joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003efc
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.10001b6c
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x100040dd
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x10005084
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x100050cc
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.10001b64
push eax
mov eax, dword [ebp + 0x14]
call fcn.10001b7c
pop edx
call fcn.10003de4
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x10003f98
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x10003fae
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x100040c7
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x10003fcb
cmp dword [ebp + 0xc], 0
je 0x10004047
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x10003ff1
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x10003fd3
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.100039f8
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.100039f8
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.10003a24
pop ecx
mov eax, dword [esi]
call fcn.100039f8
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.100039f8
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x100040b8
cmp byte [ebp + 8], 0
jne 0x1000409f
mov edi, ebx
mov eax, dword [edi]
call fcn.100039f8
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.100039f8
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.10003a24
pop ecx
mov eax, dword [esi]
call fcn.100039f8
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.100039f8
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x100040b8
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.10003a24
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x10003fc1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100040e4
lea eax, [ebp + 0x14]
call fcn.10001a70
ret
Function at 0x1000423c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov eax, 0x100041e4
call fcn.10002388
xor eax, eax
push ebp
push 0x10004411
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x10004266
push 0xa
push 0x10004420
mov eax, dword [0x1000711c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x100043f9
push ebx
mov eax, dword [0x1000711c]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x100043f9
push ebx
mov eax, dword [0x1000711c]
push eax
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x100043f9
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x100043f9
push esi
mov eax, 0x10008070
mov ecx, 1
mov edx, dword [0x10004198]
call fcn.10002170
add esp, 4
mov eax, dword [0x10008070]
mov ecx, esi
mov edx, ebx
call fcn.100024c4
push 0
push 0
mov eax, dword [0x10008070]
mov ecx, 0x10004430
mov edx, esi
call fcn.100040f0
mov dl, 1
mov eax, dword [0x100029e8]
call fcn.10001474
mov ebx, eax
mov dl, 1
mov eax, dword [0x100029e8]
call fcn.10001474
mov dword [0x10008074], eax
mov edx, dword [0x10008070]
mov ecx, esi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
push 0
push 0
mov eax, ebx
call fcn.10002a84
mov eax, dword [0x1000806c]
push eax
mov eax, 0x10008070
mov ecx, 1
mov edx, dword [0x10004198]
call fcn.10002170
add esp, 4
mov edx, dword [0x10008070]
mov ecx, dword [0x1000806c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [0x10008074]
mov eax, ebx
call fcn.100038e0
push 0
mov eax, 0x10008070
mov ecx, 1
mov edx, dword [0x10004198]
call fcn.10002170
add esp, 4
mov eax, dword [0x10008074]
mov edx, dword [eax]
call dword [edx]
mov dword [0x1000806c], eax
mov eax, dword [0x1000806c]
push eax
mov eax, 0x10008070
mov ecx, 1
mov edx, dword [0x10004198]
call fcn.10002170
add esp, 4
push 0
push 0
mov eax, dword [0x10008074]
call fcn.10002a84
mov edx, dword [0x10008070]
mov ecx, dword [0x1000806c]
mov eax, dword [0x10008074]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.100014a4
mov eax, dword [0x10008074]
call fcn.100014a4
mov eax, dword [0x10008070]
call fcn.10002610
call fcn.10001988
jmp 0x10004403
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10004418
ret
Function at 0x1001da89
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c00c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edi
lea eax, [edi + 0x2d58]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
xor esi, esi
push esi
mov dword [edi + 0x2d4c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x26
push ebx
mov dword [esp + 0x18], ebx
call ebp
xor ecx, ecx
shr eax, 8
inc ecx
and eax, ecx
cmp dword [sym.imp.USER32.dll_UpdateLayeredWindow], esi
je 0x1001daea
test eax, eax
jne 0x1001daea
mov dword [edi + 0x2d4c], ecx
mov dword [edi + 0x2894], 4
cmp dword [edi + 0x2d4c], esi
je 0x1001db28
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.10020ff5
mov dword [edi + 0x34], 1
mov dword [edi + 0x2898], esi
jmp 0x1001dbd6
mov dword [edi + 0x2898], ecx
test eax, eax
je 0x1001dbbc
push 0x6a
push ebx
call ebp
push 0x68
push ebx
mov esi, eax
call ebp
mov ebx, eax
sub ebx, esi
xor esi, esi
push esi
push esi
push esi
push esi
push edi
call fcn.10020ff5
add esp, 0x14
mov eax, esi
test ebx, ebx
jle 0x1001db6b
lea ecx, [edi + 0x2934]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
cmp eax, ebx
jl 0x1001db61
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.1001bf02
lea esi, [edi + 0x2934]
mov ebp, eax
push esi
lea ebx, [edi + 0x44]
add edi, 0x2494
push ebx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1001ba6e
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov dword [eax + 0x40], esi
xor esi, esi
mov dword [eax + 0x38], ebx
mov ebx, dword [esp + 0x10]
mov dword [eax + 0x20], 1
mov dword [eax + 0x2c], edi
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x2d54], esi
jmp 0x1001dbd9
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.10020ff5
add esp, 0x14
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.JAVA2D_DPIAWARE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x1001dc0d
call fcn.10020ff5
movss xmm0, dword [0x10027834]
fstp dword [esp]
comiss xmm0, dword [esp]
ja 0x1001dc1f
jmp 0x1001dc40
push eax
push str.true
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1001dc40
push str.user32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x1001dc40
push str.SetProcessDPIAware
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1001dc40
call eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10020582
add esp, 0x18
ret
Function at 0x10020ff5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10021004
pop dword [ebp - 0x48]
mov eax, 0xfb400f5
sub eax, 0xffb1f0f1
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xa6aba901
sub dword [ebp - 0x58], 0x585963b6
mov dword [ebp - 0x54], 0x125afc2b
add dword [ebp - 0x54], 0x1fd8501a
mov dword [ebp - 0x50], 0x2235590a
sub dword [ebp - 0x50], 0xd5e914dc
mov dword [ebp - 0x4c], 0x96e0e8b0
sub dword [ebp - 0x4c], 0x96e0e8b0
lea eax, [ebp - 0x58]
push eax
mov eax, 0x35f86c18
sub eax, 0x25f64bd4
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x81e23bf9
sub dword [ebp - 0x58], 0xd6fd2a3
mov dword [ebp - 0x54], 0xa56b9ef2
sub dword [ebp - 0x54], 0x63ff3d7d
mov dword [ebp - 0x50], 0xb248b2b6
sub dword [ebp - 0x50], 0x4ed9464a
mov dword [ebp - 0x4c], 0xcc78036d
sub dword [ebp - 0x4c], 0xcc78036d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xee3616de
add eax, 0x21cc0962
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a086
push 0
call eax
mov ecx, 0x4fb3
xor edx, edx
add edx, eax
mov esi, 0x39fcc5a7
add esi, 0xd6065659
add esi, dword [ebp - 0x48]
mov ebx, 0x89a1ea36
add ebx, 0x40886e41
sub dword [ebp - 4], 0xb72b9df5
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0x34], 0x38237595
mov dword [edx], edi
add dword [ebp - 0x18], 0xe7726a60
add edx, 0xf337686c
sub edx, 0xf3376868
add esi, 0xc98a470d
sub esi, 0xc98a4709
loop 0x10021122
add eax, 0xe82d7d6e
add eax, 0x17d3b431
xor ebx, ebx
add ebx, eax
add eax, 0x4dcb798d
add eax, 0xb2348678
mov ecx, 0x79935176
add ecx, 0x966cae8a
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x6ee02a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6ee02aeb
cmp byte [esi + ebx - 1], 0xa
je 0x6ee02abf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6ee04118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402640
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x414]
mov esi, str.c:windows_system32cmd.exe__k
push ebx
lea ebx, [ebp - 0x5d0]
push ecx
sub esp, 0x5e8
call fcn.004016b0
xor eax, eax
mov ecx, 0xff
xor edx, edx
rep stosd dword es:[edi], eax
mov ecx, 0xf
mov edi, ebx
mov dword [ebp - 0x418], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x594]
mov ecx, 0x1e
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x418]
mov ecx, dword [eax + edx*4]
mov byte [esi + edx], cl
add edx, 1
cmp edx, 0x1e
jne 0x4026a0
lea edi, [ebp - 0x51c]
mov byte [ebp - 0x3fa], 0
mov dword [ebp - 0x5da], 0x7478742e
mov byte [ebp - 0x5d6], 0
mov dword [ebp - 0x5d5], 0x6e65706f
mov byte [ebp - 0x5d1], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
je 0x402773
mov dword [esp + 4], 0x2e
mov dword [esp], edi
call sub.msvcrt.dll_strrchr
mov edx, eax
test eax, eax
je 0x402828
mov eax, dword [ebp - 0x5da]
mov dword [edx], eax
movzx eax, byte [ebp - 0x5d6]
mov byte [edx + 4], al
mov dword [esp], edi
mov dword [esp + 4], 0x404045
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x402773
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
mov dword [esp], esi
call sub.msvcrt.dll_fgets
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x404047
mov dword [esp], esi
call sub.msvcrt.dll_strcspn
mov byte [ebp + eax - 0x418], 0
mov dword [esp + 4], 0x20
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4027f1
lea edx, [ebp - 0x5d5]
mov byte [eax], 0
add eax, 1
mov dword [ebp - 0x5d0], 0x3c
mov dword [ebp - 0x5cc], 0x40
mov dword [ebp - 0x5c8], 0
mov dword [ebp - 0x5c4], edx
mov dword [ebp - 0x5c0], esi
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0x5b4], 1
mov dword [esp], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea eax, [ebp - 0x5d5]
mov dword [ebp - 0x5c0], esi
mov dword [ebp - 0x5c4], eax
mov eax, 0x404044
mov dword [ebp - 0x5d0], 0x3c
mov dword [ebp - 0x5cc], 0x40
mov dword [ebp - 0x5c8], 0
jmp 0x4027bd
lea eax, [ebp - 0x5da]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
jmp 0x402729
Function at 0x10001de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10001df3
pop dword [ebp - 0x50]
mov eax, 0xae1736be
sub eax, 0x9e1718cb
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x98772c7d
add dword [ebp - 0x60], 0xb5db18ce
mov dword [ebp - 0x5c], 0xace9f8ed
add dword [ebp - 0x5c], 0x85495358
mov dword [ebp - 0x58], 0x5e5fe4f0
add dword [ebp - 0x58], 0xedec5f3e
mov dword [ebp - 0x54], 0xb8c496bf
sub dword [ebp - 0x54], 0xb8c496bf
lea eax, [ebp - 0x60]
push eax
mov eax, 0x1b0ecd38
sub eax, 0xb0e9d34
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x3f0659f
sub dword [ebp - 0x60], 0x8f7dfc49
mov dword [ebp - 0x5c], 0xea39433c
sub dword [ebp - 0x5c], 0xa8cce1c7
mov dword [ebp - 0x58], 0x66adfaef
add dword [ebp - 0x58], 0xfcc1717d
mov dword [ebp - 0x54], 0x63f42fb4
add dword [ebp - 0x54], 0x9c0bd04c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xba55f720
sub eax, 0xaa55c714
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x393a0
push 0
call eax
mov ecx, 0x52fa
mov ebx, eax
mov edx, 0x728af6c7
sub edx, 0x628a92c7
add edx, dword [ebp - 0x50]
mov edi, 0x7eaea861
sub edi, 0x1f1cf8ff
sub dword [ebp - 0x2c], 0xa58e874d
mov esi, dword [edx]
xor esi, edi
add dword [ebp - 0x34], 0x71381940
mov dword [ebx], esi
add dword [ebp - 0x3c], 0xa1f21208
add ebx, 4
add edx, 0x92c60450
sub edx, 0x92c6044c
loop 0x10001f0f
add eax, 0x97c6174f
add eax, 0x683b276c
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401515
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401c08
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
sub esp, 0x54
push ebx
xor ebx, ebx
push edi
cmp dword [eax - 0xc], ebx
je 0x401d84
mov eax, dword [0x459100]
mov ecx, 0x459100
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push 0x449bb0
lea eax, [ebp - 8]
call fcn.00404558
lea edi, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0040a224
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040464c
push 0x449bb8
mov eax, edi
push eax
call fcn.00402105
mov edi, dword [ebp - 4]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x401c90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
jmp 0x401d7f
mov eax, dword [0x459100]
mov ecx, 0x459100
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
push edi
lea eax, [ebp - 8]
call fcn.00401fac
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_nrd___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
cmp byte [esi + 9], bl
jne 0x401cbb
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push dword [ebp - 8]
push dword [ebp - 8]
push dword [esi]
