx, ebx
je 0x4090ad
mov eax, dword [eax + 0xf4]
and edx, 0x3ff
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
movzx edi, word [eax + ecx*4]
mov eax, edi
and eax, 0x3ff
cmp ax, dx
je 0x4090ec
inc ecx
mov eax, ecx
shr eax, 0x1f
cmp eax, ebx
mov eax, dword [ebp - 0x18]
jne 0x409090
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4090ce
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret
and edi, 0x3ff
jmp 0x4090af
push 0x80004005
call fcn.00401fc0
int3
Function at 0x4094c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4303fd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0xf8]
lea ebx, [esi + 0xf8]
test edi, edi
jne 0x409504
xor al, al
jmp 0x4096b2
cmp edi, 0x409
jne 0x40951a
call fcn.00408fa0
cmp eax, edi
mov dword [ebx], eax
mov ecx, edi
cmove edi, ecx
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x4096ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [esi + 4]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push str.Software_s
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x1c]
add esp, 0xc
mov ecx, 0x4449b9
push 0
push edi
push str.Language
push esi
push 0x80000001
call fcn.00408bd0
push 0
push edi
push str.Language
push esi
push 0x80000002
mov ecx, 0x4449b9
call fcn.00408bd0
push 0
push edi
push str.InstallerLanguageDWORD
push str.SoftwareProcessLasso
push 0x80000001
mov ecx, 0x4449b9
call fcn.00408bd0
push 0
push edi
push str.InstallerLanguageDWORD
push str.SoftwareProcessLasso
push 0x80000002
mov ecx, 0x4449b9
call fcn.00408bd0
push 0
push edi
push str.Language
push str.SoftwareProcessLasso
push 0x80000001
mov ecx, 0x4449b9
call fcn.00408bd0
push 0
push edi
push str.Language
push str.SoftwareProcessLasso
push 0x80000002
mov ecx, 0x4449b9
call fcn.00408bd0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4441b8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x409642
push 4
push ebx
push 3
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4441b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40968f
push 4
push ebx
push 3
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x409691
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4096b0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401fc0
int3
Function at 0x40b740
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4306f1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x445644]
mov edi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x444b7c]
cmp eax, dword [ecx + 4]
jg 0x40b877
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
jne 0x40b80d
mov dword [ebp - 0x14], eax
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0xcab
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, 0x4a7
mov dword [ebp - 0x18], 8
nop dword [eax]
push 0
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc esi
sub dword [ebp - 0x18], 1
jne 0x40b7d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 1
jb 0x40b7a6
mov ecx, 0x444b18
call fcn.00407d50
cmp eax, 1
ja 0x40b7a6
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, 0x4a7
nop dword [eax]
lea eax, [esi - 0x4a7]
cmp eax, dword [ebp - 0x14]
ja 0x40b84c
push 1
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
jmp 0x40b85b
push 0
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc esi
lea eax, [esi - 0x4a7]
cmp eax, 8
jb 0x40b830
jmp 0x40b7f1
push 0x444b7c
call fcn.0041c7dc
add esp, 4
cmp dword [0x444b7c], 0xffffffff
jne 0x40b78e
mov ecx, 0x444b18
mov dword [ebp - 4], 0
call fcn.004073d0
push 0x4313f0
call fcn.0041ca7c
push 0x444b7c
mov dword [ebp - 4], 0xffffffff
call fcn.0041c78b
add esp, 8
jmp 0x40b78e
Function at 0x40b8d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430735
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push eax
push edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x40ba41
push ebx
call fcn.00409ae0
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0041e7e0
add esp, 0x10
lea ecx, [ebp - 0x74]
call fcn.004073d0
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0
call fcn.00407d50
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x80], eax
cmp eax, 1
ja 0x40b98d
push 0
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebx
call edi
mov ebx, dword [ebp - 0x7c]
push 0
push dword [ebp - 0x78]
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
push 0
push dword [ebp - 0x78]
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call edi
jmp 0x40ba39
push 1
push ebx
call esi
push 1
push dword [ebp - 0x78]
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x40ba5d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
push 0x432618
push eax
call fcn.00402f80
add esp, 8
push dword [ebp - 0x78]
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
push edi
lea eax, [ebp - 0x78]
push 0x432620
