joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1778
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x1774]
push eax
call fcn.00409c57
add esp, 0xc
xor edi, edi
push edi
lea eax, [ebp - 0x1778]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0x1774]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x409d40
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 8
lea eax, [ebp + 0xc]
push eax
push 3
push edi
push str.LastWriteTime
push dword [ebp - 0x1778]
call esi
push ebx
call fcn.00413700
pop ecx
push eax
push ebx
push 1
push edi
push str.Version
push dword [ebp - 0x1778]
call esi
push dword [ebp - 0x1778]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00413c78
leave
ret

Function at 0x409d4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1708]
mov eax, 0x1788
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x1704], eax
mov eax, dword [ebp + 0x1710]
push ebx
push esi
mov esi, dword [ebp + 0x171c]
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x74]
push eax
xor bl, bl
call fcn.00409c57
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409e85
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x16fc]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.LastWriteTime
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 8
call edi
test eax, eax
jne 0x409e7b
cmp dword [ebp - 0x78], 8
jne 0x409e7b
push 8
lea eax, [ebp + 0x1714]
push eax
lea eax, [ebp + 0x16fc]
push eax
call fcn.00416a6c
add esp, 0xc
test eax, eax
jne 0x409e7b
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push 0
push str.Version
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 0x1770
call edi
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x409e7b
mov eax, dword [ebp - 0x78]
cmp eax, 1
jae 0x409e3b
mov byte [esi], 0
jmp 0x409e46
add eax, esi
cmp byte [eax - 1], 0
je 0x409e46
mov byte [eax], 0
push str.1.7.
push esi
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
je 0x409e79
push str.1.6.
push esi
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
je 0x409e79
push str.1.5.
push esi
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
jne 0x409e7b
xor bl, bl
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x1704]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00413c78
add ebp, 0x1708
leave
ret
Function at 0x409e9e
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push edi
xor esi, esi
push esi
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jle 0x409ef6
push edi
call fcn.00412d69
pop ecx
mov esi, eax
push edi
push esi
push ebx
mov byte [esi], 0
call ebp
dec edi
push esi
cmp eax, edi
je 0x409edf
call fcn.00413a45
push ebx
xor esi, esi
push str.error_reading__S
jmp 0x409ee5
push ebx
push str._S_is__S
call fcn.0040ea46
add esp, 0xc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x409f1d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f67
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x40a003
Capabilities:
Check os version
Get common file path
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x1788]
mov eax, 0x1808
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x1784], eax
push esi
push edi
mov edi, dword [ebp + 0x1790]
mov esi, 0x94
push esi
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004154b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x7c], 6
jb 0x40a061
jne 0x40a0f2
cmp dword [ebp - 0x78], 4
jae 0x40a0f2
push ebx
push edi
call fcn.00413700
add eax, 0x64
push eax
call fcn.00412d69
push edi
mov ebx, eax
push str._sucrtbase.dll
push ebx
call fcn.00414711
push ebx
call fcn.00404a1d
add esp, 0x18
test al, al
je 0x40a0ea
push str.Preloading_ucrtbase.dll_4
call fcn.0040ea46
pop ecx
lea eax, [ebp + 0x14]
push eax
push 0x1770
mov byte [ebp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ucrtbase.dll
call esi
test eax, eax
jne 0x40a0d6
push ebx
call esi
test eax, eax
jne 0x40a0d6
push str.Could_not_preload_ucrtbase.dll
call fcn.0040ea46
pop ecx
lea eax, [ebp + 0x14]
push eax
call fcn.00413700
pop ecx
test eax, eax
jbe 0x40a0ea
lea eax, [ebp + 0x14]
push eax
call edi
push ebx
call fcn.00413a45
pop ecx
pop ebx
mov ecx, dword [ebp + 0x1784]
pop edi
xor ecx, ebp
pop esi
call fcn.00413c78
add ebp, 0x1788
leave
ret
Function at 0x40d2a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x45f0]
mov eax, 0x4670
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x45ec], eax
mov eax, dword [ebp + 0x4600]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x4604]
push ebx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x4608]
push esi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x460c]
push edi
mov edi, dword [ebp + 0x45f8]
mov dword [ebp - 0x7c], eax
mov ebx, 0x1770
push ebx
lea eax, [ebp - 0x64]
push eax
push 0xa0
call fcn.00403814
mov esi, dword [ebp + 0x45fc]
push edi
push esi
lea eax, [ebp - 0x64]
push eax
push str.checking_app_id__S___d___p_
call fcn.0040ea46
lea eax, [ebp - 0x64]
push eax
call fcn.00413700
add esp, 0x20
test eax, eax
je 0x40d461
lea eax, [ebp - 0x68]
push eax
or esi, 0x20019
push esi
xor esi, esi
push esi
push str.SOFTWAREej_technologiesinstall4jinstallations
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40d454
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x2e7c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d43c
cmp dword [ebp - 0x70], esi
jbe 0x40d43c
lea eax, [ebp + 0x2e7c]
push eax
push str.found_installations:__S
call fcn.0040ea46
mov ebx, 0x430d8c
lea eax, [ebp + 0x2e7c]
push ebx
push eax
call fcn.00414590
add esp, 0x10
jmp 0x40d42c
push edi
call fcn.00413700
pop ecx
test eax, eax
je 0x40d449
push edi
lea eax, [ebp + 0x170c]
push str._sjre
push eax
call fcn.00414711
lea eax, [ebp + 0x170c]
push eax
push dword [ebp - 0x6c]
call fcn.00409bb6
add esp, 0x14
test al, al
je 0x40d410
push 1
push 1
push esi
push dword [ebp - 0x7c]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
call fcn.0040d072
add esp, 0x1c
test al, al
jne 0x40d438
lea eax, [ebp + 0x170c]
push eax
push str.java_version_did_not_match_in__S
jmp 0x40d41c
lea eax, [ebp + 0x170c]
push eax
push str.did_not_find_java_in__S
call fcn.0040ea46
pop ecx
pop ecx
push ebx
push esi
call fcn.00414590
pop ecx
pop ecx
mov edi, eax
cmp edi, esi
jne 0x40d3ae
jmp 0x40d449
mov al, 1
jmp 0x40d463
push esi
push str.could_not_query_value_node__d
call fcn.0040ea46
pop ecx
pop ecx
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d461
push eax
push str.could_not_open_installation_node__d
call fcn.0040ea46
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp + 0x45ec]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c78
add ebp, 0x45f0
leave
ret
Function at 0x40d6a6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x177c], ecx
push 0x1770
lea ecx, [ebp - 0x1774]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40d76b
and dword [ebp - 0x1778], 0
lea eax, [ebp - 0x1774]
push eax
call fcn.00413700
pop ecx
test eax, eax
jbe 0x40d734
mov eax, dword [ebp - 0x1778]
lea eax, [ebp + eax - 0x1774]
cmp byte [eax], 0x2f
jne 0x40d719
mov byte [eax], 0x5c
inc dword [ebp - 0x1778]
lea eax, [ebp - 0x1774]
push eax
call fcn.00413700
pop ecx
cmp dword [ebp - 0x1778], eax
jb 0x40d704
lea eax, [ebp - 0x1774]
push eax
push esi
call fcn.00409bb6
pop ecx
pop ecx
test al, al
je 0x40d767
push 1
push 1
push 0
push dword [ebp - 0x177c]
push ebx
push edi
push esi
call fcn.0040d072
add esp, 0x1c
test al, al
je 0x40d767
xor eax, eax
inc eax
jmp 0x40d76d
xor eax, eax
jmp 0x40d76d
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c78
leave
ret
Function at 0x40d8df
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40da5a
push ebx
push esi
mov esi, 0x1770
push edi
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.00412d69
push esi
mov dword [ebp - 0x18], eax
call fcn.00412d69
push esi
mov dword [ebp - 8], eax
call fcn.00412d69
push esi
mov edi, eax
call fcn.00412d69
add esp, 0x10
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 0x18]
mov ebx, eax
xor eax, eax
push eax
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
push eax
jmp 0x40da1b
push dword [ebp - 8]
mov byte [edi], 0
mov byte [ebx], 0
call fcn.00413700
inc eax
pop ecx
test eax, eax
jle 0x40d993
mov ebx, dword [ebp - 8]
mov ecx, edi
sub ebx, edi
mov dl, byte [ebx + ecx]
cmp dl, 0x2f
jne 0x40d98a
mov byte [ecx], 0x5c
jmp 0x40d98c
mov byte [ecx], dl
inc ecx
dec eax
jne 0x40d97d
mov ebx, dword [ebp - 0x20]
push str.i4j_jres
push edi
call fcn.00415900
test eax, eax
pop ecx
setne al
cmp byte [ebp + 0x20], 0
pop ecx
je 0x40d9af
test al, al
je 0x40d9b9
cmp byte [ebp + 0x24], 0
je 0x40d9fb
test al, al
je 0x40d9fb
push 1
push 1
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push edi
call fcn.0040d072
add esp, 0x1c
test al, al
je 0x40d9fb
push dword [ebp + 0x14]
push ebx
call fcn.0040c80a
pop ecx
pop ecx
test al, al
je 0x40d9fb
push ebx
push dword [ebp + 0x14]
call fcn.00413b80
push edi
push dword [ebp + 0x10]
call fcn.00413b80
add esp, 0x10
mov byte [ebp - 1], 1
inc dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40d962
push edi
call fcn.00413a45
push ebx
call fcn.00413a45
push dword [ebp - 0x18]
call fcn.00413a45
push dword [ebp - 8]
call fcn.00413a45
add esp, 0x10
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov al, byte [ebp - 1]
leave
ret
Function at 0x40e0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x43b37c]
mov dword [ebp - 4], 0x43b37c
jmp 0x40e132
mov eax, dword [ebp - 4]
mov edi, dword [eax]
push edi
call fcn.00413700
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00412d69
pop ecx
pop ecx
test esi, esi
jle 0x40e114
mov ecx, eax
sub edi, eax
mov edx, esi
mov bl, byte [edi + ecx]
xor bl, 0xbb
mov byte [ecx], bl
inc ecx
dec edx
jne 0x40e108
push esi
push eax
push dword [ebp + 8]
mov byte [eax + esi], 0
call fcn.00414651
add esp, 0xc
test eax, eax
je 0x40e143
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00413700
pop ecx
test eax, eax
ja 0x40e0e6
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov al, 1
jmp 0x40e13e

Function at 0x40e28e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x40e2be
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
movsx edi, byte [edx]
mov eax, dword [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43b380]
inc edx
dec esi
mov dword [ecx], eax
jne 0x40e2a0
pop edi
pop esi
ret
Function at 0x40e78b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x465c
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
cmp dword [0x448c9c], esi
jne 0x40e7df
push 0x18
call fcn.00413e43
mov edx, eax
pop ecx
cmp edx, esi
je 0x40e7cd
push 6
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [0x448c9c], edx
jmp 0x40e7d3
mov dword [0x448c9c], esi
push dword [0x448c9c]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [0x448c9c]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x448c98]
cmp eax, esi
je 0x40e80e
cmp dword [0x448c94], esi
jne 0x40e80e
push str.a_ccsUTF_8
push eax
call fcn.004158b7
pop ecx
pop ecx
mov dword [0x448c94], eax
cmp byte [0x448c90], 0
jne 0x40e9c2
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
mov bl, byte [0x44a45b]
mov edi, 0x1770
push edi
lea eax, [ebp - 0x1774]
push eax
push str.EXE4J_LOG
mov byte [0x448c90], 1
call esi
test eax, eax
jbe 0x40e860
lea eax, [ebp - 0x1774]
push 0x4339c4
push eax
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
jne 0x40e860
mov bl, 1
push edi
lea eax, [ebp - 0x1774]
push eax
push str.INSTALL4J_LOG
call esi
test eax, eax
jbe 0x40e88c
lea eax, [ebp - 0x1774]
push 0x4339c4
push eax
call fcn.004150b0
pop ecx
pop ecx
test eax, eax
jne 0x40e88c
mov bl, 1
test bl, bl
pop ebx
je 0x40e9c2
mov edi, 0x2ee0
push edi
call fcn.00412d69
mov esi, eax
xor eax, eax
push eax
push esi
mov word [esi], ax
call fcn.0040583b
push esi
call fcn.00413f2b
add esp, 0x10
test eax, eax
jne 0x40e8c8
push 0x4339ac
push esi
call fcn.0041449a
jmp 0x40e8e4
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x40e8e6
cmp ax, 0x2f
je 0x40e8e6
push 0x431a60
push esi
call fcn.0041446c
pop ecx
pop ecx
push edi
call fcn.00412d69
pop ecx
mov dword [0x448c98], eax
xor edi, edi
inc edi
push edi
push esi
push str._si4j_nlog__d.log
push dword [0x448c98]
call fcn.0040e715
push dword [0x448c98]
call fcn.00404a76
add esp, 0x14
test al, al
je 0x40e921
cmp edi, 0x3e8
jl 0x40e8f4
push esi
call fcn.00413a45
mov esi, str.w_ccsUTF_8
push esi
push dword [0x448c98]
call fcn.004158b7
add esp, 0xc
mov dword [0x448c94], eax
test eax, eax
jne 0x40e960
mov eax, str.c:i4j_nlog
push esi
push eax
mov dword [0x448c98], eax
call fcn.004158b7
pop ecx
pop ecx
mov dword [0x448c94], eax
test eax, eax
je 0x40e9c2
push 0x1770
lea eax, [ebp - 0x4654]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x465c]
push eax
call fcn.00415036
lea eax, [ebp - 0x465c]
push eax
call fcn.004188ae
push eax
lea eax, [ebp - 0x4654]
push eax
push str.Started_executable__s_at__S_n
push dword [0x448c94]
call fcn.004189ca
push dword [0x448c94]
call fcn.00414ab7
add esp, 0x1c
call fcn.0040e72b
mov dword [0x448ca0], eax
mov dword [0x448ca4], edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00413c78
leave
ret
Function at 0x40ea9f
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x16fc]
mov eax, 0x177c
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x16f8], eax
push esi
xor esi, esi
push esi
call fcn.00404acf
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00405b67
add esp, 0xc
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40eb1e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 4
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x16f8]
