joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40143c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.004011ac
add rsp, 0x28
jmp 0x40143c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x004119f0], rdi
je 0x40149c
cmp rax, rdi
jne 0x40148f
mov r12d, 1
jmp 0x40149c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401475
mov eax, dword [0x004119e8]
cmp eax, 1
jne 0x4014b1
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x401518
mov eax, dword [0x004119e8]
cmp eax, ebx
jne 0x40150e
mov dword [0x004119e8], 1
lea r13, [0x004095d0]
lea rdi, [0x004095b8]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x401500
cmp eax, ebx
jne 0x401500
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x4014f5
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x4014de
cmp eax, ebx
je 0x401518
mov eax, 0xff
jmp 0x401660
mov dword [0x00411b1c], 1
mov eax, dword [0x004119e8]
cmp eax, 1
jne 0x401540
lea rdx, [0x004095b0]
lea rcx, [0x00409598]
call sub.msvcrt.dll__initterm
mov dword [0x004119e8], 2
cmp r12d, ebx
jne 0x40154f
mov rax, rbx
xchg qword [0x004119f0], rax
cmp qword [0x004119f8], rbx
je 0x401577
lea rcx, [0x004119f8]
call fcn.0040536c
cmp eax, ebx
je 0x401577
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x004119f8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x40158d
mov eax, 0xff
jmp 0x401660
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x401612
cmp word [rcx], bx
je 0x4015a8
cmp edx, ebx
jne 0x401612
cmp word [rcx], bx
je 0x4015be
cmp word [rcx], 0x20
ja 0x4015be
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x4015a8
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x00400000]
call fcn.00401680
mov dword [0x00411b18], eax
cmp dword [0x0041160c], ebx
jne 0x4015fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x00411b1c], ebx
jne 0x401610
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x00411b18]
jmp 0x401660
cmp word [rcx], 0x22
jne 0x401625
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x401599
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x4025f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
lea rax, [r11 - 0x10]
mov esi, r9d
mov rdi, r8
mov r9d, 1
xor r8d, r8d
xor bl, bl
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4026ec
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r8, rdi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 4
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov rdi, qword [rsp + 0x80]
test eax, eax
jne 0x402688
mov eax, dword [rsp + 0x44]
test esi, esi
je 0x402684
test eax, eax
je 0x402684
cmp eax, 1
jne 0x402688
mov dword [rdi], eax
mov bl, 1
mov dword [rsp + 0x40], 4
test bl, bl
jne 0x4026e1
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [0x0040f6f0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x4026e1
mov eax, dword [rsp + 0x44]
test esi, esi
je 0x4026dd
test eax, eax
je 0x4026dd
cmp eax, 1
jne 0x4026e1
mov dword [rdi], eax
mov bl, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x4029dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x402a29
cmp rcx, 0xffffffffffffffff
je 0x402a29
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x402a21
cmp dword [rcx + 0x3c], edx
jl 0x402a21
cmp dword [rcx + 0x3c], 0x10000000
jae 0x402a21
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x402a29
mov rax, rdx
add rsp, 0x18
ret
Function at 0x4030d0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004115d0]
jne 0x4030eb
rol rcx, 0x10
test cx, 0xffff
jne 0x4030e7
ret 0
ror rcx, 0x10
jmp 0x4053cc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00411100]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x004111f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x405451
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00411100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x405473
mov rax, qword [rsp + 0x88]
mov qword [0x004111f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00411198], rax
mov rax, qword [0x004111f8]
mov qword [0x00411070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00411180], rax
mov dword [0x00411060], 0xc0000409
mov dword [0x00411064], 1
mov rax, qword [0x004115d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004115d8]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00409b68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x4032ec
Capabilities:
Check os version

Disassembly:
sub rsp, 0x368
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x350], rax
cmp qword [0x00411be0], 0
jne 0x40339f
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40339f
cmp dword [rsp + 0x30], 2
jne 0x403391
cmp dword [rsp + 0x24], 6
jae 0x403391
mov rcx, qword [0x004118c8]
lea rdx, [rsp + 0x140]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40339f
lea rcx, [rsp + 0x140]
call fcn.0040458c
mov qword [0x00411be0], rax
cmp rax, qword [0x004118c8]
jne 0x40339f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40339f
mov rax, qword [0x004118c8]
mov qword [0x00411be0], rax
mov rcx, qword [0x00411be0]
mov rax, qword [0x004118c8]
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.004030d0
add rsp, 0x368
ret
Function at 0x4037c8
Capabilities:
Accept command line arguments
Create process on windows
Persist via active setup registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x590
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x580], rax
lea rcx, [rsp + 0x162]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], si
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa0]
lea rdx, str.SoftwareMicrosoftActive_SetupInstalled_Components_26923b43_4d38_484f_9b9e_de460746276c
mov r8d, 0xba
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x60]
lea r9d, [rsi + 1]
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x403a28
mov r8d, 0x208
lea rcx, [rsp + 0x160]
xor edx, edx
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x50], esi
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x60]
lea r11, [rsp + 0x54]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x50]
lea rdx, str.StubPath
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x403907
cmp dword [rsp + 0x50], 1
je 0x4038b6
cmp dword [rsp + 0x50], 2
jne 0x403907
mov eax, dword [rsp + 0x54]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x160]
shr rax, 1
mov dword [rsp + 0x58], esi
mov word [rsp + rax*2 + 0x15e], si
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
cmp rax, rsi
je 0x403907
mov r8, qword [rax]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.004028b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x403a28
mov rax, qword [str._ShowQLIcon]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x370]
mov qword [rcx], rax
mov rax, qword [0x0040a2d0]
mov r8d, 0x104
mov qword [rcx + 8], rax
mov rax, qword [0x0040a2d8]
mov qword [rcx + 0x10], rax
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
je 0x403a28
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x370]
lea r8, str.__s___s
lea rcx, [rsp + 0x160]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.0040327c
cmp eax, esi
jl 0x403a28
mov ebx, 0x68
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
xor eax, eax
lea rdx, [rsp + 0x160]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x403a28
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.004030d0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x403c44
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x6f0
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov rbp, rcx
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x403e0c
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x403e0c
mov edi, 0x104
lea rcx, [rsp + 0xd0]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x403e0c
lea r8, str.AppPatch_sysmain.sdb
lea rcx, [rsp + 0xd0]
mov rdx, rdi
call fcn.004031b0
test eax, eax
js 0x403e0c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rcx, [rsp + 0xd0]
mov edx, 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x403e0c
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x403e03
mov eax, 0x1c81080
cmp dword [rsp + 0x44], eax
jb 0x403d33
cmp dword [rsp + 0x4c], eax
jae 0x403e03
mov rax, qword [0x00411be0]
test rax, rax
jne 0x403d44
call fcn.004032ec
lea r8, [rsp + 0x2e0]
mov r9d, 0x200
mov edx, 0x2c3
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x403e03
mov rax, qword [0x00411be0]
test rax, rax
jne 0x403d79
call fcn.004032ec
lea r8, [rsp + 0x50]
mov r9d, 0x40
mov edx, 0x2d3
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x403e03
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x2e0]
mov r9d, 0x31
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x403e03
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str._extoff_go.microsoft.com_fwlink__LinkId106323
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
lea rdx, [rcx + rcx]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x403e03
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, str._extoff_go.microsoft.com_fwlink__LinkId106323
lea rdx, [rsi + 1]
mov rcx, rdi
mov qword [rbp], rdi
call fcn.004028b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.004030d0
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x403e3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x403f02
test rdx, rdx
je 0x403f02
xor r9d, r9d
lea rdx, [0x0040e378]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x403e83
xor ebx, ebx
jmp 0x403e92
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x0040e378]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x403eb9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x403ef7
test rax, rax
je 0x403ef7
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x403ef1
cmp dword [rax], ecx
jne 0x403ef1
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x403ee8
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x403ee8
xor eax, eax
jmp 0x403eed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403ef3
xor esi, esi
mov eax, esi
jmp 0x403f04
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x403fe8
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x00411be8]
test eax, eax
jne 0x4040ed
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40404b
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x00411be8], eax
sub ecx, r8d
je 0x4040cd
cmp ecx, r8d
jne 0x4040ed
cmp edx, 5
jne 0x4040bb
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x4040b4
sub ecx, r8d
je 0x40409f
cmp ecx, r8d
je 0x404089
lea eax, [rdx + 0xf]
jmp 0x4040e7
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x4040e7
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x40409a
mov eax, 4
jmp 0x4040e7
cmp edx, 4
ja 0x404105
mov ecx, 2
mov eax, ecx
mov dword [0x00411be8], ecx
cmp edx, 4
jne 0x4040ed
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x4040e4
cmp ecx, 0xa
je 0x4040e4
cmp ecx, 0x5a
jne 0x4040ed
mov eax, r8d
mov dword [0x00411be8], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.004030d0
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x4040e7
Function at 0x404b78
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
lea rax, [r11 - 0x18]
lea r8, str.TerminateOnShutdown
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r9
and qword [r11 - 0x38], 0
mov r9d, 0x10
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
call sub.SHLWAPI.dll_SHRegGetValueW
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
add rsp, 0x58
ret

Function at 0x404bd8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call sub.SHLWAPI.dll_SHSetValueW
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
add rsp, 0x38
ret

Function at 0x4051f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, dword [r8]
mov rbx, rdx
mov r9, rcx
and r11d, 0xfffffff8
test byte [r8], 4
mov r10, rcx
je 0x40521f
mov eax, dword [r8 + 8]
movsxd r10, dword [r8 + 4]
neg eax
add r10, rcx
movsxd rcx, eax
and r10, rcx
movsxd rax, r11d
mov rdx, qword [rax + r10]
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 8]
add rcx, qword [rbx + 8]
test byte [rcx + 3], 0xf
je 0x405243
movzx eax, byte [rcx + 3]
and eax, 0xfffffff0
cdqe
add r9, rax
xor r9, rdx
mov rcx, r9
add rsp, 0x20
pop rbx
jmp fcn.004030d0

Function at 0x4055dc
Capabilities:
Set registry value

Disassembly:
mov r9d, ecx
lea r8, str.StartPageCache
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
jmp fcn.00404bd8

Function at 0x4057b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
and dword [rsp + 0x40], 0
lea rax, [r11 + 0x10]
lea r9, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea rax, [r11 + 8]
lea r8, str.StartPageCache
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x18], rax
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0x405818
cmp dword [rsp + 0x50], 4
jne 0x405810
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x40581c
cmp eax, 2
je 0x40581c
cmp eax, 0xa
je 0x40581c
xor eax, eax
mov dword [rsp + 0x40], eax
jmp 0x40581c
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x40585a
call fcn.00405718
mov dword [rsp + 0x40], eax
test eax, eax
je 0x40585a
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x405856
mov r9d, dword [rsp + 0x40]
lea r8, str.StartPageCache
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call fcn.00404bd8
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x4058cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
mov edi, r9d
lea rax, [r11 - 0x10]
mov rsi, r8
xor ebx, ebx
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4059b2
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r8, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebx
jne 0x40594b
mov ecx, dword [rsp + 0x44]
cmp edi, ebx
je 0x40599b
cmp ecx, ebx
je 0x40599b
cmp ecx, 1
je 0x40599b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [0x0040f6f0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebx
jne 0x4059a7
mov ecx, dword [rsp + 0x44]
cmp edi, ebx
je 0x40599b
cmp ecx, ebx
je 0x40599b
cmp ecx, 1
jne 0x4059a7
mov rax, qword [rsp + 0x80]
mov bl, 1
mov dword [rax], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x405c7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ecx, 4
call qword [sym.imp.iertutil.dll_Ordinal_74]
mov rbx, rax
test rax, rax
je 0x405dc1
lea rax, [rsp + 0x48]
mov edi, 0x20019
lea rdx, str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405d10
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405dc1
xor edi, edi
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, edi
mov dword [rsp + 0x40], 0x27
call sub.SHLWAPI.dll_SHEnumValueW
mov esi, eax
test eax, eax
jne 0x405dac
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_SHCLSIDFromString]
test eax, eax
js 0x405dac
lea rax, [rsp + 0x50]
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x00409e28]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.urlmon.dll_Ordinal_104
test eax, eax
js 0x405dac
mov r8, qword [rsp + 0x50]
mov edx, 0x7fffffff
mov rcx, rbx
call qword [sym.imp.iertutil.dll_Ordinal_85]
cmp eax, 0xffffffff
jne 0x405dac
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc edi
test esi, esi
je 0x405d12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x00411950]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x00411b20], 0
jne 0x405de1
mov qword [0x00411b20], rbx
xor ebx, ebx
lea rcx, [0x00411950]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x405e06
lea rdx, [0x00405a00]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.iertutil.dll_Ordinal_79]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004030d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x40632c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x34]
movsxd rdi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor esi, esi
mov word [rcx], si
lea r9, [rsp + 0x30]
lea r8, str.AcceptLanguage
lea rdx, str.SoftwareMicrosoftInternet_ExplorerInternational
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x208
call sub.SHLWAPI.dll_SHGetValueW
cmp eax, esi
jne 0x4063ed
cmp dword [rsp + 0x30], 1
jne 0x4063ed
lea rax, [rsp + 0x40]
cmp word [rsp + 0x40], si
je 0x4063c7
cmp word [rax], 0x2c
je 0x4063c7
cmp word [rax], 0x3b
je 0x4063c7
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp word [rax], si
jne 0x4063ad
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov word [rax], si
call sub.MLANG.dll_Ordinal_123
cmp eax, esi
jl 0x4063ed
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.004028b8
cmp si, word [rbx]
jne 0x406405
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov r8d, edi
mov rdx, rbx
mov ecx, eax
call sub.MLANG.dll_Ordinal_121
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.004030d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x40696c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov edi, r9d
mov rsi, r8
mov rbp, rdx
cmp rcx, r12
je 0x40699b
mov ebx, r12d
jmp 0x4069c7
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, edi
jbe 0x4069c2
cmp edi, r12d
je 0x4069bd
lea eax, [rdi - 1]
mov word [rsi + rax*2], r12w
mov ebx, r12d
jmp 0x4069d5
cmp eax, r12d
jne 0x4069d5
mov rdx, rdi
mov r8, rbp
mov rcx, rsi
call fcn.004028b8
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp 0x40696c