push dword [esi]
push dword [esi]
push eax
lea eax, [ebp - 0xc]
call fcn.004022a0
mov edi, dword [ebp - 0xc]
add esp, 0x18
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [edi - 0xc]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040464c
lea eax, [edi - 0x10]
call fcn.0040464c
cmp dword [ebp - 0x18], ebx
je 0x401d09
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 4]
lea edi, [ebp - 0xc]
call fcn.00409ef5
cmp byte [esi + 8], bl
jne 0x401d30
mov edi, dword [ebp - 0xc]
push ebx
push edi
push ebx
push dword [ebp - 4]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401d71
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.00431420
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
add esp, 0xc
mov dword [ebp - 0x54], edi
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], 0x500
mov dword [ebp - 0x48], str.runas
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [edi - 0x10]
call fcn.0040464c
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040464c
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.0040464c
mov eax, dword [esi]
sub eax, 0x10
call fcn.0040464c
pop edi
pop ebx
leave
ret
Function at 0x40300d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40301b
push 0xd
pop eax
jmp 0x40304e
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x403022
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40344e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x457090]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
mov dword [ebp - 0x21c], eax
xor esi, esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040341b
mov ebx, eax
cmp ebx, esi
je 0x4034b6
cmp dword [ebp - 0x214], esi
je 0x4034af
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x403551
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4034de
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040344e
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x403562
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x4034be
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], esi
je 0x403529
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x40354f
push dword [ebp - 0x214]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004313fb
leave
ret 4
cmp dword [ebp - 0x214], esi
je 0x403576
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x403551
Function at 0x403ed6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x457090]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push ebx
mov ebx, dword [ebp + 0x3a0]
push esi
push edi
xor esi, esi
push 2
push esi
push eax
mov edi, edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x74], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x78], eax
cmp eax, esi
jne 0x403f2a
call fcn.00402b1c
mov esi, eax
jmp 0x403fe8
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x403f43
call fcn.00402b1c
jmp 0x403fdd
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x403f39
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x403f7d
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x74], eax
je 0x403f76
lea eax, [ebp - 0x74]
call fcn.00402b13
mov eax, 0x8007000e
jmp 0x403ffa
push 2
push eax
call fcn.00403072
pop ecx
pop ecx
cmp eax, 0x400
jbe 0x403f9a
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00402fec
jmp 0x403fa0
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], esi
jne 0x403fac
mov esi, 0x8007000e
jmp 0x403fdf
push edi
push dword [ebp - 0x74]
push edi
push ebx
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x403f39
mov edx, dword [ebp - 0x74]
push dword [ebp + 0x3a4]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x74]
lea edx, [ebp - 0x80]
call fcn.00403d8e
mov esi, eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x74], eax
je 0x403ff8
lea eax, [ebp - 0x74]
call fcn.00402b13
mov eax, esi
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004313fb
add ebp, 0x394
leave
ret 0xc

Function at 0x40423c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404253
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x404288
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x404284
cmp edi, eax
jae 0x404288
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x404276
cmp edi, eax
jb 0x40428c
xor eax, eax
jmp 0x404295
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret