joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40537c
cmp byte [esi + 0x3d], 0
je 0x40537c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40536a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x405331
sub eax, 1
je 0x405335
sub eax, 2
jne 0x40536a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040774e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405353
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40536a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040774e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040774e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040774e
mov esp, ebp
pop ebp
ret

Function at 0x407ff4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408033
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408033
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408033
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408033
cmp dword [ecx + 0x74], 0xe
jbe 0x408033
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40119b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.004021d4
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x40b216
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.004021d4
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x40b216
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
mov eax, 0
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
mov eax, 0
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x401234
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x40125c
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x401256
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x401275
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push dword [ebp - 0xc]
call fcn.0040134d
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4012bd
push ebx
call fcn.004021c8
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x4012d2
mov eax, 0x40c00000
jmp 0x401306
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004021c8
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.004021c8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404671
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00403599
xor ebx, ebx
cmp dword [0x40c7c4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404746
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4046b1
xor eax, eax
jmp 0x40480a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409800
push edi
call esi
cmp eax, ebx
je 0x4046aa
push eax
call fcn.00403536
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c7c4], eax
call esi
push eax
call fcn.00403536
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c7c8], eax
call esi
push eax
call fcn.00403536
mov dword [0x40c7cc], eax
lea eax, [ebp - 8]
push eax
call fcn.00402848
test eax, eax
pop ecx
pop ecx
je 0x404714
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403f5b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404746
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00403536
cmp eax, ebx
pop ecx
mov dword [0x40c7d4], eax
je 0x404746
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403536
pop ecx
mov dword [0x40c7d0], eax
mov eax, dword [0x40c7d0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4047bf
cmp dword [0x40c7d4], esi
je 0x4047bf
push eax
call fcn.004035a2
pop ecx
call eax
cmp eax, ebx
je 0x40478c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40c7d4]
call fcn.004035a2
pop ecx
call eax
test eax, eax
je 0x40478c
test byte [ebp - 0x18], 1
jne 0x4047bf
lea eax, [ebp - 0xc]
push eax
call fcn.0040287f
test eax, eax
pop ecx
je 0x4047a7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403f5b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4047b6
or dword [ebp + 0x10], 0x200000
jmp 0x4047f0
or dword [ebp + 0x10], 0x40000
jmp 0x4047f0
mov eax, dword [0x40c7c8]
cmp eax, esi
je 0x4047f0
push eax
call fcn.004035a2
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4047f0
mov eax, dword [0x40c7cc]
cmp eax, esi
je 0x4047f0
push dword [ebp - 4]
push eax
call fcn.004035a2
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40c7c4]
call fcn.004035a2
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4064ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40bf28]
jne 0x4064c4
repz ret
jmp fcn.00407af5
Function at 0x406bf0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x80]
cmp dword [ebx + 0x80], eax
je 0x406c27
mov dword [esp + 8], 0x96
mov dword [esp + 4], str._private_tmp_game_porting_toolkit_20240405_14904_ytzpuo_wine_programs_services_services.c
mov dword [esp], str.list_empty_entry__handles_
call dword [sym.imp.ucrtbase.dll__assert]
mov eax, dword [ebx + 0x30]
mov edi, dword fs:[0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebx + 0x10]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x40]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x4c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x44]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x50]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x5c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x60]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x64]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x68]
sub esp, 0xc
test eax, eax
je 0x406d57
mov dword [esp], eax
call dbg.release_process
