joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479f74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a1d4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x479fd7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00479c1c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cfe8
cmp al, 1
jne 0x479fd7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00479ee4
test al, al
je 0x47a163
cmp dword [ebp - 8], 0
jge 0x479ff5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00479c1c
mov eax, dword [ebp - 0x210]
call fcn.004042d4
cmp ebx, eax
jge 0x47a03f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00479c1c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4bae34]
and eax, 0xff
bt dword [edx], eax
jae 0x47a03f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47a053
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00479f50
cmp ebx, dword [ebp - 8]
je 0x47a155
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47a07f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040343c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b97f8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x47a142
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040343c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b97f8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044713c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040343c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4b97f8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044713c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a149
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47a1b6
cmp dword [ebp - 8], 0
jge 0x47a16e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00479c1c
mov eax, dword [ebp - 0x218]
call fcn.004042d4
cmp eax, dword [ebp - 8]
jg 0x47a1a8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00479c1c
mov eax, dword [ebp - 0x21c]
call fcn.004042d4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00479f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a1db
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404038
ret
Function at 0x49e984
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49e98c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49eb7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x49eb94
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404068
lea ecx, [ebp - 0x10]
mov edx, 0x49eba8
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404068
lea ecx, [ebp - 0x14]
mov edx, 0x49ebc0
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404068
lea ecx, [ebp - 0x18]
mov edx, 0x49ebdc
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404068
lea ecx, [ebp - 0x1c]
mov edx, 0x49ebf8
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404068
lea ecx, [ebp - 0x24]
mov edx, 0x49ec10
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040845c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004089a4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x49ec28
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x28]
call fcn.00493cd4
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x49ec38
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x2c]
call fcn.00493cd4
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x49ec50
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004089a4
inc eax
je 0x49eb21
lea ecx, [ebp - 0x34]
mov edx, 0x49ec50
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x34]
call fcn.00408968
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a384
fstp qword [ebp - 0x3c]
wait
call fcn.0040a714
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x49eb3c
lea ecx, [ebp - 0x40]
mov edx, 0x49ec50
mov eax, esi
call fcn.0049c810
mov eax, dword [ebp - 0x40]
call fcn.00493cd4
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x49ec60
mov eax, esi
call fcn.0049c810
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eb85
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404038
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404038
ret
Function at 0x4a90f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404068
mov esi, ebx
mov eax, dword [ebp]
call fcn.004042d4
test ax, ax
jbe 0x4a915f
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.0040452c
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xcad8
add ax, 0x566a
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x4a9124
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a9640
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4160b4]
call fcn.004049cc
xor eax, eax
push ebp
push 0x4a9784
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ba534], 0
jne 0x4a9693
mov ecx, dword [0x4ba688]
mov dl, 1
mov eax, dword [0x407468]
call fcn.0040c6a0
call fcn.004039cc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c48
mov eax, ebx
call fcn.0040487c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a9794
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405a64
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040488c
test eax, eax
jle 0x4a972b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a9724
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040429c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404284
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004083ec
test eax, eax
jne 0x4a9724
mov ebx, 0x15
jmp 0x4a9730
mov ebx, 0x10
jmp 0x4a9730
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4ba534]
call fcn.004a9598
mov eax, dword [ebp - 8]
call fcn.004a9598
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a978b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404038
lea eax, [ebp - 0x10]
mov edx, dword [0x4160b4]
call fcn.00404a9c
ret

Function at 0x4b2d2c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00404284
add esp, 0x108
pop ebx
ret
Function at 0x4b33e4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x14
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x14
call fcn.00404104
add esp, 0x18
pop ebx
ret
Function at 0x4b62c4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x14
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x14
call fcn.00404104
add esp, 0x18
pop ebx
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401443
pop dword [ebp - 0x1c]
mov eax, 0x1bbb4d21
add eax, 0xe484c722
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x14b4386c
sub dword [ebp - 0x2c], 0xc661f321
mov dword [ebp - 0x28], 0x97dea336
add dword [ebp - 0x28], 0x9a54a90f
mov dword [ebp - 0x24], 0x68fbeead
sub dword [ebp - 0x24], 0x1cafaa7f
mov dword [ebp - 0x20], 0x33662981
sub dword [ebp - 0x20], 0x33662981
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xe874e892
add dword [ebp - 0x2c], 0x8bfd80c4
mov dword [ebp - 0x28], 0xa066f7ab
add dword [ebp - 0x28], 0xa10569ca
mov dword [ebp - 0x24], 0x91386d8c
sub dword [ebp - 0x24], 0x2dc90120
mov dword [ebp - 0x20], 0xbb0d99aa
add dword [ebp - 0x20], 0x44f26656
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x4c06b94c
add eax, 0xb439c730
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35179
push 0
call eax
mov ecx, 0x3add
xor esi, esi
add esi, eax
mov edx, 0x459200
add edx, dword [ebp - 0x1c]
mov ebx, 0x81e2feb3
add ebx, 0x643b933b
add dword [ebp - 8], 0x97395724
mov edi, dword [edx]
xor dword [ebp - 4], eax
xor edi, ebx
sub dword [ebp - 8], 0x302e1bdf
mov dword [esi], edi
add dword [ebp - 0xc], 0xdb883c48
add esi, 0x6bfd8ca4
sub esi, 0x6bfd8ca0
add edx, 4
loop 0x401556
add eax, 0x4a7713d9
add eax, 0xb589ca6e
mov ebx, eax
add eax, 0xb239f273
add eax, 0x4dc60d92
mov ecx, 0xbf2ee25e
sub ecx, 0xbeeee25e
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10003626
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1001f7f3
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036b0
lea eax, [esp + 0x28]
push eax
call fcn.10003626
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000368b
call fcn.10002ded
push ebx
mov ecx, edi
call fcn.10002e76
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.10002ded
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x11c
ret 4
Function at 0x10005a24
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x974
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x970], eax
push ebx
push ebp
xor ebp, ebp
mov ebx, 0x400
push esi
mov esi, dword [esp + 0x99c]
inc ebp
push edi
mov edi, dword [esp + 0x988]
test esi, esi
jne 0x10005a7b
push ebx
lea eax, [esp + 0x584]
push eax
push ebp
push edi
call fcn.10008e4e
add esp, 0x10
test eax, eax
je 0x10005a7b
mov eax, str._s_ssvagent.exe
lea esi, [esp + 0x580]
jmp 0x10005a90
test edi, edi
jne 0x10005be0
test esi, esi
je 0x10005be0
mov eax, str._s_bin_ssvagent.exe
push esi
push eax
lea eax, [esp + 0x188]
push ebx
push eax
call fcn.10004e7f
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x194]
push eax
call fcn.1001f7f3
add esp, 0x18
test eax, eax
jne 0x10005be0
cmp dword [esp + 0x98c], 0
mov ecx, str.__new
mov byte [esp + 0x7c], al
mov ebx, 0x104
mov eax, str.__old
cmovne eax, ecx
push eax
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1001f7f3
mov edi, dword [esp + 0x99c]
add esp, 0xc
mov esi, dword [esp + 0x99c]
test edi, edi
jne 0x10005b03
test esi, esi
je 0x10005b19
push str.__high
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1001f7f3
add esp, 0xc
cmp dword [esp + 0x998], 0
je 0x10005b39
push str.__settreatas
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1001f7f3
add esp, 0xc
test esi, esi
je 0x10005b53
push str.__regdeploy
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1001f7f3
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1000de50
add esp, 0xc
mov dword [esp + 0x10], esi
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
test edi, edi
je 0x10005b8b
call fcn.1001f7f3
test eax, eax
mov ecx, str.runas
cmove ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x994], 0
push 0x40
pop ecx
cmovne eax, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10005be0
cmp dword [esp + 0x48], 0
je 0x10005bdc
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, ebp
jmp 0x10005be2
xor eax, eax
mov ecx, dword [esp + 0x980]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x974
ret
Function at 0x10005d98
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x948
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x944], eax
push ebx
push ebp
mov ebp, dword [esp + 0x954]
lea eax, [esp + 0x14c]
push esi
push edi
push 0x400
push 0
push eax
call fcn.1000de50
mov ebx, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
mov edi, section..data
test esi, esi
jne 0x10005ebe
push ebp
mov ebx, 0x400
mov byte [esp + 0x558], 0
lea eax, [esp + 0x558]
push ebx
push eax
call fcn.1001f7f3
push 0x100315c4
lea eax, [esp + 0x564]
push ebx
push eax
call fcn.1001f7f3
push dword [edi]
lea eax, [esp + 0x570]
push ebx
push eax
call fcn.1001f7f3
add esp, 0x24
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x558]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10005eaf
push ebp
lea eax, [esp + 0x158]
mov byte [esp + 0x158], 0
push 0x400
push eax
call fcn.1001f7f3
push 0x100315c8
lea eax, [esp + 0x164]
push 0x400
push eax
call fcn.1001f7f3
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x170]
push 0x400
push eax
call fcn.1001f7f3
lea eax, [esp + 0x178]
push eax
call fcn.10009086
add esp, 0x28
test eax, eax
je 0x10005eac
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x10005e3d
jmp 0x10005eaf
xor esi, esi
inc esi
add edi, 4
cmp edi, 0x1004100c
jl 0x10005dd9
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [esp + 0x954]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x948
ret
Function at 0x10007043
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x7c0]
sub esp, 0x840
mov eax, dword [0x10041024]
xor eax, ebp
mov dword [ebp + 0x7bc], eax
push ebx
push esi
push edi
call fcn.10007258
xor ebx, ebx
lea ecx, [ebp - 0x80]
mov esi, 0x20019
mov dword [ebp - 0x80], ebx
push esi
push 0x100314f4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.1001f7f3
test eax, eax
jne 0x10007222
push esi
push 0x10031500
push dword [ebp - 0x80]
lea ecx, [ebp - 0x74]
call fcn.1001f7f3
test eax, eax
jne 0x10007222
push esi
push 0x1003150c
push dword [ebp - 0x74]
lea ecx, [ebp - 0x68]
call fcn.1001f7f3
test eax, eax
jne 0x10007222
mov esi, 0x400
lea eax, [ebp + 0x3bc]
push esi
push ebx
push eax
mov edi, ebx
call fcn.1000de50
push esi
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.1000de50
add esp, 0x18
lea eax, [ebp + 0x3bc]
push esi
push eax
push ebx
jmp 0x10007211
lea ecx, [ebp + 0x3bc]
mov edx, ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007111
sub ecx, esi
lea eax, [ebp - 0x44]
mov bl, byte [ebp + edx + 0x3bc]
cmp bl, 0x2e
je 0x1000712c
mov byte [eax], bl
inc eax
inc edx
cmp edx, ecx
jbe 0x1000711d
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x5c], str.NODOTVERSION
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007147
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x1000715f
mov eax, ebx
jmp 0x10007176
lea eax, [esi + esi]
call fcn.1000c1e0
mov eax, esp
lea ecx, [ebp - 0x44]
push 3
push esi
push ecx
push eax
call fcn.1001f7f3
push 0x50
mov dword [ebp - 0x58], eax
pop eax
mov dword [ebp - 0x54], str.CLSID_STRING
call fcn.1000c1e0
mov eax, esp
push 3
push 0x27
push str.5852F5ED_8BF4_11D4_A245_0080C6F74284
push eax
call fcn.1001f7f3
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.1001f7f3
test eax, eax
je 0x100071bd
lea eax, [ebp - 0x5c]
push eax
push 1
push 0x67
push 0x10041c48
call fcn.100046aa
call fcn.1001f7f3
test eax, eax
je 0x100071ce
cmp dword [ebp + 0x7cc], ebx
je 0x100071e0
lea eax, [ebp - 0x5c]
push eax
push 1
push 0x68
push 0x10041c48
call fcn.100046aa
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x400
lea eax, [ebp + 0x3bc]
push esi
push ebx
push eax
call fcn.1000de50
push esi
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.1000de50
add esp, 0x18
lea eax, [ebp + 0x3bc]
inc edi
push esi
push eax
push edi
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x10007106
lea ecx, [ebp - 0x68]
call fcn.10002ded
lea ecx, [ebp - 0x74]
call fcn.10002ded
lea ecx, [ebp - 0x80]
call fcn.10002ded
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7bc]
xor ecx, ebp
call fcn.1000be90
add ebp, 0x7c0
leave
ret
Function at 0x10007258
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x41c
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push ebp
push esi
mov ebp, 0x400
lea eax, [esp + 0x24]
xor ebx, ebx
push ebp
push ebx
push eax
mov esi, ebx
call fcn.1000de50
add esp, 0xc
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
push 0x20019
push 0x100314d4
push SysReAllocString
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.1001f7f3
test eax, eax
jne 0x1000732e
push 0x2001f
push str.Classes
push dword [esp + 0x20]
lea ecx, [esp + 0x18]
call fcn.1001f7f3
test eax, eax
jne 0x1000732e
push ebp
lea eax, [esp + 0x28]
push eax
push ebx
jmp 0x10007320
push 0xa
lea eax, [esp + 0x28]
push str.JavaPlugin
push eax
call fcn.10016e00
add esp, 0xc
test eax, eax
jne 0x10007309
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.10003626
test eax, eax
je 0x1000730a
inc esi
push ebp
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.1000de50
add esp, 0xc
lea eax, [esp + 0x24]
push ebp
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x100072df
lea ecx, [esp + 0xc]
call fcn.10002ded
lea ecx, [esp + 0x18]
call fcn.10002ded
mov ecx, dword [esp + 0x424]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x41c
ret
Function at 0x10007358
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x960
push 0x1003e9c0
call fcn.1000c180
mov esi, dword [ebp + 8]
mov dword [ebp - 0x964], esi
xor edi, edi
mov dword [ebp - 0x960], edi
push 0x400
push edi
lea eax, [ebp - 0x41c]
push eax
call fcn.1000de50
add esp, 0xc
and dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp - 0x96c], ebx
cmp ebx, 3
jge 0x1000750d
mov byte [ebp - 0x81c], 0
push esi
mov esi, 0x400
push esi
lea eax, [ebp - 0x81c]
push eax
call fcn.1001f7f3
push 0x100315cc
push esi
lea eax, [ebp - 0x81c]
push eax
call fcn.1001f7f3
push dword [ebx*4 + section..data]
push esi
lea eax, [ebp - 0x81c]
push eax
call fcn.1001f7f3
add esp, 0x24
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x970], esi
cmp esi, 0xffffffff
je 0x100074d9
mov byte [ebp - 0x41c], 0
push dword [ebp - 0x964]
push 0x400
lea eax, [ebp - 0x41c]
push eax
call fcn.1001f7f3
push 0x100315d0
push 0x400
lea eax, [ebp - 0x41c]
push eax
call fcn.1001f7f3
lea eax, [ebp - 0x930]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
call fcn.1001f7f3
lea eax, [ebp - 0x41c]
push eax
call fcn.10009086
add esp, 0x28
test eax, eax
jne 0x100074c3
push 0x404
call fcn.1001f7f3
pop ecx
mov dword [ebp - 0x968], eax
test eax, eax
jne 0x10007497
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x10041024
call fcn.1000d760
add esp, 0xc
xor eax, eax
jmp 0x1000751c
mov byte [eax], 0
lea ecx, [ebp - 0x41c]
push ecx
push 0x400
push eax
call fcn.1001f7f3
add esp, 0xc
mov eax, dword [ebp - 0x968]
mov dword [eax + 0x400], edi
mov edi, eax
mov dword [ebp - 0x960], edi
lea eax, [ebp - 0x95c]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x10007409
test edi, edi
je 0x10007501
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov esi, dword [edi + 0x400]
push 0x404
push edi
call fcn.1001f7f3
pop ecx
pop ecx
mov edi, esi
mov dword [ebp - 0x960], edi
jmp 0x100074d9
inc ebx
mov esi, dword [ebp - 0x964]
jmp 0x10007392
mov dword [ebp - 4], 0xfffffffe
call fcn.10007532
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret