joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10190d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01018715
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.010060eb
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x1019120
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x101917a
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x101917a
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x10187ff
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x101917a
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x1042878
test eax, eax
jg 0x1042885
call esi
mov esi, eax
jmp 0x101916a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x101916a

Function at 0x102218f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.0100858b
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01004817
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x104324f
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1022235
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1022235
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1021eb8
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1022235
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x104325a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10221db
test eax, eax
jg 0x1043267
call esi
mov esi, eax
jmp 0x1022225
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1022225
Function at 0x10230dc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x106d985
call fcn.010016d0
push ecx
push esi
mov esi, ecx
and dword [esi + 8], 0
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
call fcn.01002ee9
and dword [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.01002630
lea ecx, [esi + 0x30]
call fcn.01002ee9
mov dword [esi + 0x48], 0xfefefefe
push esi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 2
call fcn.01023134
and dword [esi + 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10232bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01007750
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01004755
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x104394d
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1023362
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1023362
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x10223e6
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1023362
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x1043958
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1023308
test eax, eax
jg 0x1043965
call esi
mov esi, eax
jmp 0x1023352
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1023352
Function at 0x1023ec5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01007750
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01004755
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x103df47
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1023f6b
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1023f6b
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x102454a
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1023f6b
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x103df52
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1023f11
test eax, eax
jg 0x103df5f
call esi
mov esi, eax
jmp 0x1023f5b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1023f5b

Function at 0x1024fb3
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xc8
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0xffffffffffffffff
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ebx, [esi + 0x24]
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.01001aa4
lea edi, [esi + 0x34]
push 0x103af30
mov ecx, edi
call fcn.010018c3
push edi
call fcn.010026b3
lea edx, [esi + 0x44]
push 0xb
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [edx], 0x2c
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0xa
mov ebx, dword [ebx + 4]
test ebx, ebx
mov ecx, 0x102b8d8
je 0x103f491
mov dword [esi + 0x54], ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x103f498
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x2c], 0
jne 0x103f49f
cmp byte [eax + 0x2a], 0
je 0x1025066
cmp byte [eax + 0x29], 1
je 0x1025066
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], edx
xor eax, eax
pop ebx
leave
ret 0xc
or dword [esi + 0x50], 4
jmp 0x1025058
mov ebx, ecx
jmp 0x102502e
mov eax, ecx
jmp 0x102503c
or dword [esi + 0x50], 2
jmp 0x102504c
Function at 0x1027ea1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01026a68
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01026b12
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x1042e36
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1027f47
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1027f47
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1026a10
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1027f47
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x1042e41
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1027eed
test eax, eax
jg 0x1042e4e
call esi
mov esi, eax
jmp 0x1027f37
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1027f37

Function at 0x1028afa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01007750
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01004755
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x10408db
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1028ba0
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1028ba0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1028a92
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1028ba0
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x10408e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1028b46
test eax, eax
jg 0x10408f3
call esi
mov esi, eax
jmp 0x1028b90
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1028b90
Function at 0x10294e2
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x106be8e
call fcn.010016d0
sub esp, 0x43c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x4a], bl
jne 0x1040ae6
mov ecx, edi
call fcn.01029536
mov esi, eax
cmp esi, ebx
jl 0x102951f
xor esi, esi
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1040bcb
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp esi, ebx
jl 0x1029515
jmp 0x1029513
lea eax, [ebp - 0x11]
push eax
push 0x106f8d0
lea ecx, [ebp - 0x24]
call fcn.01003112
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], ebx
call fcn.010026b3
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jne 0x1040b0f
mov eax, 0x102b8d8
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x1040b57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1040bb3
cmp eax, ebx
jle 0x1040b46
and eax, 0xffff
or eax, 0x80070000
push 1
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.01001890
jmp 0x102951f
push eax
lea ecx, [ebp - 0x30]
call fcn.0106345b
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 1
call fcn.0100cdd9
lea eax, [ebp - 0x448]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.010291ea
lea ecx, [ebp - 0x448]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0100ce34
cmp esi, ebx
jge 0x1040bb0
push 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x30], 0x102fe14
call fcn.01001890
jmp 0x1029515
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.010617ad
lea ecx, [ebp - 0x24]
push 1
mov esi, eax
call fcn.01001890
jmp 0x1029530
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x102951f

Function at 0x1029e3d
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
mov ebx, 0x102b8d8
je 0x1029e55
mov ebx, eax
and byte [ebp - 1], 0
mov ecx, esi
call fcn.01029eb4
test eax, eax
jl 0x1029eae
push edi
push 4
mov edi, 0x102cba0
push edi
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x10419cd
lea eax, [esi + 0x10]
push eax
mov al, byte [ebp + 8]
neg al
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x10419d9
cmp byte [ebp - 1], 0
jne 0x10419fd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
add ebx, 8
mov byte [ebp - 1], 1
jmp 0x1029e7f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10419ec
call esi
jmp 0x1029ead
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1029ead
lea eax, [ebp + 0xb]
push eax
push dword [esi + 0x14]
lea ecx, [ebp - 0x14]
call fcn.01003112
push edi
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x10]
test eax, eax
pop ecx
pop ecx
jne 0x1041a24
mov eax, 0x102b8d8
push eax
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x14]
call fcn.01001890
jmp 0x1029eab
Function at 0x1044802
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
ret 8

Function at 0x1044d5d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x2000
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x1044d8b
mov eax, 0x8007000e
jmp 0x1044ef4
push eax
mov ecx, ebx
call fcn.01044c6b
test eax, eax
jge 0x1044d9e
mov edi, eax
jmp 0x1044ee4
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.01044b45
test eax, eax
jne 0x1044db8
mov edi, 0x80020009
jmp 0x1044ee4
push edi
call esi
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0xc], esi
jne 0x1044dcf
mov edi, 0x8007000e
jmp 0x1044ee4
mov ecx, ebx
call fcn.01044c49
push esi
mov ecx, ebx
call fcn.01044c6b
test eax, eax
jl 0x1044eda
movzx eax, word [ebp - 2]
sub eax, 8
je 0x1044ebf
sub eax, 9
je 0x1044e22
dec eax
dec eax
jne 0x1044ecb
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.010447e8
jmp 0x1044ecb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
je 0x1044e3a
mov edi, 0x80004005
jmp 0x1044edc
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.010057d1
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 4], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
je 0x1044e30
cmp dword [ebp - 8], edi
jle 0x1044ea6
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.01044bc6
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x1044e70
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1044ecb
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.01044802
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.01044c6b
test eax, eax
jge 0x1044ef2
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x1044ef4
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10456fe
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x10684ee
call fcn.010016d0
sub esp, 0x210
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.010447b3
cmp eax, esi
jne 0x1045780
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1045749
lea eax, [ebp - 0x21c]
push eax
call fcn.010456fe
cmp eax, esi
jne 0x104577f
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x10]
je 0x1045739
call fcn.0104474e
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0104474e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1047342
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x1047392
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x104737d
call esi
mov esi, eax
jmp 0x104745a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x104745a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x10473b3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x10473d8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10473c6
call esi
jmp 0x104744f
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1047451
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x1047417
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.010057d1
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + ebx], 0
mov dword [ebp + 8], eax
mov edi, esp
test edi, edi
jne 0x104741f
xor eax, eax
jmp 0x1047443
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.010057d1
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.01023e49
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push eax
call fcn.01046893
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10479c7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff8c
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x10479ef
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x1047aca
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff74
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x98]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x68]
test esi, esi
je 0x1047af5
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x104933c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x54], 0x44
jne 0x1049370
mov eax, 0x102b8d8
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10493a6
push 0xffffffffffffffff
push dword [ebp - 0x10]
call fcn.01007c94
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10493ca
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10493b8
call esi
mov esi, eax
jmp 0x10493d7
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10493d7
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10493d5
jle 0x10493d7
jmp 0x10493bc
xor esi, esi
cmp dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10493e7
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0xc], ebx
je 0x10493f1
push dword [ebp - 0xc]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4