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4011cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x4011d9
repz ret
jmp fcn.0040138e

Function at 0x403313
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021f3
and dword [ebp - 4], 0
cmp dword [0x40b668], 0
mov ebx, eax
jne 0x4033c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403475
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403475
push eax
call fcn.00402181
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.00402181
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b66c], eax
call esi
push eax
call fcn.00402181
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b670], eax
call esi
push eax
call fcn.00402181
pop ecx
mov dword [0x40b678], eax
test eax, eax
je 0x4033c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402181
pop ecx
mov dword [0x40b674], eax
mov eax, dword [0x40b674]
cmp eax, ebx
je 0x40341c
cmp dword [0x40b678], ebx
je 0x40341c
push eax
call fcn.004021fc
push dword [0x40b678]
mov esi, eax
call fcn.004021fc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40341c
test edi, edi
je 0x40341c
call esi
test eax, eax
je 0x403413
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403413
test byte [ebp - 0xc], 1
jne 0x40341c
or dword [ebp + 0x10], 0x200000
jmp 0x403455
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x403455
push eax
call fcn.004021fc
pop ecx
test eax, eax
je 0x403455
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403455
mov eax, dword [0x40b670]
cmp eax, ebx
je 0x403455
push eax
call fcn.004021fc
pop ecx
test eax, eax
je 0x403455
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b668]
call fcn.004021fc
pop ecx
test eax, eax
je 0x403475
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403477
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x264], ecx
call fcn.004052d0
mov edi, eax
pop ecx
lea ecx, [edi - 1]
cmp ecx, 0x100
ja 0x4011ea
push 0x5c
pop eax
cmp word [esi + edi*2 - 2], ax
je 0x40104f
mov word [esi + edi*2], ax
inc edi
push 0x2a
pop ecx
lea eax, [esi + edi*2]
mov word [eax], cx
xor ecx, ecx
mov dword [ebp - 0x268], eax
mov word [eax + 2], cx
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x401111
test byte [ebp - 0x258], 0x10
je 0x4010ee
lea eax, [ebp - 0x22c]
push 0x41a6f8
push eax
call fcn.004052eb
pop ecx
pop ecx
test eax, eax
je 0x4010e8
lea eax, [ebp - 0x22c]
push 0x41a6fc
push eax
call fcn.004052eb
pop ecx
pop ecx
test eax, eax
je 0x4010e8
lea eax, [ebp - 0x22c]
push eax
mov eax, 0x104
sub eax, edi
push eax
lea eax, [esi + edi*2]
push eax
call fcn.004051f7
mov edx, dword [ebp - 0x260]
add esp, 0xc
mov ecx, dword [ebp - 0x264]
push ebx
push esi
call section..text
pop ecx
pop ecx
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x25c]
jne 0x401081
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x2a
pop ecx
lea eax, [esi + edi*2]
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x4011c1
test byte [ebp - 0x258], 0x10
jne 0x4011a2
lea eax, [ebp - 0x22c]
push eax
mov eax, 0x104
sub eax, edi
push eax
lea eax, [esi + edi*2]
push eax
call fcn.004051f7
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401186
cmp dword [ebp - 0x264], eax
jne 0x401186
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x40119c
test eax, eax
jne 0x40119c
cmp dword [ebp - 0x260], eax
je 0x40119c
push 4
push eax
push esi
call ebx
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x25c]
jne 0x40113d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
xor ecx, ecx
push esi
mov word [eax - 2], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4011ea
test ebx, ebx
je 0x4011ea
cmp dword [ebp - 0x260], eax
je 0x4011ea
push 4
push eax
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004038d5
mov esp, ebp
pop ebp
ret
Function at 0x401265
Capabilities:
Delete file

Disassembly:
push esi
push edi
push str.MoveFileExW
push str.kernel32.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012ad
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012ad
test edi, edi
je 0x4012ad
push 4
push eax
push esi
call edi
pop edi
pop esi
ret

Function at 0x4012b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8a40
call fcn.00413ed0
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, edx
mov ebx, ecx
call fcn.00404720
add esp, 0xc
mov dword [ebp - 0x8a1c], 0x104
lea eax, [ebp - 0x8a40]
mov dword [ebp - 0x8a18], esi
mov dword [ebp - 0x8a10], esi
mov dword [ebp - 0x8a14], 0x3fff
push eax
lea eax, [ebp - 0x8a28]
push eax
lea eax, [ebp - 0x8a2c]
push eax
lea eax, [ebp - 0x8a30]
push eax
lea eax, [ebp - 0x8a10]
push eax
lea eax, [ebp - 0x8a34]
push eax
lea eax, [ebp - 0x8a38]
push eax
lea eax, [ebp - 0x8a18]
push eax
push esi
lea eax, [ebp - 0x8a1c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x8a10]
test eax, eax
je 0x40141b
xor eax, eax
mov dword [ebp - 0x8a14], 0x3fff
push eax
push eax
push eax
push eax
mov word [ebp - 0x8a0c], ax
lea eax, [ebp - 0x8a14]
push eax
lea eax, [ebp - 0x8a0c]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40140e
lea eax, [ebp - 0x8a0c]
push edi
push eax
call fcn.00404491
pop ecx
pop ecx
test eax, eax
jne 0x40142e
push 0x800
push eax
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0x8a24], 1
push eax
call fcn.00404720
add esp, 0xc
mov dword [ebp - 0x8a20], 0x400
lea eax, [ebp - 0x8a20]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x8a24]
push eax
push 0
lea eax, [ebp - 0x8a0c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40140e
lea eax, [ebp - 0xa0c]
push edi
push eax
call fcn.00404491
pop ecx
pop ecx
test eax, eax
jne 0x40142e
inc esi
cmp esi, dword [ebp - 0x8a10]
jb 0x401361
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004038d5
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
jmp 0x40141d
Function at 0x401433
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc
mov dword [ebp - 0x884], ecx
lea edi, [ebp - 0x6c]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
and dword [ebp - 0x874], 0
rep movsd dword es:[edi], dword [esi]
push 0xc
pop ecx
push str.IsWow64Process
movsb byte es:[edi], byte [esi]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push str.kernel32
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4014a0
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov edi, dword [ebp - 0x874]
lea eax, [ebp - 0x87c]
neg edi
push eax
sbb edi, edi
lea eax, [ebp - 0x6c]
and edi, 0x100
or edi, 0x20019
push edi
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4015a3
mov esi, 0x800
mov dword [ebp - 0x878], 7
push esi
lea eax, [ebp - 0x86c]
push 0
push eax
call fcn.00404720
add esp, 0xc
mov dword [ebp - 0x870], esi
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x878]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x87c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x87c]
mov esi, eax
call ebx
test esi, esi
jne 0x4015a3
mov eax, dword [ebp - 0x870]
lea esi, [ebp - 0x86c]
shr eax, 1
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x880], 0
je 0x4015a3
push dword [ebp - 0x884]
push esi
call fcn.00404491
pop ecx
pop ecx
test eax, eax
jne 0x4015df
push esi
call fcn.004052d0
mov ecx, dword [ebp - 0x880]
inc ecx
add ecx, eax
push esi
mov dword [ebp - 0x880], ecx
call fcn.004052d0
pop ecx
pop ecx
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x880]
add esi, 2
cmp eax, dword [ebp - 0x888]
jb 0x401560
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x870]
push eax
push edi
push 0
lea eax, [ebp - 0x38]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x4015e6
mov edx, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x870]
call fcn.004012b0
push dword [ebp - 0x870]
test eax, eax
je 0x4015e4
call ebx
xor eax, eax
inc eax
jmp 0x40161e
call ebx
lea eax, [ebp - 0x870]
push eax
push edi
push 0
lea eax, [ebp - 0x38]
push eax
push 0x80000001
call esi
test eax, eax
jne 0x40161c
mov edx, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x870]
call fcn.004012b0
push dword [ebp - 0x870]
test eax, eax
jne 0x4015dd
call ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004038d5
mov esp, ebp
pop ebp
ret
Function at 0x40162f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push ecx
push ecx
mov word [edi], ax
call fcn.004052d0
pop ecx
inc eax
push eax
push edi
call fcn.004051f7
add esp, 0xc
test eax, eax
je 0x401666
xor eax, eax
jmp 0x40180a
push ebx
push edi
call fcn.004052d0
pop ecx
mov ebx, eax
push 0x5c
pop eax
cmp word [edi + ebx*2 - 2], ax
je 0x401685
mov word [edi + ebx*2], ax
inc ebx
xor eax, eax
mov word [edi + ebx*2], ax
push esi
push str.LMIR
push edi
call fcn.004052d0
mov esi, eax
mov dword [esp], str.LMIR
call fcn.004052d0
inc eax
pop ecx
add eax, esi
push eax
push edi
call fcn.0040525b
add esp, 0xc
test eax, eax
jne 0x401806
push str.LMIR
call fcn.004052d0
pop ecx
push 4
pop ecx
cmp eax, ecx
ja 0x4016c9
mov ecx, eax
lea eax, [ebp - 0x14]
add ebx, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc]
lea edx, [edi + ebx*2]
imul ecx, eax, 0x3c
movzx eax, word [ebp - 0xa]
push 2
pop esi
push 0x2e
add ecx, eax
movzx eax, word [ebp - 8]
imul ecx, ecx, 0x3c
add ecx, eax
mov eax, ecx
shr eax, 0x10
and eax, 0xf
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edx], ax
add edx, esi
mov eax, ecx
shr eax, 0xc
and eax, 0xf
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edx], ax
add edx, esi
mov eax, ecx
shr eax, 8
and eax, 0xf
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edx], ax
add edx, esi
mov eax, ecx
and ecx, 0xf
shr eax, 4
and eax, 0xf
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edx], ax
add edx, esi
mov ax, word [ecx*2 + str.0123456789ABCDEF]
mov word [edx], ax
add edx, esi
xor eax, eax
mov word [edx], ax
add edx, esi
mov word [edx], ax
add edx, esi
mov word [edx], ax
add edx, esi
pop eax
push 0x74
mov word [edx], ax
add edx, esi
pop eax
push 0x6d
mov word [edx], ax
add edx, esi
pop eax
push 0x70
mov word [edx], ax
pop eax
mov word [edx + esi], ax
xor eax, eax
mov word [edx + esi + 2], ax
xor esi, esi
inc esi
mov eax, esi
shr eax, 8
and eax, 0xf
push str.LMIR
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edi + ebx*2 + 0xa], ax
mov eax, esi
shr eax, 4
and eax, 0xf
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edi + ebx*2 + 0xc], ax
mov eax, esi
and eax, 0xf
inc esi
mov ax, word [eax*2 + str.0123456789ABCDEF]
mov word [edi + ebx*2 + 0xe], ax
call fcn.004052d0
pop ecx
mov ecx, ebx
sub ecx, eax
lea ecx, [edi + ecx*2]
call fcn.00401433
test eax, eax
jne 0x4017fe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401819
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401806
cmp esi, 0xfff
jb 0x40178d
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004038d5
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
jmp 0x401808