joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bac7c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6bae8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x48]
lea eax, [ebp - 8]
call fcn.0040f6a0
push eax
push 0x6bae9c
push 1
push 0
mov eax, dword [0x876310]
push eax
call sub.ole32.dll_CoCreateInstance
test eax, 0x80000000
jne 0x6bad41
lea eax, [ebp - 4]
call fcn.0040f6a0
push eax
push 0
push 0
mov eax, dword [0x876698]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call fcn.00538790
jmp 0x6bad25
lea edx, [ebp - 0x228]
lea eax, [ebp - 0x24]
call fcn.0053888c
mov edx, dword [ebp - 0x228]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x6bad0a
jmp 0x6bae4b
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x6baeac
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x6bae4b
xor eax, eax
push ebp
push 0x6bae44
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
jmp 0x6bae0d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 0xa
lea edx, [ebp - 0x23c]
mov eax, dword [0x876698]
call fcn.005387fc
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x238]
mov ecx, 1
mov eax, 0x6baec4
call fcn.004290e4
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x224]
mov ecx, pe_nt_image_headers32
call fcn.0040b178
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x238]
call fcn.005387a0
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x240]
call fcn.0053888c
mov edx, dword [ebp - 0x240]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
push 0x200
lea eax, [ebp - 0x224]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyW
test eax, eax
je 0x6bad78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bae4b
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bae95
lea eax, [ebp - 0x244]
mov edx, 3
call fcn.0040a5b8
lea eax, [ebp - 0x228]
call fcn.0040a558
lea eax, [ebp - 0xc]
call fcn.0040a558
lea eax, [ebp - 8]
call fcn.0040f6a0
lea eax, [ebp - 4]
call fcn.0040f6a0
pop eax
jmp eax
Function at 0x6baf6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyW
test eax, eax
jne 0x6bafad
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.0040b178
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6bafb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, edi
call fcn.0040b0c4
push eax
push esi
call sub.advapi32.dll_RegQueryValueW
test eax, eax
jne 0x6bb006
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.0040b178
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6d3918
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6d3920
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6d3ac7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6d3ae0
call fcn.0040b328
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.006d1600
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6d3af4
call fcn.006159a8
mov eax, dword [ebx + 0xc]
call fcn.0040aa5c
test eax, eax
jle 0x6d39d8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.006d1600
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d3b5c
call fcn.006159a8
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b2d0
mov eax, esi
mov edx, 0x6d3b88
call fcn.0040b2d0
mov eax, dword [ebx + 0x14]
call fcn.0040aa5c
test eax, eax
jle 0x6d3a56
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d3b9c
call fcn.006159a8
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b2d0
mov eax, dword [ebx + 0x10]
call fcn.0040aa5c
test eax, eax
jle 0x6d3a4a
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d3bcc
call fcn.006159a8
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b2d0
mov eax, esi
mov edx, 0x6d3b88
call fcn.0040b2d0
mov eax, dword [ebx + 0x18]
call fcn.0040aa5c
test eax, eax
jle 0x6d3a89
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d3bf8
call fcn.006159a8
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b2d0
mov eax, esi
mov edx, 0x6d3b88
call fcn.0040b2d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d3ace
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a5b8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a5b8
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax
Function at 0x706ec4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x706ed8
add esp, 0xfffffff0
call fcn.00408c98
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00408674
push esi
push 0x707370
call fcn.004cc27c
mov dword [esi + 0x444], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [esi + 0x440], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [esi + 4], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [esi + 8], eax
push 0xfa0
lea eax, [esi + 0x41c]
push eax
call sub.kernel32.dll_InitializeCriticalSectionAndSpinCount
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x43c], eax
mov eax, dword [ebp - 0x10]
add eax, eax
add eax, eax
sub eax, 2
mov dword [esi + 0x10], eax
cmp eax, 0x100
jle 0x706f67
mov dword [esi + 0x10], pe_nt_image_headers32
mov eax, esi
test bl, bl
je 0x706f7c
call fcn.00408cf0
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7079b4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x707ad2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040a558
mov word [ebp - 0x194], 0
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
test eax, eax
jne 0x707aaf
xor edx, edx
push ebp
push 0x707aa8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, esi
mov ecx, 0
call fcn.0040af00
cmp dword [ebp - 4], 0
jne 0x707a4a
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call fcn.0040ae88
push 0x104
mov eax, dword [ebp - 4]
call fcn.0040ae18
push eax
call sub.ws2_32.dll_gethostname
mov eax, dword [ebp - 4]
call fcn.0040ae18
push eax
call sub.ws2_32.dll_gethostbyname
test eax, eax
je 0x707a93
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1a0], eax
push dword [ebp - 0x1a0]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1a8]
mov ecx, 0
call fcn.0040ac5c
mov edx, dword [ebp - 0x1a8]
mov eax, ebx
call fcn.0040b194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x707aaf
call sub.ws2_32.dll_WSACleanup
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x707ad9
lea eax, [ebp - 0x1a8]
call fcn.0040a57c
lea eax, [ebp - 4]
call fcn.0040a57c
pop eax
jmp eax
Function at 0x76a608
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x244], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a64c
xor eax, eax
push ebp
push 0x76a7c8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.0076a5a8
mov esi, eax
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
mov eax, esi
call fcn.0076a5c8
mov ebx, eax
jmp 0x76a792
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x214]
mov ecx, 0x104
call fcn.0040b178
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.0042888c
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.004269d8
mov eax, dword [ebp - 0x23c]
push eax
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 4]
call fcn.004269d8
mov edx, dword [ebp - 0x248]
pop eax
call fcn.0040b4c0
je 0x76a732
lea eax, [ebp - 0x250]
lea edx, [ebp - 0x214]
mov ecx, 0x104
call fcn.0040b178
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.004269d8
mov eax, dword [ebp - 0x24c]
push eax
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.004269d8
mov edx, dword [ebp - 0x254]
pop eax
call fcn.0040b4c0
jne 0x76a783
cmp byte [ebp - 5], 0
je 0x76a745
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x230]
je 0x76a783
cmp byte [ebp - 6], 0
je 0x76a752
mov edi, 1
jmp 0x76a79a
mov eax, dword [ebp - 0x230]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
cmp byte [ebp + 8], 0
je 0x76a783
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea edx, [ebp - 0x238]
mov eax, esi
call fcn.0076a5e8
mov ebx, eax
test ebx, ebx
jne 0x76a68d
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76a7cf
lea eax, [ebp - 0x254]
mov edx, 7
call fcn.0040a5b8
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax
Function at 0x76df6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a64c
xor eax, eax
push ebp
push 0x76e09d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b0c4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
mov eax, edi
call fcn.00407234
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push edi
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x76e0ac
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00427700
push dword [ebx]
push 0x76e0bc
mov eax, dword [esi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00427700
push dword [ebp - 0x18]
mov eax, ebx
mov edx, 3
call fcn.0040b3b0
push dword [ebx]
push 0x76e0bc
mov eax, dword [esi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00427700
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.0040b3b0
push dword [ebx]
push 0x76e0bc
mov eax, dword [esi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00427700
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.0040b3b0
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00407250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76e0a4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040a5b8
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax
Function at 0x773460
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x773523
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
mov edi, 0x1000
call sub.kernel32.dll_GetEnvironmentStringsW
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0040a558
cmp edi, ebx
jbe 0x7734fd
cmp word [esi + ebx*2], 0
je 0x7734c4
lea eax, [ebp - 0x10]
movzx edx, word [esi + ebx*2]
call fcn.0040b0e4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040b2d0
jmp 0x7734f8
cmp dword [ebp - 4], 0
je 0x7734fd
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x773540
call fcn.0040b654
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x7734f0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 4]
call fcn.0040a558
inc ebx
cmp edi, ebx
ja 0x7734a4
push esi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77352a
lea eax, [ebp - 0x10]
call fcn.0040a558
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax

Function at 0x773544
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x7735d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.00428f28
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b124
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, 0x7735f4
call fcn.0040b328
push esi
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
push dword [edi]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040b124
push dword [ebp - 8]
push 0x7735f4
mov eax, edi
mov edx, 3
call fcn.0040b3b0
mov eax, ebx
call fcn.00428f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7735de
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax

Function at 0x7735f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x773694
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a5a0
mov eax, 0x104
call fcn.00428f28
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x773653
mov eax, esi
mov edx, ebx
call fcn.0040af80
mov eax, ebx
call fcn.00428f68
lea eax, [ebp - 4]
call fcn.0040f6a0
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
jne 0x77367c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77369b
lea eax, [ebp - 4]
call fcn.0040f6a0
pop eax
jmp eax
Function at 0x773e5c
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a64c
mov eax, dword [ebp - 8]
call fcn.0040a64c
xor eax, eax
push ebp
push 0x773f2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040a558
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040b0c4
push eax
mov eax, dword [ebp - 4]
call fcn.0040b0c4
mov edi, eax
push edi
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 0x10]
call fcn.00428f28
mov esi, eax
mov eax, dword [ebp - 0x14]
call fcn.0040721c
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040b0c4
push eax
push edi
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x773f04
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00773d58
mov eax, esi
call fcn.00428f68
mov eax, ebx
call fcn.00407250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x773f36
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax

Function at 0x774244
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x774345
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.00773f40
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x774321
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00516e60
mov edx, 0x774360
mov eax, dword [ebp - 8]
call fcn.005170f0
test al, al
je 0x7742e6
mov edx, 0x7743d8
mov eax, dword [ebp - 8]
call fcn.00517f1c
test al, al
je 0x7742de
lea ecx, [ebp - 0x10]
mov edx, 0x7743d8
mov eax, dword [ebp - 8]
call fcn.00517984
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004269d8
mov eax, dword [ebp - 0xc]
mov ecx, 1
mov edx, eax
mov eax, 0x7743f4
call fcn.0040b654
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00516e30
cmp byte [ebp - 1], 0
jne 0x774309
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00516e60
mov edx, 0x774410
mov eax, dword [ebp - 8]
call fcn.005182a8
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x774328
mov eax, dword [ebp - 8]
call fcn.004086a4
pop eax
jmp eax
Function at 0x77451c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x7745c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
mov eax, ebx
call fcn.00407234
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7745a5
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
push 1
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b124
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x7745e4
call fcn.0040b328
mov eax, dword [ebp - 0xc]
call fcn.0042793c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7745ac
mov eax, dword [ebp - 8]
call fcn.00407250
pop eax
jmp eax

Function at 0x7745f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x7746a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x87e5d4
lea eax, [ebp - 4]
lea edx, [esi + 0x61]
call fcn.0040b0e4
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x7746bc
call fcn.0040b328
lea eax, [ebx + 4]
mov edx, 0x7f
call fcn.0040b250
lea eax, [ebx + 4]
call fcn.0040ab18
xor ecx, ecx
mov edx, 0x7f
call fcn.00407e94
push 0x7f
lea eax, [ebx + 4]
call fcn.0040ab18
push eax
mov eax, dword [ebx]
call fcn.0040b0c4
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov eax, dword [ebx + 4]
call fcn.0040b0c4
call fcn.0040aa7c
mov edi, eax
mov dword [ebx + 8], edi
mov edx, edi
lea eax, [ebx + 4]
call fcn.0040b250
inc esi
add ebx, 0xc
cmp esi, 0x1a
jne 0x774611
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7746a8
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax
Function at 0x7d5c84
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x7d5dea
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x7d5cc6
or ebx, 0xffff
mov eax, esi
call fcn.0040b0c4
mov esi, eax
jmp 0x7d5cc8
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x7d5cf8
mov eax, edi
call fcn.0040a558
jmp 0x7d5dcd
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x7d5d48
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x87e9e8]
call fcn.0042da60
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x8760f4]
mov dl, 1
mov eax, dword [0x7da1b8]
call fcn.0042f5f0
call fcn.00409c14
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040b250
mov eax, dword [edi]
test eax, eax
je 0x7d5d60
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x7d5dcd
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040b0c4
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7d5dcd
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x87e9e8]
call fcn.0042da60
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x8760f4]
mov dl, 1
mov eax, dword [0x7da1b8]
call fcn.0042f5f0
call fcn.00409c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d5df1
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax

Function at 0x7d5ffe
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x7d5fbf
add esp, 0xfffffff0
call fcn.00408c98
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.007e0bb0
mov dl, 1
mov eax, dword [0x7d4394]
call fcn.007d9198
mov dword [edi + 0xb8], eax
mov dl, 1
mov eax, dword [0x7bf2ac]
call fcn.007cdf5c
mov dword [edi + 0xb4], eax
mov eax, dword [0x7d3464]
call fcn.007d8d14
push 0
push 0
push 0
push 1
push 0x7d6060
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0xb0], esi
test esi, esi
jne 0x7d602d
mov ecx, dword [0x876428]
mov dl, 1
mov eax, dword [0x7da270]
call fcn.0042f51c
call fcn.00409c14
push 0
push 0x10010
push 0x7d5e0c
mov eax, dword [edi + 0xb0]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x7d605a
call fcn.00408cf0
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret