joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c83eb
Capabilities:
Persist via run registry key

Disassembly:
push 0x6c
mov eax, 0x628d1b
call fcn.00429e48
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
mov byte [edi], bl
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
call fcn.004ca196
mov esi, eax
test esi, esi
js 0x4c84ea
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push str.OneDrive
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00411838
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.00411838
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x60]
push eax
push reloc.WS2_32.dll_accept
call fcn.004cc44e
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.0041395f
lea ecx, [ebp - 0x78]
call fcn.0041395f
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0043c7e7
pop ecx
pop ecx
test eax, eax
jne 0x4c84af
mov byte [edi], 1
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4c84ea
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x4c84e1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.00429b68
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4c8525
mov ecx, dword [ebp - 0x44]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4c851c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.00429b68
pop ecx
pop ecx
mov eax, esi
call fcn.00429df7
ret 4

Function at 0x4c8f05
Capabilities:
Delete file

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
xor edi, edi
cmp dword [esi + 0x14], 8
jb 0x4c8f29
mov eax, dword [esi]
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4c8f6a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 8
jb 0x4c8f4b
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4c8f6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00429dd5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4c8f03
Function at 0x4c96cb
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x228
mov eax, 0x628fdf
call fcn.00429e48
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
call fcn.004573d8
xor ecx, ecx
mov eax, 0x200
cmp dword [ebp + 0x10], 1
mov edx, 0x100
cmove ecx, eax
xor eax, eax
cmp dword [ebp + 0x10], 2
cmove eax, edx
and dword [ebp - 0x230], 0
or ecx, eax
or ecx, 0x20019
cmp dword [esi + 0x14], 8
jb 0x4c9723
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4c97e1
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x4c97b8
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00411838
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.00425806
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.0041395f
jmp 0x4c97c0
cmp edi, 0x103
jne 0x4c97c7
inc ebx
test edi, edi
je 0x4c974d
jmp 0x4c97d5
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00429df7
ret 0x10

Function at 0x4ca7a0
Capabilities:
Get common file path

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
mov dword [ebp - 0x210], 0x104
push esi
push eax
call fcn.0042af50
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
test eax, eax
je 0x4ca801
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00411a05
jmp 0x4ca815
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00429dd5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4ca79e
Function at 0x4ca827
Capabilities:
Get file version info

Disassembly:
push 0xd4
mov eax, 0x629355
call fcn.00429e48
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ecx
mov dword [ebx], ecx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 7
mov dword [ebp - 0x14], esi
mov word [ebx], ax
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc4], 1
jb 0x4ca875
mov eax, dword [esi]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x4ca9f7
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0xbd]
mov dword [ebp - 4], 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.004236bd
cmp dword [esi + 0x14], 8
jb 0x4ca8be
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x24]
push esi
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4ca9c5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x68d3d8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ca9c5
push 0x98
lea eax, [ebp - 0xbc]
push edi
push eax
call fcn.0042af50
add esp, 0xc
lea ecx, [ebp - 0xbc]
push 1
call fcn.00475592
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 2
movzx eax, word [eax + 0xa]
push eax
call fcn.0041f09e
mov edi, 0x68ff58
lea eax, [ebp - 0xbc]
push edi
push eax
call fcn.00420e72
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
movzx eax, word [eax + 8]
push eax
call fcn.0041f09e
push edi
lea eax, [ebp - 0xbc]
push eax
call fcn.00420e72
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
movzx eax, word [eax + 0xe]
push eax
call fcn.0041f09e
push edi
lea eax, [ebp - 0xbc]
push eax
call fcn.00420e72
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xbc]
movzx eax, word [eax + 0xc]
push eax
call fcn.0041f09e
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0041fd84
lea eax, [ebp - 0xe0]
mov ecx, ebx
push eax
call fcn.004117ff
lea ecx, [ebp - 0xe0]
call fcn.0041395f
lea ecx, [ebp - 0xbc]
call fcn.004757d3
test esi, esi
je 0x4ca9f7
mov eax, dword [ebp - 0x1c]
sub eax, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x4ca9ee
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
push eax
push esi
call fcn.00429b68
pop ecx
pop ecx
mov eax, ebx
call fcn.00429df7
ret 8
Function at 0x4caee5
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
shl eax, 8
push esi
add eax, 0x20019
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x4caf1b
mov ecx, dword [ecx]
lea esi, [ebp - 0x830]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x82c], 0x820
test eax, eax
cmovle esi, eax
and dword [ebp - 0x828], 0
test esi, esi
js 0x4cafc3
cmp dword [edi + 0x14], 8
jb 0x4caf58
mov edi, dword [edi]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4cafb7
cmp dword [ebp - 0x828], 1
je 0x4cafa7
cmp dword [ebp - 0x828], 2
je 0x4cafa7
mov esi, 0x8007065d
jmp 0x4cafb7
lea eax, [ebp - 0x824]
mov ecx, ebx
push eax
xor esi, esi
call fcn.00411a05
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429dd5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x4caee3

Function at 0x4cbb38
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.0042af50
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
call fcn.004cba2d
mov esi, eax
test esi, esi
js 0x4cbbb1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cbbf4
push 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x214]
push ebx
call fcn.004cba2d
mov esi, eax
test esi, esi
js 0x4cbc0c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cbc0c
test edi, edi
je 0x4cbc11
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x1c]
push edi
call fcn.004197ab
mov esi, eax
jmp 0x4cbc11
mov esi, 0x80070490
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429dd5
leave
ret 0x18

Function at 0x4cc0a5
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
pop ebp
jmp 0x4cc0a5
Function at 0x4ce830
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 4
xor ebx, ebx
cmp dword [eax + 0x14], 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
jb 0x4ce85a
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftOneDriveAccounts
lea eax, [ebp - 0x28]
push eax
call fcn.004c63c2
cmp dword [eax + 0x14], 8
jb 0x4ce871
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push str.IsGoSov
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0041395f
test esi, esi
pop esi
jne 0x4ce8a7
cmp dword [ebp - 8], 1
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00429dd5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4ce82e

Function at 0x4cf7f3
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push esi
push 8
push str.SoftwareClasses
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cf87e
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4cf875
cmp dword [ebp - 8], ebx
jne 0x4cf875
cmp dword [ebp - 0xc], esi
jne 0x4cf875
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x1000ffff
push str.SymbolicLinkValue
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4cf875
cmp dword [ebp - 0x10], 6
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00429dd5
leave
ret
jmp 0x4cf7f1

Function at 0x4d004f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4d005f
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [eax + 0x10]
mov edx, 0x811c9dc5
push 0
pop esi
add edi, edi
je 0x4d0081
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x4d0070
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x4d228d
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x4d22c4
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4d2306
cmp dword [esi + 0x10], eax
jne 0x4d22e2
xor esi, esi
jmp 0x4d22ea
cmp dword [esi + 0x14], 8
jb 0x4d22ea
mov esi, dword [esi]
push 4
push ebx
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00429dd5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x4d228b

Function at 0x4d25ff
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x4d2636
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4d268e
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
lea ecx, [eax*2 + 2]
jb 0x4d265d
mov ebx, dword [ebx]
movzx eax, byte [ebp + 0x1c]
inc eax
cmp dword [esi + 0x10], 0
jne 0x4d266c
xor esi, esi
jmp 0x4d2674
cmp dword [esi + 0x14], 8
jb 0x4d2674
mov esi, dword [esi]
push ecx
push ebx
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00429dd5
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x4d25fd

Function at 0x4d26ae
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea edx, [eax*2 + 2]
jb 0x4d26c6
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4d26d1
mov eax, dword [eax]
push edx
push ecx
push 2
push eax
push 0x68dc1c
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x4d26ac
Function at 0x4d2ddb
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x6ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
push 0x68d3dc
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x240], eax
call fcn.00411a05
mov eax, dword [ebp - 0x240]
xor ecx, ecx
push 0x118
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x238]
mov dword [ebx], ecx
mov bl, cl
push eax
mov dword [edi], ecx
call fcn.0042af50
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4d2ebe
mov ecx, dword [ebp - 0x120]
mov bl, 1
mov eax, dword [ebp - 0x238]
mov dword [edi], eax
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x120], 0x118
mov dword [ecx], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 2
push str.BuildLab
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push dword [0x6cebb8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
js 0x4d2ebe
push esi
lea eax, [ebp - 0x11c]
push eax
call fcn.004d2a63
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429dd5
leave
ret 0x10
push ebp
mov ebp, esp
pop ebp
jmp 0x4d2dd9
Function at 0x4d624b
Capabilities:
Get user security identifier

Disassembly:
push 0x34
mov eax, 0x62ac1a
call fcn.00429e48
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x14], esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
jb 0x4d6275
mov eax, dword [esi]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, dword [ebp - 0x18]
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
add edi, 1
je 0x4d62d3
cmp edi, 0x7fffffff
ja 0x4d6388
push edi
lea ecx, [ebp - 0x28]
call fcn.004a458d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3a]
push eax
push edi
push dword [ebp - 0x28]
call fcn.004d5ac7
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x34]
mov byte [ebp - 0x39], bl
stosd dword es:[edi], eax
lea ecx, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x39]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.004c5858
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4d6308
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x4d6336
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
call fcn.00411a05
mov bl, 1
test esi, esi
je 0x4d6368
mov eax, dword [ebp - 0x2c]
sub eax, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x4d635f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x3c]
push eax
push esi
call fcn.00429b68
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d637e
mov ecx, dword [ebp - 0x20]
sub ecx, eax
and ecx, 0xfffffffe
push ecx
push eax
call fcn.00413ae3
mov al, bl
call fcn.00429df7
ret 8
call fcn.00412e75
int3

Function at 0x4d7082
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
pop ebp
ret 4
Function at 0x4d71b2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004c65d6
cmp dword [eax + 0x14], 8
jb 0x4d71cc
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041395f
mov eax, esi
pop esi
leave
ret 8

Function at 0x4d7322
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004c65d6
cmp dword [eax + 0x14], 8
jb 0x4d733c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041395f
mov eax, esi
pop esi
leave
ret 4

Function at 0x4d7542
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004c65d6
cmp dword [eax + 0x14], 8
jb 0x4d755c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041395f
mov eax, esi
pop esi
leave
ret 4

Function at 0x4d7a52
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCheckConnectionW]

Function at 0x4d7e32
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004c65d6
cmp dword [eax + 0x14], 8
jb 0x4d7e4c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041395f
mov eax, esi
pop esi
leave
ret 4

Function at 0x4d8132
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004c65d6
cmp dword [eax + 0x14], 8
jb 0x4d814c
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041395f
mov eax, esi
pop esi
leave
ret 8

Function at 0x4d81f2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x4d8372
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0060335c
add esp, 0xc
pop ebp
ret 0xc