joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40123e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push edi
push pe_nt_image_headers32
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push 0x4011a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
lea eax, [ebp - 0x108]
push ebx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401302
push esi
push dword [ebp + 0xc]
call fcn.004016d7
pop ecx
inc eax
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
push 1
push ebx
push 0x401194
push dword [ebp + 8]
call esi
push dword [ebp + 0x10]
call fcn.004016d7
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push ebx
push 0x401184
push dword [ebp + 8]
call esi
push dword [ebp + 0x14]
call fcn.004016d7
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push ebx
push 0x401174
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x401306
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401374
lea eax, [ebp - 0xc]
push eax
push 0x4011b0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40136b
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x1c]
push 0x10
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401378
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
leave
ret
push 1
pop eax
leave
ret
Function at 0x40137d
Capabilities:
Get common file path
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
lea eax, [ebp - 0x11c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x11c]
push 0x4011c4
push eax
call fcn.00401760
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
pop ecx
mov edi, 0x80
push 0
push edi
push 3
push 0
push 1
lea eax, [ebp - 0x11c]
push 0x80000000
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401423
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call ebx
push 0
push edi
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x401423
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x4017e8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.DLL_Process32First
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004017d8
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
call fcn.004016e9
add esp, 0x10
test eax, eax
jne 0x401866
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x40186c
jmp 0x40182a
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4018f5
Capabilities:
Check os version
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
push edi
mov esi, 0x9c
xor edi, edi
push esi
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.004017a9
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x40194c
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call esi
test eax, eax
je 0x4019cf
mov eax, dword [ebp - 0x8c]
dec eax
dec eax
jne 0x4019cf
cmp dword [ebp - 0x98], 5
jne 0x4019cf
cmp dword [ebp - 0x94], 1
jne 0x4019cf
lea eax, [ebp - 0x1a0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x1a0]
push 0x4011c4
push eax
call fcn.00401760
pop ecx
lea eax, [ebp - 0x1a0]
pop ecx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4019cf
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp edi, 0x22000
jne 0x4019cf
push 1
pop eax
jmp 0x4019d1
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x45a900
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x20e000
lea edi, [esi - 0x3d000]
push edi
or ebp, 0xffffffff
jmp 0x45a922
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45a929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a918
mov eax, 1
add ebx, ebx
jne 0x45a93b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45a94c
jne 0x45a96b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a96b
dec eax
add ebx, ebx
jne 0x45a958
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45a930
add ebx, ebx
jne 0x45a967
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45a9bd
xor ecx, ecx
sub eax, 3
jb 0x45a983
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45a9f2
sar eax, 1
mov ebp, eax
jmp 0x45a98e
add ebx, ebx
jne 0x45a98e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a95c
inc ecx
add ebx, ebx
jne 0x45a99c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a95c
add ebx, ebx
jne 0x45a9a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45a99e
jne 0x45a9ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45a99e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45a9dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45a9ce
jmp 0x45a91e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45a9dc
add edi, ecx
jmp 0x45a91e
pop esi
mov edi, esi
mov ecx, 0xdc6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45a9fa
cmp byte [edi], 0x11
jne 0x45a9fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45a9ff
lea edi, [esi + 0x57000]
mov eax, dword [edi]
or eax, eax
je 0x45aa77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x636e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x63780]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45aa2c
mov ecx, edi
jns 0x45aa5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x63784]
or eax, eax
je 0x45aa71
mov dword [ebx], eax
add ebx, 4
jmp 0x45aa49
call dword [esi + 0x63794]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x45aaa8
cmp al, 0xef
ja 0x45aa9b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x45aa7d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x45aa8a
mov ebp, dword [esi + 0x63788]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45aadc
sub esp, 0xffffff80
jmp 0x416e84
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4012fd
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x10]
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor edi, edi
inc edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor ebx, ebx
lea eax, [ebp - 0x24]
push ebx
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], 0xc
mov edx, esi
mov dword [ebp - 8], edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
call fcn.0040126b
pop ecx
push dword [eax]
lea eax, [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00401aec
test esi, esi
je 0x40139c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40139c
push ebx
push str.Dtl_Installer
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x401398
push edi
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov eax, esi
jmp 0x40139e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013e9
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x482811
call fcn.0044baf5
mov esi, ecx
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
push edx
call fcn.00401de7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov edi, 0x4922e4
push edi
call fcn.00401de7
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov edx, eax
push esi
mov byte [ebp - 4], bl
call fcn.004014fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
mov edx, eax
mov dword [esp], 0x4922e8
call fcn.004014fa
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.004014fa
pop ecx
pop ecx
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.0040155f
push eax
lea ecx, [ebp - 0x10]
call fcn.00401666
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov edx, dword [esi]
mov dword [ebp - 0x1c], ebx
push dword [eax - 0xc]
push eax
push dword [edx - 0xc]
call fcn.00401582
push edi
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.004014fa
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401aec
push ebx
xor eax, eax
push eax
push dword [ebp - 0x14]
push str.explorer.exe
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, 0x20
setg bl
add ecx, 0xfffffff0
call fcn.00401aec
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401aec
mov eax, ebx
call fcn.0044bacf
ret
Function at 0x401968
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4019bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4019bc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4019ae
cmp esi, ecx
jae 0x4019bc
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40199c
cmp esi, ecx
jae 0x4019bc
cmp word [esi], 0
je 0x4019bc
mov eax, esi
jmp 0x4019be
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x402db4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call fcn.004031a6
mov ecx, eax
call fcn.00401ae9
mov esi, eax
mov edx, str.global_complate_download_url
mov ecx, esi
call fcn.0041f340
xor edi, edi
or edx, 0xffffffff
push edi
mov ecx, esi
call fcn.0041ee90
pop ecx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.00403c5d
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.0041e600
push 1
push edi
push edi
push dword [ebp - 4]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00401aec
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x4058bf
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x820c]
mov eax, 0x820c
call fcn.0044c280
push 0xffffffffffffffff
push 0x482c3e
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4a6074]
xor eax, ebp
mov dword [ebp + 0x8208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
push 0x208
xor ebx, ebx
lea eax, [ebp + 0x8000]
xor edi, edi
push ebx
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.0044cd20
push 0x7ffe
mov dword [ebp - 0x28], 0x104
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], edi
call fcn.0044b636
add esp, 0x10
mov dword [ebp - 0x14], 0x3fff
mov edi, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x8000]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x405a41
mov eax, 0x3fff
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [ebp], ax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
jne 0x405a90
push edi
lea ecx, [ebp - 0x10]
call fcn.00401de7
cmp dword [ebp + 0x8228], 8
lea ecx, [ebp + 0x8214]
jb 0x4059ed
mov ecx, dword [ebp + 0x8214]
test ecx, ecx
je 0x405a85
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jl 0x405a88
push ecx
push eax
call fcn.0044d5c3
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x405a85
mov eax, dword [ebp - 0x10]
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x405a88
cmp dword [ebp + 0x8240], 8
lea eax, [ebp + 0x822c]
push edi
cmovae eax, dword [ebp + 0x822c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401aec
test edi, edi
je 0x405a4c
push edi
call fcn.0044b876
pop ecx
lea ecx, [ebp + 0x8214]
call fcn.00408f65
lea ecx, [ebp + 0x822c]
call fcn.00408f65
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8208]
xor ecx, ebp
call fcn.0044b0c6
add ebp, 0x820c
leave
ret
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.00401aec
inc ebx
cmp ebx, dword [ebp - 0x1c]
jae 0x405a41
mov esi, dword [ebp - 0x20]
jmp 0x40597c
Function at 0x407cc8
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
push edi
mov edi, ecx
jne 0x407cd7
push 0xd
pop eax
jmp 0x407cfd
push dword [esp + 0xc]
call fcn.0045631c
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
ret 0xc
Function at 0x408b97
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x482ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a6074]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
xor esi, esi
mov ebx, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x408c32
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x408c32
call fcn.0040776c
mov esi, eax
jmp 0x408d0e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x408c4f
call fcn.0040776c
jmp 0x408d01
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408c45
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x408c7c
mov esi, 0x8007000e
jmp 0x408d03
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x408d45
jb 0x408c97
cmp eax, 0xffffffff
ja 0x408d45
cmp eax, 0x400
jbe 0x408ca9
push eax
lea ecx, [ebp]
call fcn.0040774a
jmp 0x408cbf
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x408cbf
mov dword [ebp - 4], 1
cmp dword [ebp], 0
je 0x408c72
push ebx
push dword [ebp]
push ebx
push dword [ebp - 0x14]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x408c45
mov eax, dword [ebp]
xor edx, edx
push dword [ebp + 0x41c]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x24]
push dword [ebp]
call fcn.00408a4b
mov esi, eax
test edi, edi
je 0x408d0e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x408d1e
lea ecx, [ebp]
call fcn.00407735
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0044b0c6
add ebp, 0x408
leave
ret 0x10
push 0x80070216
call fcn.00401d06
int3
Function at 0x40b7d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call fcn.004031a6
mov ecx, eax
call fcn.00401ae9
mov esi, eax
mov edx, 0x493244
mov ecx, esi
call fcn.0041f340
xor edi, edi
or edx, 0xffffffff
push edi
mov ecx, esi
call fcn.0041ee90
pop ecx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.00403c5d
push 0xfffffffffffffffe
pop edx
mov ecx, esi
call fcn.0041e600
push 1
push edi
push edi
push dword [ebp - 4]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00401aec
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x40bb58
Capabilities:
Check if file exists

Disassembly:
push 0x464
mov eax, 0x483272
call fcn.0044bb29
mov esi, ecx
push ecx
push 0x4932b0
push ecx
lea ecx, [ebp - 0x458]
call fcn.0040c93d
push 0x4a7da0
xor ebx, ebx
push 0x4a71e4
mov dword [ebp - 4], ebx
call fcn.0044d439
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x460]
call fcn.00402ed1
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x68]
push eax
lea eax, [ebp - 0x470]
push eax
call fcn.00417b6f
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x460]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov esi, dword [ebp - 0x470]
mov edi, dword [ebp - 0x46c]
jmp 0x40bbf2
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x54]
push str.BackUpPath
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40bbf6
add esi, 4
cmp esi, edi
jne 0x40bbd7
push ebx
push 0x4a71e0
push 0x4a6dec
push ebx
push dword [esi]
call fcn.0044dd40
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40bd5c
lea eax, [ebp - 0x45c]
mov ecx, edi
push eax
call fcn.0041b35e
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x45c]
cmp dword [eax - 0xc], 0
je 0x40bcbd
push 0x49248c
push eax
call fcn.00459de3
pop ecx
pop ecx
test eax, eax
je 0x40bcbd
push dword [ebp - 0x45c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
jne 0x40bc84
push 0x104
lea ecx, [ebp - 0x45c]
call fcn.00401c03
push 0x104
lea ecx, [ebp - 0x45c]
mov esi, eax
call fcn.00401d22
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0x45c]
call ebx
test eax, eax
jne 0x40bca9
mov esi, str.c:DriversBackup
push esi
call fcn.0045631c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x45c]
call fcn.00401d4a
mov eax, dword [ebp - 0x45c]
xor ebx, ebx
mov dword [ebp - 0x438], eax
mov byte [ebp - 0x430], bl
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x458]
call fcn.0040c724
cmp eax, 1
jne 0x40bd4e
call fcn.004031a6
push str.DriversBackup
lea ecx, [ebp - 0x464]
call fcn.00401de7
lea eax, [ebp - 0x226]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x460]
call fcn.00401de7
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x460]
cmp dword [eax - 0xc], 3
jne 0x40bd24
mov eax, dword [ebp - 0x464]
lea ecx, [ebp - 0x460]
push dword [eax - 0xc]
push eax
call fcn.0040c811
lea eax, [ebp - 0x460]
mov ecx, edi
push eax
call fcn.0041b1ad
mov ecx, dword [ebp - 0x460]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x464]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x45c]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp - 0x470]
test ecx, ecx
je 0x40bd8c
mov eax, dword [ebp - 0x468]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.004036ce
pop ecx
pop ecx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
call fcn.0044bae4
ret 0x10