xor ecx, ebp
pop esi
call fcn.00413c78
add ebp, 0x16fc
leave
ret

Function at 0x40eb34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1704]
mov eax, 0x1784
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp + 0x1700], eax
push edi
xor edi, edi
push edi
call fcn.00404acf
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00405b67
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push edi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ebbe
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ebb5
cmp dword [ebp - 0x78], 4
jne 0x40ebb5
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1700]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00413c78
add ebp, 0x1704
leave
ret

Function at 0x40ee73
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040ec10
pop ecx
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, eax
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
mov edi, eax
call fcn.00413a45
pop ecx
cmp edi, 0xffffffff
jne 0x40eeb1
push str.creating_mailslot_failed
call fcn.0040ea46
pop ecx
jmp 0x40eecc
push str.creating_mailslot_successful
call fcn.0040ea46
pop ecx
push ebx
push ebx
push edi
push 0x40ec4b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
Function at 0x40eed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
call fcn.0040ec10
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call fcn.00413f2b
pop ecx
pop ecx
test eax, eax
jne 0x40eef6
mov dword [ebp + 0xc], str.__i4j_empty_command_line
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0
mov ebx, 0x80
push ebx
push 3
push 0
push 1
mov edi, 0x40000000
push edi
push dword [ebp - 0xc]
call esi
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40ef69
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
cmp eax, 0x32
jge 0x40ef4e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
push 3
push 0
push 1
push edi
push dword [ebp - 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40ef24
cmp dword [ebp - 4], 0xffffffff
jne 0x40ef69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_CreateFile__d
call fcn.0040ea46
pop ecx
pop ecx
jmp 0x40efc1
push dword [ebp + 0xc]
call fcn.00413f2b
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
add esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40efa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_WriteFile__d
call fcn.0040ea46
pop ecx
pop ecx
jmp 0x40efb8
cmp dword [ebp - 8], esi
je 0x40efb8
push esi
push dword [ebp - 8]
push str.error_mailslot_WriteFile_length__d__d
call fcn.0040ea46
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.00413a45
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410696
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x44a45d], 0
push esi
je 0x4106d6
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x4106d6
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00413700
pop ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x4106ee
push dword [ebp + 8]
call fcn.00418cd1
call fcn.00414c2f
add eax, 0x20
push eax
call fcn.00414ab7
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x410733
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x4107b9
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.004154b0
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
jne 0x410797
cmp dword [ebp - 0x90], 0
je 0x4107b9
push str.SetDefaultDllDirectories
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4107b9
push 0xc00
call eax
push str.restrict_DLL_directories
call fcn.0040ea46
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00413c78
leave
ret

Function at 0x4107c6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1774
call fcn.00413c90
mov eax, dword [0x43bc80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, 0x448cd8
lea eax, [ebp - 0x1774]
push eax
call fcn.00405898
push 0
call fcn.00415036
push edx
push eax
lea eax, [ebp - 0x1774]
push eax
push str._s_dir_d
push esi
call fcn.00414711
push esi
push str.Temp_dir3:__S
call fcn.0040ea46
add esp, 0x24
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x410859
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43485c
call fcn.0040ea46
inc edi
cmp edi, 0xa
pop ecx
pop ecx
jl 0x4107e6
push 0x434858
push 0x3f1
mov byte [0x448cd8], 0
call fcn.0040401d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00413c78
leave
ret

Function at 0x410867
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4108d5
push esi
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4108d4
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret