joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a548
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x446c48
push 0xa
push 0x40a5dc
mov eax, dword [0x446c38]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40a56c
call fcn.004154ac
push ebx
mov eax, dword [0x446c38]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40a583
call fcn.004154ac
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40a595
call fcn.004154ac
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x446c4c], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x446c50], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x446c54], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x446c58], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x446c5c], ecx
add edx, dword [eax + 0x14]
mov dword [0x446c60], edx
pop esi
pop ebx
ret

Function at 0x40df8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40e035
test eax, edx
je 0x40e038
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40dfb5
push edx
mov edx, eax
mov eax, esp
call fcn.00406744
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40dfcb
push eax
lea eax, [esp + 8]
call fcn.00406744
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40dfda
movzx eax, word [eax]
sub eax, ecx
jmp 0x40e001
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40e01b
add ecx, 4
js 0x40dff2
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40e018
push eax
mov eax, ecx
mov edx, 2
call fcn.00405d90
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40dfff
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40e001
xor eax, eax
ret
test eax, eax
je 0x40e048
test edx, edx
jne 0x40df9c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40f214
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004065cc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40f232
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40f253
cmp ebx, 3
je 0x40f253
cmp ebx, 0x7b
je 0x40f253
mov eax, esi
call fcn.0040f1d4
test al, al
jne 0x40f257
xor eax, eax
jmp 0x40f259
mov al, 1
pop esi
pop ebx
ret

Function at 0x40f25c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004065cc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40f275
test al, 0x10
jne 0x40f279
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4126f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412729
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040667c
jmp 0x412732
mov eax, ebx
mov edx, esi
call fcn.00406540
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41273c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41275e
movzx eax, word [esp]
jmp 0x412760
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x413015
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00412d00
mov esi, eax
mov eax, dword [0x443278]
cmp byte [eax], 0
je 0x412fbd
mov eax, dword [0x443128]
call fcn.004044b0
call fcn.004042c8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x412ec8]
call fcn.00407aa4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x413030
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x412ff9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4430f4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x446c38]
call fcn.00407b68
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41301c
lea eax, [ebp - 4]
mov edx, dword [0x412ec8]
call fcn.00407ab0
ret
Function at 0x415354
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004060a0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x4152fe
mov eax, edi
add eax, eax
call fcn.00404180
mov esi, eax
jmp 0x415300
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415339
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415323
mov eax, esp
cmp esi, eax
je 0x415346
mov eax, esi
call fcn.0040419c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x415380
cmp bl, 0
je 0x41537c
cmp bl, 0x41
jl 0x415377
cmp bl, 0x5a
jg 0x415377
or bl, 0x20
xor al, bl
inc esi
jmp 0x41535b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4152c0
Function at 0x43af24
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43b09f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406594
mov eax, dword [ebp - 4]
call fcn.0043a7bc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x43af76
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406d2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0043bbd0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43b055
xor eax, eax
push ebp
push 0x43b04e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0043ab24
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0043b0d4
test al, al
je 0x43b02c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040667c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x43b02c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004065cc
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0043aa84
test al, al
je 0x43b026
mov eax, dword [ebp - 8]
call fcn.004065cc
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004066ec
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0043af24
dec ebx
cmp ebx, 0xffffffff
jne 0x43afd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b055
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0043ab24
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.004065cc
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0043ab10
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0043aa84
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b0a6
lea eax, [ebp - 0x3c]
call fcn.00406530
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406538
ret

Function at 0x43baac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0043a830
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004065cc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0043aa84
test al, al
jne 0x43bb14
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4431d8]
mov dl, 1
mov eax, dword [0x4395e0]
call fcn.00413238
call fcn.00405630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43bb20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004065cc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.0043aa84
test al, al
jne 0x43bb81
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x443334]
mov dl, 1
mov eax, dword [0x4395e0]
call fcn.00413238
call fcn.00405630
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043a860
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43c180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43c2a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0043ab24
xor eax, eax
push ebp
push 0x43c283
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043b0d4
test al, al
je 0x43c267
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043c060
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040667c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x43c267
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004065cc
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043aa84
test al, al
je 0x43c263
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004065cc
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004066ec
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043c060
pop ecx
inc edi
dec ebx
jne 0x43c20b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c28a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0043ab24
ret
Function at 0x43c2b8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43c506
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0043ab24
xor eax, eax
push ebp
push 0x43c4dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043b0d4
test al, al
je 0x43c4c0
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040667c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x43c4c0
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004065cc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043aa84
test al, al
je 0x43c4b4
mov eax, dword [ebp - 4]
call fcn.004065cc
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004066ec
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043bbd0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43c4b4
xor eax, eax
push ebp
push 0x43c4ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0043ab24
xor eax, eax
push ebp
push 0x43c48f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004065cc
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.004066ec
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043ab28
mov eax, dword [ebp - 4]
call fcn.004065cc
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.004066ec
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043bbd0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x43c46c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043c180
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043c2b8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c473
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x43c343
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c4e3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0043ab24
ret
Function at 0x43d8ec
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406528
xor eax, eax
push ebp
push 0x43da69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x44328c]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00406bf4
je 0x43da46
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404584
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.004065cc
mov dword [ebp - 0x34], eax
mov eax, ebx
call fcn.004065cc
mov dword [ebp - 0x30], eax
movzx eax, si
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x43da41
mov eax, dword [ebp - 4]
test eax, eax
je 0x43d99a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x43d99a
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405f1c
test eax, eax
je 0x43d9a3
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
jmp 0x43d9a9
dec ebx
lea eax, [ebp - 4]
call fcn.00405f2c
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x43d9a8
mov eax, dword [ebp - 4]
test eax, eax
je 0x43d9d6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x43d9d6
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405f1c
mov esi, eax
test esi, esi
je 0x43d9e1
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
mov ecx, esi
sub ecx, ebx
dec ecx
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.00406c5c
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.0040e290
mov edx, dword [ebp - 0x48]
mov eax, 0x43da88
call fcn.00406bf4
jne 0x43da1c
lea eax, [ebp - 8]
mov edx, 0x43dab0
call fcn.00406594
push 0x3e8
call sub.kernel32.dll_Sleep_1
call fcn.0043d7a0
mov eax, dword [ebp - 8]
call fcn.0043d7b4
xor al, 1
or al, byte [0x449010]
je 0x43da1c
xor edi, edi
jmp 0x43da46
mov edi, 0x2b67
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43da70
lea eax, [ebp - 0x48]
call fcn.00406530
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406538
ret
Function at 0x44173c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x43db3c
call fcn.00409954
xor eax, eax
push ebp
push 0x4418aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4397d4]
call fcn.0043a9d8
mov dword [0x44900c], eax
mov eax, 0x449014
mov edx, 0x4418c4
call fcn.00406540
call fcn.0043d1ac
call fcn.0043d3a8
call fcn.0043d468
call fcn.0043cb28
call fcn.0043cc54
call fcn.0043cd60
mov edx, dword [0x449004]
mov eax, 0x441924
call fcn.00406e48
test eax, eax
jle 0x4417e1
movzx eax, byte [0x44192c]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x449014]
mov edx, 0x441924
mov eax, dword [0x449004]
call fcn.00414fc8
mov edx, dword [ebp - 0x14]
mov eax, 0x449004
call fcn.00406540
jmp 0x4417f1
mov eax, 0x449004
mov edx, dword [0x449014]
call fcn.00406540
mov eax, dword [0x449008]
mov edx, dword [0x44328c]
mov edx, dword [edx]
call fcn.00406bf4
jne 0x44182a
push 1
push 0x441930
push 0x441930
mov eax, dword [0x449014]
call fcn.004065cc
push eax
push 0x441934
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x44183e
mov cx, 1
mov edx, dword [0x449004]
mov eax, dword [0x449008]
call fcn.0043d8ec
mov eax, 0x44194c
call fcn.0040f214
test al, al
je 0x441869
push 1
push 0x441930
push 0x441930
push 0x441960
push 0x441934
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, 0x441980
call fcn.0040f214
test al, al
je 0x441894
push 1
push 0x441930
push 0x441930
push 0x4419a8
push 0x441934
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4418b1
lea eax, [ebp - 0x14]
call fcn.00406530
ret
Function at 0xd86370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xd8638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xdaf074
push ecx
mov edi, eax
call fcn.00d9a198
mov esi, eax
add esp, 8
test esi, esi
jne 0xd863cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00d9a02e
push esi
call fcn.00d99fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xd89850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xd898ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xdb4720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xd898ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00d9a1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xd898ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xdb4720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xd8992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00d9b082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xd89957
mov word [eax], si
add eax, 2
push eax
call fcn.00d9b030
add esp, 4
jmp 0xd89959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xd898ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xd898b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xd89ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret