joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf76f95d
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
ret

Function at 0xf770de7
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x11
sub esp, 0x58
push esi
push edi
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov word [ebp - 0x28], ax
push ecx
mov dword [ebp - 0x58], 0x44
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0xf770e52
cmp esi, 0xffffffff
je 0xf770e3a
imul esi, esi, 0x3e8
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xf770e56
cmp eax, 0x102
je 0xf770e52
cmp eax, 0xffffffff
xor eax, eax
jmp 0xf770e72
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0xf770e6d
cmp dword [ebp - 4], 0
jne 0xf770e52
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0xf775d9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push ebp
push dword [esp + 0x1c]
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0xf775dce
push edi
push 0x146
call fcn.0f775d5a
pop ebp
pop edi
pop esi
pop ebx
ret 0x14
push ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [esi + 4]
call ebp
mov ebp, eax
test ebp, ebp
jne 0xf775de7
mov eax, 7
jmp 0xf775dc7
mov edi, dword [esp + 0x20]
test edi, edi
je 0xf775dfb
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi], eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x24]
cmp eax, 1
mov dword [ecx], eax
sbb eax, eax
and eax, 7
jmp 0xf775dc7
Function at 0xf777fe8
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0xf7ae5ac]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0xf77802f
push 3
mov eax, dword [0xf7ae5ac]
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [0xf7ae5ac]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0xf77802e
push 9
mov eax, dword [0xf7ae5ac]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
push 5
push str.taskman.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0xf77802e

Function at 0xf77adf6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor bx, bx
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
inc eax
shr eax, 1
test eax, eax
je 0xf77ae16
xor bx, word [esi]
add esi, 2
dec eax
jne 0xf77ae0d
mov ax, bx
pop esi
shr ax, 8
xor al, bl
pop ebx
ret 4
Function at 0xf7817ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
cmp ebx, esi
jne 0xf781812
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 0
mov byte [ebx], 0
jne 0xf781845
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
push eax
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf78183e
mov dword [ebp + 0x14], edi
test eax, eax
je 0xf78183e
xor eax, eax
jmp 0xf781809
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.0f772013
push dword [ebp - 0xc]
push str.CLSID_s
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x94]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0x14], eax
test eax, eax
je 0xf7818a4
push dword [ebp + 0x10]
push ebx
push 0x7ea1
push dword [0xf7ae6d4]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
je 0xf7818e6
push edi
call dword [sym.imp.ole32.dll_CoIsOle1Class]
test eax, eax
je 0xf7818e6
lea eax, [ebp - 0x10]
mov esi, 1
push eax
push edi
call fcn.0f772097
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0xf7818e6
mov dword [ebp - 4], 0
test esi, esi
je 0xf7818f8
push dword [ebp - 0x10]
mov eax, dword [0xf7ae6f8]
push eax
mov ebx, dword [eax]
call dword [ebx + 0x14]
push dword [ebp - 0xc]
mov eax, dword [0xf7ae6f8]
push eax
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp dword [ebp - 8], 0
je 0xf781915
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
jmp 0xf781809

Function at 0xf783b00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push ebp
xor ebp, ebp
lea esi, [edi + 0xa8]
lea eax, [ebp + 0x38]
push 0x20
or eax, dword [esp + 0x20]
push esi
push eax
add esi, 0x20
push ebx
inc ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [esi - 1], 0
cmp ebp, 0xc
jl 0xf783b14
xor ebp, ebp
add edi, 0x228
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 8
lea eax, [ebp + 0x44]
or eax, dword [esp + 0x20]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [edi + 7], 0
push edi
call esi
lea eax, [eax + edi - 1]
cmp byte [eax], 0x2e
jne 0xf783b66
mov byte [eax], 0
add edi, 8
inc ebp
cmp ebp, 0xc
jl 0xf783b41
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0xf783b76
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
add eax, 0x288
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
push 0x20
push eax
mov eax, dword [esp + 0x28]
mov edi, 1
or al, 0x30
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [esp + 0x1c]
mov byte [eax + 0x2a7], 0
lea ebp, [eax + 0x2a8]
lea eax, [edi + 0x29]
push 0x20
or eax, dword [esp + 0x24]
push ebp
push eax
add ebp, 0x20
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [ebp - 1], 0
cmp edi, 7
jl 0xf783bb1
mov edi, dword [esp + 0x1c]
push 8
add edi, 0x368
mov eax, dword [esp + 0x24]
push edi
or al, 0x37
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x1c]
sub eax, eax
mov byte [ecx + 0x36f], 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
not ecx
lea eax, [eax + ecx + 0x366]
cmp byte [eax], 0x2e
jne 0xf783c14
mov byte [eax], 0
mov ebp, 8
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], 1
add ebx, 0x370
mov eax, dword [esp + 0x10]
push 8
push ebx
add eax, 0x30
or eax, dword [esp + 0x28]
mov edi, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0xffffffff
sub eax, eax
mov byte [ebx + 7], 0
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
not ecx
lea eax, [edx + ecx - 2]
lea eax, [eax + ebp + 0x368]
cmp byte [eax], 0x2e
jne 0xf783c69
mov byte [eax], 0
add ebp, 8
add ebx, 8
inc dword [esp + 0x10]
cmp ebp, 0x38
jl 0xf783c2b
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0xc

Function at 0xf783c82
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push ebp
xor ebp, ebp
lea ebx, [edi + 0x3a0]
lea eax, [ebp + 0x38]
push 0x20
or eax, dword [esp + 0x20]
push ebx
push eax
add ebx, 0x20
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [ebx - 1], 0
cmp ebp, 0xc
jl 0xf783c96
xor ebx, ebx
add edi, 0x520
lea eax, [ebx + 0x44]
push 8
or eax, dword [esp + 0x20]
push edi
push eax
add edi, 8
push esi
inc ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [edi - 1], 0
cmp ebx, 0xc
jl 0xf783cbd
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0xf783ce3
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 0x20
lea eax, [esi + 0x580]
mov edi, dword [esp + 0x18]
push eax
mov ebx, 1
mov eax, dword [esp + 0x24]
lea ebp, [esi + 0x5a0]
or al, 0x30
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [esi + 0x59f], 0
lea eax, [ebx + 0x29]
push 0x20
or eax, dword [esp + 0x20]
push ebp
push eax
add ebp, 0x20
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [ebp - 1], 0
cmp ebx, 7
jl 0xf783d18
push 8
lea eax, [esi + 0x660]
push eax
mov ebp, 1
mov eax, dword [esp + 0x24]
add esi, 0x668
or al, 0x37
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [esi - 1], 0
lea eax, [ebp + 0x30]
push 8
or eax, dword [esp + 0x20]
push esi
push eax
add esi, 8
push edi
inc ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [esi - 1], 0
cmp ebp, 7
jl 0xf783d5d
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0xf785ccc
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x11
sub esp, 0x54
push ebx
push esi
push edi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov eax, dword [ebp + 0xc]
cmp word [eax], 0xa
jne 0xf785d9b
cmp dword [eax + 8], 0x80020004
jne 0xf785d9b
mov word [ebp - 0x24], 2
push dword [ebp + 8]
call fcn.0f79702e
cmp dword [0xf7ae760], 0
mov esi, eax
je 0xf785e19
mov eax, 0
test esi, esi
je 0xf785d34
mov eax, dword [esi - 4]
shr eax, 1
push 0
inc eax
push 0
push 0
push 0
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0xf785db6
push 0xe
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jne 0xf785e52
cmp ebx, 2
je 0xf785e3d
cmp ebx, 3
je 0xf785e44
cmp ebx, 8
je 0xf785e4b
cmp ebx, 0xe
je 0xf785e4b
push 5
call fcn.0f72689c
push eax
call fcn.0f7348f7
mov word [ebp - 0x24], ax
cmp ax, 9
jbe 0xf785d0f
push 5
call fcn.0f72689c
push edi
call fcn.0f726e61
mov ebx, eax
test ebx, ebx
jne 0xf785dce
push 0xe
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0xf785d59
mov eax, 0
test esi, esi
je 0xf785ddc
mov eax, dword [esi - 4]
shr eax, 1
push 0
inc eax
push 0
push edi
push ebx
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x54]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
push ebx
call fcn.0f726e12
jmp 0xf785d59
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x54]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
jmp 0xf785d59
push 0x35
call fcn.0f72689c
push 0x4c
call fcn.0f72689c
push 7
call fcn.0f72689c
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xf785f28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x100
push esi
push edi
xor esi, esi
cmp eax, esi
je 0xf786052
mov esi, dword [eax - 4]
shr esi, 1
push esi
push eax
call fcn.0f78610f
mov esi, eax
test esi, esi
jne 0xf786034
cmp dword [0xf7ae7a8], 0
je 0xf786052
mov eax, dword [0xf7ae7a8]
push eax
call fcn.0f786bd1
mov esi, eax
test esi, esi
jne 0xf786034
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [ebp - 0xec]
mov al, byte [ebp - 0x70]
mov dl, byte [ebp - 0x6f]
mov byte [0xf7baa40], cl
mov byte [0xf7baa41], al
mov byte [0xf7baa42], dl
cmp dword [0xf7ae760], 0
jne 0xf786014
test cl, cl
je 0xf78605c
push 0
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0x14
call edi
push 0
push 2
push 0
push 0x14
call edi
cmp byte [0xf7baa41], 0
je 0xf785ff1
push 0
push 0
push 0
push 0x90
call edi
push 0
push 2
push 0
push 0x90
call edi
cmp byte [0xf7baa42], 0
je 0xf786014
push 0
push 0
push 0
push 0x91
call edi
push 0
push 2
push 0
push 0x91
call edi
xor eax, eax
lea ecx, [ebp - 0x100]
push ecx
mov byte [ebp - 0xec], al
mov byte [ebp - 0x70], al
mov byte [ebp - 0x6f], al
call dword [sym.imp.USER32.dll_SetKeyboardState]
call fcn.0f786d42
cmp dword [0xf7ae7a8], 0
je 0xf786052
mov eax, dword [0xf7ae7a8]
push eax
call fcn.0f722929
mov dword [0xf7ae7a8], 0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.USER32.dll_keybd_event]
jmp 0xf785fce
Function at 0xf7893d9
Capabilities:
Set registry value

Disassembly:
sub esp, 4
cmp dword [0xf7ae760], 0
push ebx
push esi
push edi
push ebp
je 0xf7894ad
mov edi, dword [esp + 0x28]
push 0
push 0
push 0
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push dword [esp + 0x38]
push 0
push 0
call ebx
mov ebp, eax
test edi, edi
je 0xf789423
test ebp, ebp
jne 0xf789423
mov eax, 0xe
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x14
lea eax, [ebp + 1]
push eax
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf789439
mov eax, 0xe
jmp 0xf789419
test edi, edi
je 0xf78945f
push 0
push 0
push ebp
push esi
push edi
push dword [esp + 0x38]
push 0
push 0
call ebx
test eax, eax
jne 0xf78945f
push esi
call fcn.0f726e12
mov eax, 0xe
jmp 0xf789419
lea edx, [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov byte [esi + ebp], 0
call fcn.0f79d30d
test eax, eax
jge 0xf789481
push esi
call fcn.0f726e12
mov eax, 0xe
jmp 0xf789419
push ebp
push esi
push dword [esp + 0x28]
push dword [esp + 0x1c]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, eax
push esi
call fcn.0f726e12
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, edi
jmp 0xf789419
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
jmp 0xf789419

Function at 0xf7894cc
Capabilities:
Set registry value

Disassembly:
sub esp, 4
cmp dword [0xf7ae760], 0
push ebx
push esi
push edi
push ebp
je 0xf7895db
mov eax, dword [esp + 0x24]
cmp eax, 1
jb 0xf7894f3
cmp eax, 2
jbe 0xf789523
cmp eax, 7
je 0xf789523
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
xor edi, edi
lea edx, [esp + 0x10]
mov ecx, dword [esp + 0x1c]
call fcn.0f79d30d
test eax, eax
jge 0xf7895aa
test edi, edi
je 0xf78951c
push esi
call fcn.0f726e12
mov eax, 0xe
jmp 0xf78955d
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0xf789537
mov esi, dword [esp + 0x28]
xor edi, edi
mov ebx, dword [esp + 0x10]
jmp 0xf7894fd
mov ebp, edi
push 0
shr ebp, 1
push 0
push 0
push 0
push ebp
push dword [esp + 0x3c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
jne 0xf789567
mov eax, 0xe
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x18
push edi
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf78957a
mov eax, 0xe
jmp 0xf78955d
push 0
push 0
push ebx
push esi
push ebp
push dword [esp + 0x3c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0xf7895a0
push esi
call fcn.0f726e12
mov eax, 0xe
jmp 0xf78955d
mov edi, 1
jmp 0xf7894fd
push ebx
push esi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x20]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test edi, edi
je 0xf7895ce
push esi
call fcn.0f726e12
mov ecx, dword [esp + 0x10]
call fcn.0f79d382
mov eax, ebx
jmp 0xf78955d
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0xf78955d
Function at 0xf7895fe
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [0xf7ae760], 0
je 0xf789660
mov eax, dword [ebp + 0xc]
push 0
test eax, eax
je 0xf789655
push 0
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0xf789643
mov eax, 0xe
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0xf78963d
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0xf78963d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0xf78963d

Function at 0xf78966e
Capabilities:
Delete registry value

Disassembly:
cmp dword [0xf7ae760], 0
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
je 0xf7896da
call dword [sym.imp.MSVCRT20.dll_wcslen]
add esp, 4
lea edi, [eax*2 + 2]
push edi
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf7896a6
mov eax, 0xe
pop edi
pop esi
pop ebp
ret 8
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
mov edi, 0xe
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0xf7896d0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
push esi
call fcn.0f726e12
mov eax, edi
jmp 0xf7896a0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0xf7896a0
Function at 0xf789c89
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, dword [esp + 0x1c]
cmp dword [0xf7bac78], esi
je 0xf789d02
lea eax, [esp + 8]
push 0x10
mov dword [0xf7aebe0], 0
push eax
push 0x1004
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf789cfc
lea eax, [esp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_atoi]
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0xf789cfc
lea eax, [esp + 8]
push 0
push 0
push 0x10
push eax
push 1
push 0xf7bac7c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jne 0xf789cfc
mov dword [0xf7aebe0], edi
mov dword [0xf7bac78], esi
mov eax, dword [0xf7aebe0]
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0xf791ee5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov word [ebp - 0x14], 0
push ebx
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [ebp + 8]
call fcn.0f73651e
cmp word [eax], 1
mov esi, eax
jne 0xf791f12
push 0x5e
call fcn.0f72689c
cmp word [esi], 8
je 0xf791f1f
push 0xd
call fcn.0f72689c
push dword [esi + 8]
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0f7927d7
lea ecx, [ebp - 0x234]
lea edx, [ebp - 0x11c]
push ecx
push edx
call dword [sym.imp.MSVCRT20.dll__findfirst]
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0xf791f53
push 0x35
call fcn.0f72689c
test byte [ebp - 0x234], 0x16
je 0xf791f8f
mov esi, 0x16
lea eax, [ebp - 0x234]
push eax
push ebx
call dword [sym.imp.MSVCRT20.dll__findnext]
add esp, 8
test eax, eax
je 0xf791f87
push ebx
call dword [sym.imp.MSVCRT20.dll__findclose]
add esp, 4
push 0x35
call fcn.0f72689c
test dword [ebp - 0x234], esi
jne 0xf791f61
push 0x5c
lea eax, [ebp - 0x11c]
push eax
call fcn.0f78781d
add esp, 8
inc eax
mov dword [ebp - 4], eax
test byte [ebp - 0x234], 0x16
jne 0xf792039
lea edi, [ebp - 0x220]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
not ecx
lea edx, [ecx + eax - 1]
lea ecx, [ebp - 0x18]
cmp edx, ecx
jbe 0xf791fd7
push 0x35
call fcn.0f72689c
lea edi, [ebp - 0x220]
mov ecx, 0xffffffff
sub eax, eax
push 7
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0f7903d2
test eax, eax
je 0xf792016
push 0x37
call fcn.0f72689c
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT20.dll_remove]
add esp, 4
test eax, eax
je 0xf792039
call fcn.0f7907dd
test eax, eax
je 0xf792039
push eax
call fcn.0f72689c
lea eax, [ebp - 0x234]
push eax
push ebx
call dword [sym.imp.MSVCRT20.dll__findnext]
add esp, 8
test eax, eax
je 0xf791fa4
push ebx
call dword [sym.imp.MSVCRT20.dll__findclose]
add esp, 4
push 0xf7ae740
call fcn.0f7a212f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xf792238
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
push esi
push pe_nt_image_headers32
push 3
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
mov edi, eax
jne 0xf792273
call fcn.0f7907dd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x40000000
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov ebx, eax
jne 0xf79229f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0f7907dd
jmp 0xf79226a
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0xf7922cd
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0xf7922d4
call fcn.0f7907dd
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ebx
call edi
mov eax, esi
jmp 0xf79226a

Function at 0xf7923f7
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
je 0xf792425
cmp word [esi], 0
je 0xf792425
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jbe 0xf79242c
push 0x35
call fcn.0f72689c
push 1
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0f79265e
mov si, word [ebp + 0xc]
mov ax, si
or al, 0x27
cmp ax, 0x27
je 0xf792451
push 5
call fcn.0f72689c
test si, si
jne 0xf79245a
mov si, pe_nt_image_headers32
movsx eax, si
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0xf79249e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0xf79248f
call esi
cmp eax, 0x35
je 0xf79248f
call esi
cmp eax, 0x57
mov eax, 0x35
jne 0xf792494
mov eax, 0x4b
test eax, eax
je 0xf79249e
push eax
call fcn.0f72689c
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0xf7924a6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0xf792534
cmp word [eax], 0
je 0xf792534
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0f7927f1
test eax, eax
jne 0xf7924eb
push 0xf7bb1cc
lea eax, [ebp - 0x108]
push eax
call fcn.0f7878d2
add esp, 8
test eax, eax
je 0xf7924f1
mov eax, 0x34
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0xf792529
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0xf792534
cmp eax, 3
je 0xf792522
cmp eax, 0x35
je 0xf792534
mov eax, 5
jmp 0xf7924eb
mov eax, 0x4c
jmp 0xf7924eb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0xf7924eb
mov eax, 0x35
jmp 0xf7924eb