joyce8/EMBER2024-capa huggingface dataset:
Function at 0x729edb50
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push edi
mov edi, dword [ebp + 8]
push 1
mov dword [ebp - 8], edi
cmp byte [edi], 0
pop ebx
je 0x729edc05
push edi
call esi
cmp byte [eax], 0x3a
jne 0x729edc05
push dword [ebp + 0xc]
call esi
cmp byte [eax], 0x3a
jne 0x729edc12
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
cmp al, byte [edi]
jne 0x729edc12
push edi
call esi
push eax
call esi
mov dword [ebp - 8], eax
test ebx, ebx
je 0x729edd32
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
lea eax, [ebp - 0x110]
push eax
jne 0x729edc16
call fcn.729edb17
and byte [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x110]
push eax
call ebx
push dword [ebp - 8]
mov edx, eax
mov dword [ebp + 0xc], edx
call ebx
mov ecx, dword [ebp + 0xc]
add ecx, eax
cmp ecx, 0x104
jle 0x729edc1d
mov eax, 0x800a017c
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [edi], 0x5c
jne 0x729edba4
push edi
call esi
cmp byte [eax], 0x5c
jne 0x729edba4
xor ebx, ebx
jmp 0x729edba4
call fcn.729edae0
jmp 0x729edbd3
push dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x110]
push eax
call esi
cmp byte [eax], 0x3a
jne 0x729edcaf
mov al, byte [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
and byte [ebp + 0xf], 0
xor ebx, ebx
push ebx
push ebx
mov byte [ebp + 0xc], al
mov byte [ebp + 0xd], 0x3a
mov byte [ebp + 0xe], 0x5c
call esi
mov edi, eax
push edi
push ebx
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
push ebx
push edi
call esi
dec edi
cmp eax, edi
je 0x729edc83
push 0x7296d6ec
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp + 0xc]
push eax
call esi
test eax, eax
jne 0x729edc9a
mov dword [ebp - 4], 0x800a0044
push ebx
call esi
push ebx
push 0
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp + 8]
cmp dword [ebp - 4], 0
jl 0x729edd2a
lea eax, [ebp - 0x110]
push 0x105
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.7298d71e
add esp, 0xc
test eax, eax
je 0x729edd47
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea eax, [ebp + esi - 0x218]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp esi, 3
jbe 0x729edd1c
cmp byte [eax], 0x5c
jne 0x729edd05
and byte [eax], 0
lea eax, [ebp - 0x218]
push eax
call fcn.72995042
test eax, eax
jne 0x729edd1c
mov dword [ebp - 4], 0x800a004c
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
jmp 0x729edbfe
push dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x729edc2d
mov dword [ebp - 4], 0x800a004c
jmp 0x729edd2a
Function at 0x729ee2a3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov eax, dword [esi + 0xd8]
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x729ee2c6
mov eax, 0x72950aa0
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x250]
push 0x105
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x250]
push eax
call fcn.729edae0
push edi
push edi
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x28]
push 0xb
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push edi
push edi
push 0x184
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0xdc]
cmp eax, edi
mov ebx, eax
jne 0x729ee330
mov ebx, 0x729b10e4
mov edi, ebx
mov al, byte [edi]
test al, al
je 0x729ee347
cmp al, 0x3b
je 0x729ee347
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
jmp 0x729ee332
mov al, byte [edi]
and byte [edi], 0
push ebx
mov byte [ebp + 8], al
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x729ee3ef
mov dl, byte [ebp - 0x148]
test dl, 0x10
jne 0x729ee3d6
mov eax, dword [esi + 0xd4]
xor ecx, ecx
test dl, 2
je 0x729ee393
test al, 2
je 0x729ee3d6
push 1
pop ecx
test dl, 4
je 0x729ee39f
test al, 4
je 0x729ee3d6
push 1
pop ecx
test al, 0x80
jne 0x729ee3b8
test al, 1
je 0x729ee3af
test dl, 1
je 0x729ee3af
push 1
pop ecx
test al, 0x20
je 0x729ee3bb
test dl, 0x20
je 0x729ee3bb
push 1
pop ecx
test ecx, ecx
je 0x729ee3d6
lea eax, [ebp - 0x11c]
push eax
push 0
push 0x180
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x729ee374
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp + 8]
inc dword [ebp - 4]
test al, al
je 0x729ee40b
push edi
mov byte [edi], al
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov ebx, edi
jmp 0x729ee332
cmp dword [ebp - 4], 1
jle 0x729ee419
push dword [ebp + 0xc]
call fcn.729ee44a
mov eax, dword [esi + 0x28]
push 0
push 1
push 0xb
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x729ee441
push 1
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x729ee4f7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0
push 0
push 0x31
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test eax, eax
je 0x729ee527
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push 0x100
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp + 0x10], eax
push eax
lea eax, [ebp - 0x144]
push eax
push edi
call esi
cmp dword [ebp - 8], 0
push 1
pop ebx
jne 0x729ee570
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x7296d6f0
push edi
call esi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x72a4e898], 0
je 0x729ee69f
mov eax, dword [ebp + 8]
test byte [eax + 0x27], 0x20
je 0x729ee69f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffc
mov dword [ebp - 0x24], eax
sub eax, dword [ebp - 0xc]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
cdq
sub eax, edx
push 0x10
sar eax, 1
add dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
dec dword [ebp - 0x10]
call esi
push 0xf
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.729a2058
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x14
call esi
push 0xf
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.729a2058
lea eax, [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
call fcn.72970e19
mov esi, dword [sym.imp.GDI32.dll_SetBkMode]
push 2
push edi
call esi
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x729ee648
push 0x80000011
push ebx
call fcn.72970d94
cmp eax, dword [ebp - 0x30]
jne 0x729ee640
push 0x80000010
push ebx
call fcn.72970d94
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [0x72a4e898], 0
je 0x729ee6b4
test byte [ebx + 0x27], 0x20
je 0x729ee6b4
push 0x20022
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x144]
push dword [ebp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
cmp dword [ebp - 4], 0
je 0x729ee681
push dword [ebp - 4]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
push edi
call esi
lea eax, [ebp - 0x44]
push 0
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
call fcn.72970e19
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], 4
add eax, 8
mov dword [ebp - 0x24], eax
jmp 0x729ee5a9
push 0x20
jmp 0x729ee65c
Function at 0x729fce16
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x7f02
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x10], eax
cmp dword [esi + 0xd5c], edi
mov ebp, dword [esi + 0xe3c]
mov dword [esi + 0xd60], 1
jne 0x729fce64
mov dword [esi + 0xe3c], edi
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x729fcf91
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
mov eax, dword [esp + 0x1c]
je 0x729fcea0
cmp eax, 0x200
jae 0x729fcfb6
cmp eax, 0x209
jbe 0x729fcfb6
mov edx, dword [esp + 0x20]
cmp eax, 0x100
jne 0x729fcebb
cmp edx, 0x1b
jne 0x729fcebb
mov ebx, 0x11f
mov dword [esi + 0xd60], edi
cmp eax, 0x200
je 0x729fcfb6
cmp eax, 0x202
je 0x729fcfb6
cmp eax, 0x205
je 0x729fcfb6
cmp eax, 0x208
je 0x729fcfb6
mov ecx, 0xa0
cmp eax, ecx
je 0x729fcfb6
cmp eax, 0xa2
je 0x729fcfb6
cmp eax, 0xa5
je 0x729fcfb6
cmp eax, 0xa8
je 0x729fcfb6
cmp eax, ecx
jb 0x729fcf20
cmp eax, 0xa9
jbe 0x729fcf3c
cmp eax, 0x100
jb 0x729fcf2e
cmp eax, 0x108
jbe 0x729fcf3c
cmp eax, 0x200
jb 0x729fcf7f
cmp eax, 0x209
ja 0x729fcf7f
cmp eax, 0x104
jne 0x729fcfc1
cmp edx, 0x12
je 0x729fd010
cmp edx, 0x11
je 0x729fd010
cmp dword [esi + 0xd58], edi
lea ecx, [esi + 0xd58]
je 0x729fcfc1
cmp edx, 0x10
je 0x729fcfc1
cmp edx, 9
mov dword [ecx], edi
je 0x729fcf74
cmp edx, 0x1b
jne 0x729fcf7f
mov ebx, 0x11f
mov dword [esi + 0xd60], edi
cmp eax, 0x104
je 0x729fcf91
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi + 0xd60], edi
je 0x729fcfcd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x40]
jbe 0x729fcfc1
mov ebx, 0x11e
mov dword [esi + 0xd60], edi
jmp 0x729fcfc1
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi + 0xd60], edi
jne 0x729fce64
cmp ebx, edi
mov dword [esi + 0xe3c], ebp
je 0x729fcffe
push edi
push dword [esp + 0x40]
push dword [esi + 0xd74]
call sub.USER32.dll_DdeAbandonTransaction
test eax, eax
jne 0x729fcffa
call fcn.729fd429
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
mov eax, ebx
jmp 0x729fcff0
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 0xd70]
jmp 0x729fcff0
mov dword [esi + 0xd58], 1
jmp 0x729fcfc1
Function at 0x729fe195
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.729fddc5
push eax
push esi
push dword [ebp + 8]
call fcn.729fdd7a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.729fddc5
push eax
push esi
push dword [ebp + 8]
call fcn.729fdd7a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.729fddb5
test dword [edx - 0x6277aa95], ebp
jl 0x729fe23a
invalid
invalid

Function at 0x729fe405
Capabilities:
Inspect section memory permissions

Disassembly:
inc edi
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x729fe469
add eax, esi
cmp dword [eax], ebx
je 0x729fe469
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x729fe464
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x729fe44e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x729fe456
cmp edx, ebx
jne 0x729fe5a4
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x729fe425
add eax, dword [eax + 4]
jmp 0x729fe412
mov dword [ebp + 0xc], ebx
jmp 0x729fe474
Function at 0x729fe4f2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x729fe48c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x729fe4aa
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x729fe508
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x729fe4ef
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x729fe4f8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x729fe502
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x729fe4e4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x729fe46e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x729fe555
dec eax
je 0x729fe54c
sub eax, 3
je 0x729fe543
mov dword [ebp - 4], 0x40
jmp 0x729fe572
mov dword [ebp - 4], 4
jmp 0x729fe558
mov dword [ebp - 4], 0x20
jmp 0x729fe558
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x729fe5a4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x729fe524
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.729fddb5
push 0xfffffffffffffff3
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x729ff93c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x78b5b], al
inc dword [eax]
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
cmp al, 0xc6
test dword [eax + edi*8 - 1], edi
push dword [eax]
Function at 0x72a015e3
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [ebp + 8]
push esi
push edi
and dword [ebp - 4], 0
push 8
and dword [eax], 0
pop esi
push 3
mov dword [ebp - 0x14], esi
pop edi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 9
call fcn.7294a0ba
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x72a0162c
mov eax, 0x800a0209
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x72a016b8
xor edi, edi
lea esi, [ebp - 0x14]
push dword [esi]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x72a01690
inc edi
add esi, 4
cmp edi, 4
jb 0x72a0163c
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push ebx
call esi
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x72a01685
cmp dword [0x72a50ac0], eax
je 0x72a01673
cmp ebx, 2
jne 0x72a01673
push 9
call esi
push 0
push 0
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.72a013e7
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
jmp 0x72a01625
mov ebx, dword [ebp + edi*4 - 0x14]
cmp ebx, 3
jne 0x72a01651
mov esi, dword [sym.imp.USER32.dll_EnumClipboardFormats]
push 0
call esi
test eax, eax
je 0x72a01651
cmp eax, 3
je 0x72a016b4
cmp eax, 0xe
je 0x72a016b4
push eax
jmp 0x72a016a1
mov ebx, eax
jmp 0x72a01651
cmp ebx, 2
je 0x72a01651
cmp ebx, edi
je 0x72a01651
cmp ebx, esi
je 0x72a01651
cmp ebx, 0xe
je 0x72a01651
cmp ebx, 9
je 0x72a01651
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 0x800a01cc
jmp 0x72a01625
Function at 0x72a05e48
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
xor ebx, ebx
cmp dword [0x72a4e828], ebx
je 0x72a05e61
xor eax, eax
pop ebx
leave
ret
push edi
lea eax, [ebp - 8]
push esi
push eax
push 0x20006
push ebx
push 0x7296e484
push 0x80000002
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x72a05e9e
cmp eax, 5
je 0x72a05eda
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0xc], eax
jmp 0x72a05eda
lea eax, [ebp - 4]
mov edi, 0x7296a444
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, ebx
je 0x72a05efe
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
cmp esi, ebx
je 0x72a05efe
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0xc], esi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x72a05eea
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], ebx
je 0x72a05ef4
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0xc]
pop esi
pop edi
jmp 0x72a05e5e
mov edi, 0x100
lea eax, [ebp - 0x118]
push edi
push eax
push dword [0x72a4e7d4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x72a05f34
mov eax, esi
and esi, 0xffff
or esi, 0x80070000
neg eax
sbb eax, eax
and eax, esi
jmp 0x72a05e99
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
mov ebx, 0x7296e470
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x72a05f90
cmp dword [ebp - 0x18], 1
jne 0x72a05f90
lea esi, [ebp - 0x218]
lea eax, [ebp - 0x118]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x72a05fdb
test cl, cl
je 0x72a05f8a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x72a05fdb
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x72a05f6c
xor eax, eax
test eax, eax
je 0x72a05fd4
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x118]
push ecx
push eax
push 1
push 0
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x72a05fd4
push 4
lea ecx, [ebp - 0x14]
pop eax
push eax
push ecx
push eax
push 0
push 0x7296e460
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call esi
xor ebx, ebx
jmp 0x72a05eda
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x72a05f8c
Function at 0x72a05fe2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x72a4e828], 0
je 0x72a05ff3
xor eax, eax
leave
ret
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
and dword [ebp - 4], esi
push 0x7296e484
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x72a06023
push 0x7296a444
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x72a0602f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp dword [ebp - 4], 0
je 0x72a0603e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x72a06294
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [0x72a4f790], esi
je 0x72a06322
mov eax, dword [0x72a4f858]
mov dword [0x72a4f790], esi
test eax, eax
je 0x72a062c5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x72a4f858], 0
lea eax, [ebp - 8]
push 6
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x72a06322
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 8]
push eax
mov ebx, str.vb6_s.dll
lea eax, [ebp - 0x18]
push ebx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
mov dword [0x72a4f858], eax
jne 0x72a06322
and byte [ebp - 6], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call edi
mov dword [0x72a4f858], eax
mov eax, dword [0x72a4f858]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x72a06e4a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
mov esi, ecx
je 0x72a06e5c
and dword [ebp], 0
mov eax, dword [esi + 4]
test al, 2
jne 0x72a06e81
test al, 0x20
jne 0x72a06ea6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, eax
mov eax, dword [esi + 0x20]
mov ecx, edi
sub ecx, eax
cmp ecx, dword [esi + 0x14]
jae 0x72a06e8a
cmp edi, eax
jb 0x72a06e8a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 1
mov ecx, esi
call fcn.72a06dd4
mov dword [esi + 0x24], edi
call ebx
test ebp, ebp
mov dword [esi + 0x20], eax
je 0x72a06ea6
mov dword [ebp], 1
push 1
pop eax
jmp 0x72a06e83