joyce8/EMBER2024-capa huggingface dataset:
Function at 0x665594
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x6655ad
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x6655e1
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0066545c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x66ab84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x66ac47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x66ac2a
test bl, 0x10
je 0x66ac2a
lea ecx, [ebp - 4]
mov edx, 0x66ac64
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x66ac88
mov eax, 0x66aca4
call fcn.005bbb1c
mov edx, 0x66acd0
mov eax, dword [ebp - 8]
call fcn.00423d10
test eax, eax
jne 0x66ac2a
mov eax, dword [ebp - 4]
call fcn.00425184
lea ecx, [ebp - 0xc]
mov edx, 0x66ad2c
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 0xc]
call fcn.00425184
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040b88c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ac4e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x66bb50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x66bc2c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005febd4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x66bc48
call fcn.00607ea8
mov eax, dword [0x6b7630]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.0049a7d0
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x66bbc3
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0061ea14
test al, al
jne 0x66bc14
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x66bbf9
mov eax, 0x66bc98
call fcn.00607c20
jmp 0x66bc14
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x66bd38
call fcn.00607ea8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66bc33
lea eax, [ebp - 0x1c]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x66e134
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x66e2c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005b9cdc
lea eax, [ebp - 0x258]
mov edx, 0x66e2dc
call fcn.0040ba80
mov eax, dword [ebp - 0x258]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x66e298
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.0040b928
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x66e1c7
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x66e20c
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040bca8
mov eax, dword [ebp - 0x25c]
mov edx, 0x66e300
call fcn.00423d10
test eax, eax
jne 0x66e20c
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e20e
xor eax, eax
test al, al
je 0x66e225
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e227
xor eax, eax
test al, al
je 0x66e23e
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e240
xor eax, eax
test al, al
je 0x66e27d
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x66e27d
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.0040bca8
mov eax, dword [ebp - 0x260]
call fcn.00424b4c
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x66e1a8
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66e2c7
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.0040a8cc
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x67d284
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.0067d158
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x6bf810]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408bcc
cmp ebx, 0x6c840001
jne 0x67d2e4
call fcn.0042b504
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x67d308
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d3bc
call fcn.005fe9c0
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x67d35e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x67d35e
dec eax
sub ax, 2
jb 0x67d372
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d41c
call fcn.005fe9c0
push 0x1cff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x67d313
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x67e108
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.0067e184
call fcn.0040704c
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.0067e184
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.0067e13c
mov eax, esi
pop edx
pop esi
pop ebx
ret

Function at 0x687168
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6871ee
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6871d4
mov ebx, esi
test ebx, ebx
je 0x68719a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x68720c
call fcn.0040bad8
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6871d6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6871f5
lea eax, [ebp - 8]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x68d76c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x68d776
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x68d82c
push 0x68d860
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
mov ebx, eax
test ebx, ebx
je 0x68d815
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x68d815
test al, 0x10
je 0x68d7c6
mov ebp, 0x2000000
jmp 0x68d7c8
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x68d815
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x68d815
cmp ebx, 0xff0
jge 0x68d815
mov edx, edi
mov eax, esp
call fcn.0068d684
jmp 0x68d81e
mov eax, edi
mov edx, esi
call fcn.0040ac5c
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x68d87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68d90b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jle 0x68d8df
cmp eax, 0x104
jge 0x68d8df
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b928
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0068d76c
jmp 0x68d8f0
mov eax, 0x68d924
call fcn.005feb78
mov eax, ebx
call fcn.0040a86c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68d912
lea eax, [ebp - 0x20c]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x68d94c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68dadb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov eax, ebx
call fcn.005ba204
mov esi, dword [ebp - 0x4c]
mov edx, 0x68daf8
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x50]
call fcn.00423d10
test eax, eax
sete al
test al, al
jne 0x68d9a5
mov eax, 0x68db10
call fcn.005fe964
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0068d76c
lea eax, [ebp - 8]
call fcn.0068d87c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407d24
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x68db58
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040b88c
mov dword [ebp - 0x38], eax
mov eax, edi
call fcn.0040b88c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040b88c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x68da2b
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x68da21
call fcn.0042b4e4
mov eax, 0x68db70
call fcn.005feac0
cmp dword [ebp - 0x10], 0
jne 0x68da3b
mov eax, 0x68db9c
call fcn.005fe964
xor edx, edx
push ebp
push 0x68daaf
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0068d558
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x68da49
cmp eax, 0xffffffff
jne 0x68da76
mov eax, 0x68dbf0
call fcn.005feac0
call fcn.0068d558
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x68da96
mov eax, 0x68dc30
call fcn.005feac0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68dab6
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax

Function at 0x697300
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x6bfbd9], 1
call fcn.006015a4
test al, al
jne 0x697352
push 5
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0x15c]
mov cl, 2
xor edx, edx
call fcn.00697008
ret
Function at 0x69ace8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x69ad0d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x69cbb8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x69cbe4
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x69cbed
call fcn.0069b794
mov eax, 0xa
call fcn.005bddf8
call fcn.0069b794
call fcn.0069cb84
test al, al
jne 0x69cbc2
pop ebx
ret

Function at 0x69d118
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x6b74dc]
cmp dword [eax], 0
je 0x69d1c3
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.00516774
test al, al
je 0x69d1c3
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
cmp byte [eax + 0x21d], 0
je 0x69d16d
cmp byte [ebx + 0x3f9], 0
jne 0x69d16d
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x69d171
xor eax, eax
jmp 0x69d173
mov al, 1
mov ebx, eax
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x69d1c3
test bl, bl
je 0x69d1af
push 5
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push eax
call sub.user32.dll_ShowWindow
jmp 0x69d1c3
push 0
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x69d274
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffcc
push 0x69d480
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
mov byte [0x6bfb90], 0
push 0x69d49c
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d304
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x69d304
cmp word [esp], 0
je 0x69d304
mov byte [0x6bfb90], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x69d2da
sub ax, 0x8518
je 0x69d2e6
sub ax, 0x2400
je 0x69d2f2
jmp 0x69d2fb
mov byte [0x6b7295], 1
jmp 0x69d379
mov byte [0x6b7295], 2
jmp 0x69d379
mov byte [0x6b7295], 4
jmp 0x69d379
mov byte [0x6b7295], 0
jmp 0x69d379
push 0x69d4bc
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d334
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x69d334
cmp dword [esp + 4], 0
je 0x69d334
mov byte [0x6bfb90], 1
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [esp + 0x10]
sub ax, 1
jb 0x69d357
sub ax, 8
je 0x69d360
sub ax, 3
je 0x69d369
jmp 0x69d372
mov byte [0x6b7295], 1
jmp 0x69d379
mov byte [0x6b7295], 2
jmp 0x69d379
mov byte [0x6b7295], 4
jmp 0x69d379
mov byte [0x6b7295], 0
cmp byte [0x6bfb90], 0
je 0x69d3ba
call fcn.005fdb70
test al, al
je 0x69d3b3
push 0x69d4dc
push ebx
call fcn.00415434
test eax, eax
je 0x69d3b3
push 0x69d510
push 0x69d530
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
test eax, eax
jne 0x69d3ba
mov byte [0x6bfb90], 0
movzx eax, byte [0x69d54c]
mov byte [0x6bfba1], al
cmp byte [0x6b7295], 0
je 0x69d3f1
movzx eax, byte [0x6b7295]
cmp al, 7
ja 0x69d3f1
and eax, 0x7f
mov edx, 0x6bfba1
mov ecx, edx
and ecx, 3
sub edx, ecx
shl ecx, 3
add eax, ecx
bts dword [edx], eax
push 0x69d550
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d449
lea eax, [esp + 8]
push eax
push 0x1c4
call esi
test eax, eax
jne 0x69d420
test byte [esp + 8], 1
je 0x69d420
or byte [0x6bfba1], 8
test byte [0x6bfba1], 4
jne 0x69d478
lea eax, [esp + 8]
push eax
push 0x8664
call esi
test eax, eax
jne 0x69d478
test byte [esp + 8], 1
je 0x69d478
or byte [0x6bfba1], 4
jmp 0x69d478
push 0x69d584
push ebx
call fcn.00415434
mov ebx, eax
test ebx, ebx
je 0x69d478
lea eax, [esp + 0xc]
push eax
push 0x1c4
call ebx
test eax, eax
jne 0x69d478
cmp dword [esp + 0xc], 0
je 0x69d478
or byte [0x6bfba1], 8
add esp, 0x34
pop esi
pop ebx
ret
Function at 0x69e5fc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x69e6a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x69e6c4
push ebx
push 0x69e6d4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040bb60
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407d24
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b88c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x69e682
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0x20c]
call fcn.0069e550
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69e6ad
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax

Function at 0x6a0aa4
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a0be5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6a0c00
mov edx, ebx
call fcn.0040bad8
mov eax, dword [ebp - 0x25c]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x6a0bbd
xor eax, eax
push ebp
push 0x6a0bb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6a0c1c
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.004258a4
test eax, eax
jne 0x6a0b85
test byte [ebp - 0x258], 0x10
jne 0x6a0b85
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.0040b928
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bad8
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6a0b7d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.0040b88c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00425184
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6a0b15
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bbd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bec
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040a8cc
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x409690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4096b4
xor eax, eax
jmp 0x409734
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4096cb
xor eax, eax
jmp 0x409734
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x409717
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x409717
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4096ee
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x409723
xor eax, eax
jmp 0x409734
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x409731
xor eax, eax
jmp 0x409734
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x414ca0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5854b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.00411630
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00414750
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x414d1f
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.00411a00
mov eax, dword [ebp - 0x220]
jmp 0x414dd4
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x414da3
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00414ca0
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x414d97
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.00411a00
mov eax, dword [ebp - 0x224]
jmp 0x414dd4
mov dword [ebp - 0x210], 0x100
jmp 0x414d29
lea ecx, [ebp - 0x21c]
call fcn.00412f50
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.00413080
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.00411a00
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d77de
mov esp, ebp
pop ebp
ret 4

Function at 0x414eb0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x414f0f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414edc
mov eax, 1
jmp 0x414f2d
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x414f0d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x414f2d
jmp 0x414f28
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x414f28
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x414f2d
mov eax, 1
mov esp, ebp
pop ebp
ret 8