joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527c10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xb495d8]
xor edx, edx
cmp eax, edx
jne 0x527c36
xor eax, eax
mov byte [eax + 0xb494d8], al
inc eax
cmp eax, 0x100
jl 0x527c1e
mov dword [0xb495d8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xb494d8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x527cc7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x527c9a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x527c68
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x527cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x527d23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x527d0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52e6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55cf9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0052efc0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xaea014
call fcn.0054d8e8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x52e733
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0054d8e8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x52e72c
push 0
mov ecx, eax
call fcn.00525840
mov dword [esi + 0xc], eax
jmp 0x52e735
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x52e735
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x54ff75
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x54ffad
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0054e002
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0054dfda
jmp 0x54ffb9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55166c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5516ae
call fcn.0055715d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5516ae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5516a5
xor eax, eax
jmp 0x5516b6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005516bc
pop edi
pop esi
pop ebx
ret 4

Function at 0x55768d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5576bb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5576d9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005575f3
jmp 0x5576d9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5576d9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005575f3
test edi, edi
mov eax, edi
jne 0x5576c3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401ad2
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xc
add esp, 0xfffff004
push eax
dec eax
jne 0x401adb
mov eax, dword [ebp - 4]
add esp, 0xfffff104
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
test esi, esi
je 0x40257f
jmp case.default.0x401b55
lea eax, [ebp - 0x2024]
xor ebx, ebx
mov edx, ebx
shl edx, 0xc
lea ecx, [ebp - 0x8024]
add edx, ecx
call fcn.00402d08
inc ebx
cmp ebx, 6
jl 0x401b0e
or edi, 0xffffffff
xor ebx, ebx
push dword [ebx*4 + 0x415064]
lea eax, [ebp - 0x1024]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x401b46
mov edi, ebx
jmp 0x401b4c
inc ebx
cmp ebx, 0xc
jl 0x401b2b
cmp edi, 0xb
ja case.default.0x401b55
jmp dword [edi*4 + 0x401b5c]
cmp dword [ebp - 8], 2
jne case.default.0x401b55
lea eax, [ebp - 0x8424]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea edx, [ebp - 0x8424]
lea eax, [ebp - 0x8824]
call fcn.0040fee0
lea eax, [ebp - 0x8824]
call fcn.00402bf4
lea edx, [ebp - 0x2024]
lea eax, [ebp - 0x8824]
call fcn.0040ffa8
lea eax, [ebp - 0x942c]
call fcn.00405aac
lea edx, [ebp - 0x8824]
lea eax, [ebp - 0x942c]
call fcn.00405b00
lea eax, [ebp - 0x98cc]
call fcn.0040693c
lea eax, [ebp - 0x98a0]
call fcn.0040693c
lea eax, [ebp - 0x9874]
call fcn.0040693c
jmp 0x401d64
push 0
lea edx, [ebp - 0xa4e0]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
cmp byte [ebp - 0x98d0], 0
je 0x401ce1
call fcn.00405758
cmp eax, 4
je 0x401ce1
lea edx, [ebp - 0xa8e0]
lea eax, [ebp - 0x8424]
call fcn.00406828
lea eax, [ebp - 0xa8e0]
call fcn.00402bf4
lea eax, [ebp - 0x8424]
call fcn.0040fe64
mov ebx, eax
cmp ebx, 4
jl 0x401c7c
lea eax, [ebp - 0xa8e0]
call fcn.0040fe64
cmp eax, ebx
jb 0x401c91
invalid
test esp, ebx
invalid
Function at 0x4013d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480942
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4a06b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], 0
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x228], esi
mov word [esi], cx
mov dword [ebp - 4], ecx
mov edi, dword [eax]
mov ecx, 1
mov dword [ebp - 0x224], ecx
test edi, edi
je 0x4014ae
push 0x208
lea edx, [ebp - 0x218]
push 0
push edx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], 0x104
call fcn.00426e40
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push str.UninstallString
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x401490
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401490
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401af0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret 4
Function at 0x401f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4808f8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4a06b4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00402430
push eax
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x70], 0
call fcn.00402490
add esp, 0x10
push 0x49be28
lea eax, [esp + 0x30]
push eax
call fcn.0041ec4b
int3
Function at 0x406370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480398
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a06b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4063b1
xor eax, eax
jmp 0x40654a
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
xor eax, eax
cmp edx, eax
je 0x4063df
mov ecx, dword [esi + 0x34]
mov ebx, dword [ecx]
lea ebx, [edx + ebx*2]
cmp edx, ebx
jae 0x4063df
dec dword [ecx]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x40654a
cmp dword [esi + 0x54], eax
je 0x406545
mov edx, dword [esi + 0x10]
lea ebx, [esi + 0x48]
cmp dword [edx], ebx
jne 0x406408
mov ecx, dword [esi + 0x40]
mov ebx, dword [esi + 0x3c]
mov dword [edx], ebx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov edx, dword [esi + 0x30]
sub ecx, ecx
sar ecx, 1
mov dword [edx], ecx
cmp dword [esi + 0x44], eax
jne 0x406432
mov esi, dword [esi + 0x54]
push esi
push edi
call fcn.0041ced3
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x40654a
mov eax, ecx
jmp 0x40654a
movzx edx, di
mov ecx, 0xf
mov dword [ebp - 0x30], edx
mov edx, eax
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40645a
lea edx, [ebp - 0x2c]
mov byte [edx + 8], al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x406472
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x2e]
push edx
mov edx, dword [edi + 0x14]
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call edx
test eax, eax
js 0x40653d
cmp eax, 1
jg 0x406505
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4064b2
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, ecx
je 0x4064db
cmp ebx, 0x10
jae 0x4064c1
lea eax, [ebp - 0x2c]
mov ecx, dword [esi + 0x54]
push ecx
push edi
push 1
push eax
call fcn.0041e33e
add esp, 0x10
cmp edi, eax
jne 0x40653d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], edx
jne 0x40652f
test edi, edi
jne 0x406466
cmp dword [ebp - 0x1c], 0x20
lea ecx, [ebp - 0x2c]
jae 0x406540
push edi
push 8
call fcn.00406de0
jmp 0x406460
cmp eax, 3
jne 0x40653d
mov eax, dword [esi + 0x54]
mov ecx, dword [ebp - 0x30]
call fcn.00404b00
movzx esi, word [ebp + 8]
test al, al
jne 0x406522
mov esi, 0xffff
lea ecx, [ebp - 0x2c]
call fcn.00405060
mov ax, si
jmp 0x40654a
lea ecx, [ebp - 0x2c]
call fcn.00405060
mov ax, word [ebp + 8]
jmp 0x40654a
lea ecx, [ebp - 0x2c]
call fcn.00405060
mov eax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret 4
Function at 0x407160
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480808
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4a06b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x54], 0
jne 0x407258
mov eax, dword [ebp + 8]
push 0x40
push 0xa
push eax
call fcn.0041b321
add esp, 0xc
test eax, eax
je 0x407258
lea edx, [esi + 0x18]
mov dword [esi + 0x20], edx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4a], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea edx, [esi + 0x28]
mov dword [esi + 0x30], edx
lea ecx, [esi + 0xc]
mov dword [esi + 0x14], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [ecx], 0
mov ecx, dword [esi + 0x24]
mov dword [ecx], 0
mov edx, dword [esi + 0x34]
mov dword [edx], 0
mov ecx, dword [esi + 0x10]
mov dword [ecx], 0
mov edx, dword [esi + 0x20]
mov dword [edx], 0
mov ecx, dword [esi + 0x30]
mov edx, dword [0x4a54f8]
mov dword [ecx], 0
mov dword [esi + 0x54], eax
lea edi, [ebp + 8]
mov eax, esi
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], 0
call fcn.00408520
push eax
mov dword [ebp - 4], 0
call fcn.0040a080
add esp, 4
mov edi, eax
call fcn.00407450
lea ecx, [ebp + 8]
call fcn.00403e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x407300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480598
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a06b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40742b
cmp byte [edi + 0x4a], bl
je 0x40742b
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x40741f
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40737f
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x407397
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x4073c0
dec eax
je 0x4073c4
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x40741a
jmp 0x407426
mov byte [edi + 0x4a], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4073d4
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4073fd
cmp ebx, 0x10
jae 0x4073e3
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0041e33e
add esp, 0x10
cmp esi, eax
jne 0x407417
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x407423
test esi, esi
jne 0x40738b
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00406de0
jmp 0x407385
lea ecx, [ebp - 0x2c]
call fcn.00405060
xor al, al
jmp 0x40742d
lea ecx, [ebp - 0x2c]
call fcn.00405060
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret
Function at 0x408430
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48036b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a06b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0041b212
push 4
mov dword [ebp - 4], 0
call fcn.0041cc2d
mov edi, eax
add esp, 4
test edi, edi
je 0x4084ac
call fcn.0041b0ea
mov dword [edi], eax
call fcn.0041aea9
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041b1d3
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4084a2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041b1fb
jmp 0x4084ae
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x492c44
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a746
mov ecx, dword [ebp - 4]
push 4
push 0x4a3590
push 4
push eax
push str.LanguageID
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x40a750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x492c44
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a7b5
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.LanguageID
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40a7c0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481448
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a06b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a879
xor ecx, ecx
push 0xffffffffffffffff
push ecx
mov word [ebp - 0x2c], cx
push 0x4a3570
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
call fcn.00401990
push 0x12
push str.EmployeeLogin.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00402fe0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x40a842
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
lea ecx, [edx + edx]
mov edx, dword [ebp - 0x30]
push ecx
push eax
push 1
push 0
push str.EmployeeLogin
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x18], 8
jb 0x40a86f
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041cbd1
add esp, 4
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret
Function at 0x40a8a0
Capabilities:
Check os version
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48140c
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4a06b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x80
xor edi, edi
lea eax, [ebp - 0x90]
push edi
push eax
call fcn.00426e40
add esp, 0xc
lea ecx, [ebp - 0x1fc]
push ecx
lea edx, [ebp - 0x90]
push edx
mov dword [ebp - 0x1fc], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x1f8]
push eax
mov dword [ebp - 0x1f8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1f4], 5
je 0x40ab09
lea ecx, [ebp - 0x90]
push str.Administrator
push ecx
call fcn.0041e6e6
add esp, 8
test eax, eax
je 0x40ab09
lea esi, [ebp - 0x218]
call fcn.00403250
mov dword [ebp - 4], edi
cmp dword [ebp - 0x20c], edi
je 0x40a972
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x40a972
lea edx, [ebp - 0x200]
push edx
call eax
mov dword [ebp - 0x204], eax
push 4
xor eax, eax
mov ebx, 7
push 0x492d44
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x9c], edi
mov word [ebp - 0xac], ax
call fcn.00401af0
push 0xffffffffffffffff
push edi
push 0x4a3570
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 1
call fcn.00402ed0
push 0xe
push str.closeuac.reg_
lea ecx, [ebp - 0xac]
call fcn.00402fe0
cmp dword [ebp - 0x98], 8
mov edx, dword [ebp - 0xac]
jae 0x40a9dc
lea edx, [ebp - 0xac]
xor ecx, ecx
mov eax, edx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb8], edi
mov word [ebp - 0xc8], cx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a9f6
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0xc8]
call fcn.00401af0
mov byte [ebp - 4], 2
push 0x16
xor edx, edx
push str.C:windows_regedit.exe
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xd4], edi
mov word [ebp - 0xe4], dx
call fcn.00401af0
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
call fcn.00411390
mov esi, 8
add esp, 4
cmp dword [ebp - 0xd0], esi
jb 0x40aa72
mov ecx, dword [ebp - 0xe4]
push ecx
call fcn.0041cbd1
add esp, 4
xor edx, edx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xd4], edi
mov word [ebp - 0xe4], dx
cmp dword [ebp - 0xb4], esi
jb 0x40aa9e
mov eax, dword [ebp - 0xc8]
push eax
call fcn.0041cbd1
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb8], edi
mov word [ebp - 0xc8], cx
cmp dword [ebp - 0x98], esi
jb 0x40aaca
mov edx, dword [ebp - 0xac]
push edx
call fcn.0041cbd1
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x9c], edi
mov word [ebp - 0xac], ax
cmp dword [ebp - 0x20c], edi
je 0x40ab09
cmp dword [ebp - 0x204], edi
je 0x40ab09
mov eax, dword [ebp - 0x210]
cmp eax, edi
je 0x40ab09
mov ecx, dword [ebp - 0x200]
push ecx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret