joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x40989a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + 2]
sub ecx, eax
lea edx, [eax + 2]
add ecx, 0xfffffffe
lea eax, [edi - 1]
mov dword [ebp + 0x14], edx
shr eax, 3
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
push ecx
push dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
call fcn.00408a30
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [ebp + 0x14]
add esp, 0xc
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x14], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 4], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 8]
jne 0x4097d0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40e200
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x40e26c
cmp byte [esi + 1], 0
je 0x40e26c
push ebx
push edi
call fcn.00411aa0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp edi, 0x14
jl 0x40e22d
cmp byte [esi + 3], 0
je 0x40e23d
cmp byte [esi + 2], 0
jne 0x40e241
push 0x1f4
inc edi
call ebx
jmp 0x40e222
cmp byte [esi + 2], 0
pop edi
pop ebx
jne 0x40e26c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40e27a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4139b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd556
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00455267
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x828], ax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0x840]
mov dword [ebp - 0x814], 7
push eax
mov dword [ebp - 0x818], 0
call fcn.004029a0
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00480620
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x413a56
mov esi, dword [esi]
cmp dword [ebp - 0x82c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp - 0x840]
cmovae eax, dword [ebp - 0x840]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x413a8e
xor ecx, ecx
jmp 0x413aa6
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413a97
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00402ac0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00483ea9
mov ecx, dword [ebp - 0x814]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x413af6
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
cmp eax, 8
jb 0x413b31
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00402c10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413cc0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x413d04
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4
call fcn.00452215
test al, al
je 0x413d28
push edi
xor al, 0x3c
inc cx
inc ecx
sahf
adc dh, 0x55
inc edx
salc
jnp 0x413d11
cli
sahf
les esi, [ebx - 0x1b]
push eax
fisttp qword [ecx]
pop edx
push esi
push ebp
xor al, ch
invalid
call fcn.004520bc
test al, al
je 0x413d4f
jbe 0x413d0e
out 0xf0, eax
inc esi
adc dh, byte [eax - 0x20220e20]
inc edx
cmpsd dword [esi], dword es:[edi]
call 0x9209c216
xchg ecx, eax
pop ebx
mov edx, 0x665150ee
cmp dword [ebx + 0x7a], ebx
cmp byte [ebx + 0x6f], bh
push 0xf01ff
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x413cef
call fcn.004520bc
test al, al
je 0x413d91
sbb edi, dword [edx - 0x4b2879f8]
xor byte [ebx], 0x2a
push cs
or ebx, edi
push ebp
and dh, byte [edx]
sub al, 0xb8
popfd
mov ebx, 0x5aaef227
push ebx
invalid
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x413cef
call fcn.0045236e
test al, al
je 0x413dcb
xor bh, byte [eax]
inc ecx
loope 0x413d42
mov word [eax + 0x647d5093], ds
mov dword [ebp + 0x68], edx
sti
in al, 0xc1
inc esp
dec edi
popal
or ch, 0xe8
xor ebx, esp
add eax, dword [eax]
call fcn.00452101
test al, al
je 0x413dec
xchg edx, eax
mov ch, 0x66
mov ebx, 0x647bad0
invalid
sbb al, 0xf5
pop ebp
shr al, 1
lcall 0x74c0, 0x840003e3
sbb byte [edx + 0x55], ah
jno 0x413e4e
call fcn.0045218b
test al, al
je 0x413e0d
bound edx, qword [ebp + 0x71]
push ebp
cmpsb byte [esi], byte es:[edi]
in al, 0x63
and dword [ebp - 0x3c591f6c], edi
inc edx
fnstenv [ebx]
push ds
movups xmmword [ebp - 0x5f58a], xmm1
jne 0x413dec
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x413cef
call fcn.00452329
test al, al
je 0x413e39
cmp ah, bh
jmp 0x413de8
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
cdq
add eax, 0x5de58b00
ret 4
Function at 0x414700
Capabilities:
Delete registry value

Disassembly:
invalid
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00452215
test al, al
je 0x41472e
pop ds
in al, 0xe
jp 0x4146bf
sbb ch, byte [ebx + 0x40]
test eax, 0x4b886acc
jg 0x414729
mov cl, 0xea
popfd
inc ebp
sal byte [edx], cl
xchg ebp, eax
xor eax, dword [edi]
js 0x4146cc
in eax, dx
call fcn.004520bc
test al, al
je 0x414755
jno 0x4146d9
pop ss
int1
into
test al, ah
push cs
aas
xchg byte [esi], bl
add edx, edx
outsb dx, byte [esi]
invalid
mov edi, dword [ebp + 8]
cmp word [edi], 0
jne 0x414762
xor ecx, ecx
jmp 0x414776
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414767
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 4]
push edi
call fcn.00402ac0
push dword [ebp + 0xc]
push edi
push 0x79
call fcn.004587ef
mov ecx, dword [ebp - 4]
add esp, 0xc
push dword [ebp + 0xc]
call fcn.004145f0
test eax, eax
setne byte [ebp + 0xf]
call fcn.0045250c
test al, al
je 0x4147b9
cmc
jno 0x4147f2
xchg edx, ebp
fsub dword [edx - 0x300ff12d]
inc esi
out dx, eax
in al, 0x45
fnstcw word [ebx + 0x3da57e8]
add byte [eax + eax*8 + 0x3761f74], al
call fcn.00452215
test al, al
je 0x4147e1
jbe 0x4147c7
scasd eax, dword es:[edi]
int1
push ebx
in al, dx
push eax
sub dh, byte [eax + 0x2573b1fc]
inc ebx
inc esp
pop esi
dec edi
pop ebp
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xce06b72a
push esi
inc ecx
and eax, 0xe83f5384
dec esp
fadd dword [ebx]
add byte [eax + eax*8 + 0x60df1674], al
stosb byte es:[edi], al
call fcn.00452032
test al, al
je 0x414800
fbld tbyte [eax - 0x56]
movsd dword es:[edi], dword [esi]
jl 0x4147e6
pop eax
sub dh, byte [edi]
invalid
cmp byte [ebp + 0xf], 0
jne 0x41481e
push 0xa2
call fcn.004587ef
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x415930
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
call fcn.00452620
test al, al
je 0x41595f
cwde
fsubrp st(2)
dec esi
in al, 0xc5
invalid
call fcn.00452596
test al, al
je 0x415983
pop ds
or byte cs:[0x484dcf41], cl
adc eax, dword [ecx - 0x5bc9a220]
adc byte [esi + edx], ch
mov eax, dword [0x94f6fb3d]
jg 0x41597b
sti
not byte [edi + edi*2 - 0x409ed605]
sub dword [ecx - 0x41], esp
call fcn.00452551
test al, al
je 0x4159a5
mov dword [edx*4 - 0x6e9e4694], ebx
popal
js 0x415994
jns 0x4159e5
pop ebp
jae 0x4159f4
lea edi, [ebx + ebp*4 + 0x34]
xlatb
mov ecx, dword [ecx]
adc al, 0xbe
mov dword [ebx - 0x3fccf78b], ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp - 4]
push 0xffffffffffffffff
add ecx, 0x18
push eax
push ecx
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.004029a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add byte [eax - 0x7d], dl
in al, dx
je 0x41599b
sub al, 0x43
add byte [bx + di], dh
inc ebp
clc
Function at 0x419980
Capabilities:
Delete registry key
Encode data using xor

Disassembly:
push ebx
push esi
push edi
call fcn.00452215
test al, al
je 0x4199ab
neg byte [edi]
iretd

Function at 0x419a30
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddc14
mov eax, dword fs:[0]
push eax
sub esp, 0xf68
mov eax, dword [0x67432c]
Function at 0x41b9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x210], ecx
call fcn.0041b700
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x60]
call eax
test al, al
je 0x41ba9e
call fcn.0045236e
test al, al
je 0x41ba02
cmp al, 0x69
inc ecx
adc byte [edi], bh
int 9
push 0xffffffffffffffb9
jge 0x41ba5e
aam 0x6f
xchg esi, eax
movsd dword es:[edi], dword [esi]
arpl word [eax + 7], ax
daa
scasd eax, dword es:[edi]
aaa
inc ecx
sbb eax, 0x366fae8
add byte [eax + eax*8 - 0x7d07e78c], al
fstp dword [edi + 0x31]
rcl dword [eax], 0x12
call fcn.00452101
test al, al
je 0x41ba23
clc
sbb cl, 0x5f
xor ecx, eax
adc byte [edx], dl
rol byte [esi - 0x7252b8f4], 1
out dx, eax
rcr bh, 0xec
mov edi, 0xd6745320
imul ebp, eax, 0x63
add eax, dword [bx + si]
call fcn.0045218b
test al, al
je 0x41ba44
iretd
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41ba83
invalid
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041c390
std
invalid
call fcn.00452329
test al, al
je 0x41ba9e
rol byte [edi + 0x5a], cl
test eax, 0xfe462e4d
or ebp, dword [esi + 0x779c9bc7]
jnp 0x41ba7a
cld
ror dword [ebx + 0x5e5ffc4d], cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x41de10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de04a
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004524c7
test al, al
je 0x41de56
add al, ch
xchg dword [esi + 3], eax
add byte [eax + eax*8 + 0x3b721274], al
jb 0x41de81
salc
je 0x41de3a
xor dword cs:[eax - 0x4d], edx
lahf
pop esi
xlatb
sahf
hlt
lea eax, [ebp - 0x58]
push eax
call int.0045cbae
add esp, 4
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x41de71
mov eax, dword [eax]
push 0x5e6948
push str.7681e
push str.OISet
push eax
lea eax, [ebp - 0x40]
push 0x5e6c34
push eax
call fcn.004656d0
add esp, 0x18
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x41deab
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x44], 7
rol bh, 0x45
mov esp, 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp dword [ebp - 0x30], eax
je 0x41dfc6
mov eax, dword [0x679464]
test eax, eax
jne 0x41defd
push 0x15c
call fcn.0046d554
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x41def2
mov ecx, eax
call fcn.00443ec0
jmp 0x41def4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x679464], eax
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0x28]
call fcn.00404060
mov byte [ebp - 4], 4
call fcn.004523f8
test al, al
je 0x41df35
push ecx
call 0x1ba017a8
push es
cli
daa
jg 0x41deac
add dword [si - 0x3171], esp
jle 0x41df6e
fstp xword [esi - 0x6dee057]
inc ebp
invalid
call fcn.0045225a
test al, al
je 0x41df53
fnstcw word [eax - 0xd277085]
test eax, 0xa869e95e
xchg ebx, eax
in eax, dx
mov dh, 0xc0
and al, 0x30
mov esi, dword [ebx]
inc esi
call fcn.004523b3
test al, al
je 0x41df6e
push ebp
fsub qword [esi + 0x49]
sub ecx, ecx
or al, 0x55
push eax
stc
adc al, 0x49
xchg ebp, eax
mov ebp, 0x635ebd6f
push 0xc
push str.WWordMgr.exe
lea ecx, [ebp - 0x28]
call fcn.00405c20
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00453528
add esp, 8
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41dfc6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402c10
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41dfdb
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x41f350
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de277
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67432c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41f3a1
mov eax, dword [esi]
jmp 0x41f3a3
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x2c], 8
mov dword [ebp - 4], ecx
jb 0x41f3c0
mov eax, dword [esi + 0x18]
jmp 0x41f3c3
lea eax, [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], ecx
cmp dword [esi + 0x44], 8
jb 0x41f3dd
mov eax, dword [esi + 0x30]
jmp 0x41f3e0
lea eax, [esi + 0x30]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f3fa
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x60]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f414
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x78]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f42e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x90]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f44b
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xa8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f468
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f485
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0xd8]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41f4a2
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push 0xc
push str.WanNengWBIME
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00402ac0
push 5
push str.WHost
lea ecx, [esi + 0x18]
call fcn.00402ac0
push 0xc
push str.WHostService
lea ecx, [esi + 0x30]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0x48]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0x60]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0x78]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0xc0]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0xd8]
call fcn.00402ac0
push 0
push 0x5e6948
lea ecx, [esi + 0xa8]
call fcn.00402ac0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f760
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00452620
test al, al
je 0x41f78b
mov ebp, 0x3649a518
xor al, 0x81
pop esi
xchg ebx, eax
push ss
fiadd dword [edx]
jnp 0x41f7c3
or eax, 0xbf3d0d5b
or dword fs:[ecx], edx
adc byte [edx - 0x4d], al
cld
mov dword [ebp + 0x6850fc45], ecx
aas
add dword [edi], ecx
add byte [edx], ch
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f821
rol byte [edi + 0x268005e], 1
add byte [eax], al
cmp bh, 0x15
or al, 0x60
pop esi
add byte [ebp - 0x17888a40], al
xchg edi, eax
sub dword [ebx], eax
add byte [eax + eax*8 - 0x2c6feb8c], al
add byte [edi], al
call fcn.00452146
test al, al
je 0x41f7c7
nop
rol dword [eax], cl
pop es
jo 0x41f80a
add ch, byte [ebp - 0x30d2ef39]
in eax, 0
mov dh, 0x5f
pop edi
leave
and byte [edx - 0x18], bl
sub al, 0x2c
add eax, dword [eax]
call fcn.004523f8
test al, al
je 0x41f7ec
invalid
call fcn.00452620
test al, al
je 0x41f80a
fstp dword [ebp + 8]
add byte [0xd3755094], bh
or al, 0x9a
fild word [ebp - 0x6b4d6d47]
xor eax, 0x6858a50c
loopne 0x41f797
push str.WHost
push dword [ebp - 4]
pop esi
add bh, bh
jne 0x41f80e
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420f80
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00452077
test al, al
je 0x420fab
mul byte [edi]
loop 0x420f9c
lds esp, [esi]
cmp ebp, ebp
lea ebx, [ecx + 0x66]
dec ebx
pop ecx
dec bx
cli
pop ds
xchg ebx, eax
inc esi
dec si
dec eax
stc
das
bound esp, qword [ecx - 0x5c]
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4210e4
call fcn.00452215
test al, al
je 0x420ff6
stosb byte es:[edi], al
test eax, 0x285f98cd
add dl, byte [ebx - 0x3bc13539]
invalid
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.WHost
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42102d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00452620
test al, al
je 0x421051
test al, 0xa2
aaa
invalid
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
call fcn.00452146
add eax, dword [eax]
test al, al
je 0x4210a1
push 0x63
test byte [edi], ah
jl 0x4210c5
jae 0x4210d4
jmp 0x421051
call fcn.004523f8
test al, al
je 0x4210c6
inc ebp
popal
adc eax, 0x6773ad6f
sub eax, 0x7ec58a10
mov cl, 0x32
and eax, 0xd1b5b5e2
mov esp, 0x53d37d8d
jno 0x42112c
xchg ecx, eax
mov edx, 0x31555e8
add byte [eax + eax*8 - 0x185fea8c], al
loop 0x421124
call fcn.00452620
test al, al
je 0x4210e4
mov al, byte [0x151e2e7]
add dword [edx + esi*8 - 0x5c67aef6], esp
mov ah, 0xda
jns 0x421087
movsb byte es:[edi], byte [esi]
or dl, byte [ecx - 0x68]
mov dword [0xa979dab4], eax
cld
sbb al, 0x27
leave
mov al, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
invalid
test eax, ebx
stc
invalid
Function at 0x4303a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.00480620
add esp, 0xc
add byte [eax - 0x18], dl
dec ebp
add al, byte [0xcc48300]
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x80c], 0
call fcn.00452620
test al, al
je 0x430410
mov ah, 0x4a
inc esp
and al, byte [edx]
rol byte [ecx - 0x78], cl
pop ebx
dec ecx
push ds
jae 0x4303d6
cwde
out dx, eax
cmc
jo 0x430421
int 0xe8
and dword [ecx], 0xc0840002
call fcn.00452596
test al, al
je 0x430434
mov ebp, 0x2037e33f
jno 0x43047e
dec eax
inc esp
in eax, 0x9c
jb 0x4303cc
fisubr dword [ebp + 0x6c]
xor byte [ebx], 0xaa
push ss
out 0xfc, al
invalid
call fcn.00452551
test al, al
je 0x430456
push esi
mov cl, 0x73
out dx, eax
arpl word [esi - 3], dx
mov ss, ecx
xor byte [ebx + 0x2e7b1ee7], 0x6b
or dword [ecx], ebx
imul ecx, dword [ebx + 0x646a3f70], 0xffffffaa
stosb byte es:[edi], al
lea eax, [ebp - 0x808]
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
call fcn.00452551
test al, al
je 0x43049f
pop esi
add byte [eax + 2], ch
add byte [eax], al
cmp bh, 0x15
or al, 0x60
pop esi
add byte [ecx - 0x80f7b], cl
invalid
add byte [eax + eax*8 - 0x219be38c], al
jg 0x430455
fidivr word fs:[edi - 0x32]
dec eax
push ss
jp 0x430467
out dx, eax
movsb byte es:[edi], byte [esi]
call 0x2d77fd75
cwd
out 0x25, eax
loop 0x430422
bound ebx, qword [ebx + 0x58]
leave
pop ds
stosd dword es:[edi], eax
in al, dx
cmp dword [ebp - 0x810], 0
jne 0x430519
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.WanNengWB_Shell_Extension
lea eax, [ebp - 0x804]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430506
test dx, dx
je 0x430502
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430506
add eax, 4
add ecx, 4
test dx, dx
jne 0x4304e0
xor eax, eax
jmp 0x43050b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x430564
mov dword [ebp - 0x80c], 1
call fcn.00452620
test al, al
je 0x43053d
inc edx
jbe 0x430599
mov dword [edx], esp
cmp dword [ebx - 0x33342e4a], esp
pop ds
out dx, al
int 0xb6
in al, dx
adc eax, 0x2d1d1fd2
and eax, 0x917e92d1
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], 0
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x80c], 0
jmp 0x43053d
mov dword [0], eax