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x78]
add esp, 0xc
push esi
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, dword [ebp - 0x80]
jb 0x40b9e3
push 0
push 0
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ba39
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x74]
call fcn.00407530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401fc0
int3
Function at 0x412f00
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430af0
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x818], edi
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x413125
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 0
push eax
push 0x80000002
mov ecx, esi
call fcn.00412bf0
cmp al, 1
je 0x413092
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
push 0x80000001
call fcn.00412bf0
cmp al, 1
je 0x413092
call fcn.0041b9c0
push 0x800
mov bl, al
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0041e7e0
add esp, 0xc
mov eax, 0x23
test bl, bl
mov ecx, 0x1c
cmovne ecx, eax
lea eax, [ebp - 0x810]
push 1
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x413083
mov ebx, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x810]
push 0
push eax
push 0
call ebx
lea edi, [ebp - 0x810]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x412ff5
push 0
lea eax, [ebp - 0x810]
mov ecx, 7
push eax
mov esi, 0x432598
rep movsd dword es:[edi], dword [esi]
push 0
call ebx
lea ecx, [ebp - 0x810]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x413023
mov eax, dword [str.config]
mov dword [ecx], eax
mov eax, dword [0x4359ac]
mov dword [ecx + 4], eax
mov eax, dword [0x4359b0]
mov dword [ecx + 8], eax
mov eax, dword [0x4359b4]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413057
mov edi, dword [ebp - 0x818]
lea eax, [ebp - 0x810]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00401840
mov esi, dword [ebp - 0x814]
jmp 0x4130df
mov ecx, edi
call fcn.004019b0
mov esi, dword [ebp - 0x814]
jmp 0x4130df
mov esi, dword [ebp - 0x814]
cmp dword [esi - 0xc], 0
jl 0x4130b9
push str.config
push esi
call fcn.0041df87
add esp, 8
test eax, eax
je 0x4130b9
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4130d1
push 7
push str.config
lea ecx, [ebp - 0x814]
call fcn.00403c10
mov esi, dword [ebp - 0x814]
lea eax, [ebp - 0x814]
mov ecx, edi
push eax
call fcn.004024f0
push edi
call fcn.004065a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x413107
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401fc0
int3
Function at 0x413130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x4132ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sPerfOptions
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
add esp, 0xc
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4132ab
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
lea eax, [edi + 4]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push str.CpuPriorityClass
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call eax
test eax, eax
je 0x4131e5
or eax, 0xffffffff
jmp 0x41322a
mov eax, dword [edi + 4]
dec eax
cmp eax, 5
ja case.default.0x4131ee
jmp dword [eax*4 + 0x4132fc]
mov eax, 0x100
jmp 0x413222
mov eax, 0x80
jmp 0x413222
mov eax, 0x8000
jmp 0x413222
mov eax, 0x20
jmp 0x413222
mov eax, 0x4000
jmp 0x413222
mov eax, 0x40
jmp 0x413222
or eax, 0xffffffff
or dword [edi], 1
mov ebx, 1
mov dword [edi + 4], eax
lea ecx, [ebp - 0x18]
push ecx
lea eax, [edi + 8]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 4
push eax
push 0
push str.IoPriority
push dword [ebp - 0x1c]
call dword [ebp - 0x20]
test eax, eax
je 0x413261
mov dword [edi + 8], 0xffffffff
jmp 0x413265
or dword [edi], 4
inc ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push ecx
lea eax, [edi + 0xc]
mov dword [ebp - 0x18], 4
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.PagePriority
push dword [ebp - 0x1c]
call dword [ebp - 0x20]
test eax, eax
je 0x41329e
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xffffffff
jmp 0x4132a2
or dword [edi], 8
inc ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov dword [ebp - 4], 0xffffffff
setne bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4132cf
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00401fc0
nop dword [eax]
sbb byte [edx], dh
inc ecx
add byte [edx], cl
xor al, byte [ecx]
cld
xor dword [ecx], eax
cmc
xor dword [ecx], eax
adc dword [edx], esi
inc ecx
add byte [ebx], al
xor al, byte [ecx]
int3
Function at 0x413320
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b70
mov eax, dword fs:[0]
push eax
mov eax, 0x2014
call fcn.0041ce70
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004019b0
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x2018], 0
push eax
mov ecx, esi
call fcn.00413530
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ebp - 0x2018]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4133ae
mov ecx, edi
call fcn.004019b0
jmp 0x4134e0
lea eax, [ebp - 0x201c]
mov dword [ebp - 0x201c], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x1000
jae 0x4134d2
cmp dword [ebp - 0x201c], 0
jne 0x4134d2
test ebx, ebx
jne 0x4133fa
mov ecx, edi
call fcn.004019b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x4134e2
push 0x2002
lea eax, [ebp - 0x2014]
push 0
push eax
call fcn.0041e7e0
add esp, 0xc
mov dword [ebp - 0x2020], 0
lea eax, [ebp - 0x2020]
push 0
push eax
push ebx
lea eax, [ebp - 0x2014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4134d9
lea ecx, [ebp - 0x2014]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413443
sub ecx, edx
lea eax, [ebp - 0x2014]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00401840
push 0x432414
push 0x435a58
mov ecx, edi
call fcn.00408300
push 0x432414
push 0x432894
mov ecx, edi
call fcn.00408300
push 0x432414
push 0x43c1ac
mov ecx, edi
call fcn.00408300
push 0x432414
push 0x432554
mov ecx, edi
call fcn.00408300
push 0x432414
push 0x43b7ec
mov ecx, edi
call fcn.00408300
push 0x432414
push 0x435a5c
mov ecx, edi
call fcn.00408300
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x4134e2
mov ecx, edi
call fcn.004019b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov eax, dword [ebp - 0x2018]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x413507
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret 4
Function at 0x413910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4304cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x440440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x3054]
test eax, eax
je 0x4139b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3054], 0
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x4139c3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00412ac0
push 9
push str..pl_lock
lea ecx, [ebp - 0x10]
call fcn.00403c10
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4139b1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401fc0
int3
Function at 0x41ac70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43110d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ae0f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sPerfOptions
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41adcb
test byte [edi], 1
mov ecx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x41ad7e
mov eax, dword [edi + 4]
cmp eax, 0x100
jg 0x41ad3d
je 0x41ad36
sub eax, 0x20
je 0x41ad2f
sub eax, 0x20
je 0x41ad28
sub eax, 0x40
jne 0x41ad4b
lea eax, [ebx + 3]
jmp 0x41ad5c
mov eax, 1
jmp 0x41ad5c
mov eax, 2
jmp 0x41ad5c
mov eax, 4
jmp 0x41ad5c
cmp eax, 0x4000
je 0x41ad57
cmp eax, 0x8000
je 0x41ad50
or eax, 0xffffffff
jmp 0x41ad5c
mov eax, 6
jmp 0x41ad5c
mov eax, 5
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.CpuPriorityClass
push dword [ebp - 0x1c]
call ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, 1
test byte [edi], 4
je 0x41ad9e
mov eax, dword [edi + 8]
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.IoPriority
push dword [ebp - 0x1c]
call ecx
inc ebx
test byte [edi], 8
je 0x41adc2
mov eax, dword [edi + 0xc]
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.PagePriority
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov dword [ebp - 4], 0xffffffff
setne bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41adef
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00401fc0
int3

Function at 0x41d572
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d5b1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d5b1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d5b1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d5b1
cmp dword [ecx + 0x74], 0xe
jbe 0x41d5b1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x427e2c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4396cc
push 0x4396c4
push str.FlsAlloc
push 0x1f
call fcn.00427d67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427e60
push dword [ebp + 8]
mov ecx, esi
call dword [0x432320]
call esi
jmp 0x427e66
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x427eaa
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4396dc
push 0x4396d4
push str.FlsGetValue
push 0x21
call fcn.00427d67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427ee1
push dword [ebp + 8]
mov ecx, esi
call dword [0x432320]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x427ee9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4396e4
push 0x4396dc
push str.FlsSetValue
push 0x22
call fcn.00427d67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427f23
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x432320]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]