joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5c32d8]
xor edx, edx
cmp eax, edx
jne 0x468e96
xor eax, eax
mov byte [eax + 0x5c31d8], al
inc eax
cmp eax, 0x100
jl 0x468e7e
mov dword [0x5c32d8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5c31d8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x468f27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x468efa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x468ec8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x468f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x468f83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x468f6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49cb4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00470230
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x57ac24
call fcn.0048e5e4
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46f9a3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048e5e4
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46f99c
push 0
mov ecx, eax
call fcn.00466aa0
mov dword [esi + 0xc], eax
jmp 0x46f9a5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46f9a5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x490c47
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x490c7f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048ecfe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048ecd6
jmp 0x490c8b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49233d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49237f
call fcn.00497df1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49237f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x492376
xor eax, eax
jmp 0x492387
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049238d
pop edi
pop esi
pop ebx
ret 4

Function at 0x498321
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49834f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49836d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00498287
jmp 0x49836d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49836d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00498287
test edi, edi
mov eax, edi
jne 0x498357
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001020
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
mov esi, dword [ebp + 0xc]
xor edx, edx
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
lea esp, [esp]
lea esp, [esp]
nop
mov dl, byte [esi]
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x10001060]
add esi, 1
sub ecx, 1
jne 0x10001040
not eax
pop edx
pop ecx
pop esi
leave
ret 8

Function at 0x1000149b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_FindResourceA
or eax, eax
jne 0x100014bc
jmp 0x100014de
push eax
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x1000d880], eax
pop eax
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_LoadResource
or eax, eax
jne 0x100014db
jmp 0x100014de
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x10001545
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov byte [ebp - 0x401], 0
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.KERNEL32.DLL_lstrcpyA
xor ecx, ecx
jmp 0x1000156b
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x1000156a
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
push ebx
call fcn.10001657
or eax, eax
je 0x100015d2
mov byte [ebx], 0
test dword [ebp + 0x14], 8
je 0x10001596
mov edx, 1
jmp 0x10001598
xor edx, edx
push edx
push dword [ebp + 0x10]
push esi
push eax
push ebx
call sym.dup2patcher.dll_GetRegString
push section..data
push ebx
call fcn.10001607
test dword [ebp + 0x14], 1
je 0x100015be
push ebx
call fcn.100015de
cmp byte [ebx], 0
je 0x100015d2
push ebx
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetEnvironmentVariableA
mov byte [ebp - 0x401], al
popal
movzx eax, byte [ebp - 0x401]
leave
ret 0x10
Function at 0x100016e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x1000189f
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
push ebx
call sub.user32.dll_LoadBitmapA
or eax, eax
jne 0x10001710
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x18]
push ebx
call sub.user32.dll_LoadBitmapA
or eax, eax
jne 0x10001723
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call sub.user32.dll_GetDlgItem
test eax, eax
je 0x1000189f
mov esi, eax
push ebx
lea ebx, [ebp - 0x38]
push ebx
push esi
call sub.user32.dll_GetWindowRect
lea edi, [ebp - 0x28]
push edi
push dword [ebp + 0xc]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx]
sub eax, dword [edi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
sub eax, dword [edi + 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.100018b0
pop ebx
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x1000178e
lea esi, [ebp - 0x68]
mov dword [esi], 0x30
mov dword [esi + 4], 0x2000
mov dword [esi + 8], 0x10001980
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], 0x10
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x1000177d
mov dword [esi + 0x18], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], 0
push esi
call sub.user32.dll_RegisterClassExA
push 0
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0x50000000
push 0
push 0x1000177d
push 0x20
call sub.user32.dll_CreateWindowExA
mov ebx, eax
push dword [ebp - 8]
push 0
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0xc]
push 4
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x10]
push 8
push ebx
call sub.user32.dll_SetWindowLongA
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push ebx
push 0
push 0
push 0
push 0
push 0x5000000e
push 0
push str.STATIC
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 4], eax
push dword [ebp - 8]
push 0
push 0x172
push eax
call sub.user32.dll_SendMessageA
push edi
push dword [ebp - 4]
call sub.user32.dll_GetWindowRect
push dword [ebp - 4]
push 0xc
push ebx
call sub.user32.dll_SetWindowLongA
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 4]
mov eax, dword [edi + 8]
sub eax, dword [edi]
push 2
push ecx
push eax
push 0
push 0
push 0
push ebx
call sub.user32.dll_SetWindowPos
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x10001b8b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x10001bcc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
leave
ret 4
Function at 0x10001fe3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
push edi
push ebx
push ecx
push edx
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push 0x1000d0ef
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_lstrcatA
xor edi, edi
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
or eax, eax
je 0x100020b2
mov dword [0x1000d89e], eax
mov esi, str.BASSMOD_Init
mov ebx, 0x1000d88a
jmp 0x10002071
push esi
push dword [0x1000d89e]
call sub.KERNEL32.DLL_GetProcAddress
or eax, eax
je 0x1000205a
mov dword [ebx], eax
add ebx, 4
jmp 0x10002052
inc esi
cmp byte [esi], 0
jne 0x10002051
inc esi
jmp 0x10002071
push dword [0x1000d89e]
call sub.KERNEL32.DLL_FreeLibrary
mov dword [0x1000d89e], 0
jmp 0x100020b2
cmp byte [esi], 0
jne 0x1000203a
push 0
push 0xac44
push 0xffffffffffffffff
call dword [0x1000d88a]
cmp eax, 1
jne 0x100020b2
call dword [0x1000d88e]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add eax, 4
push 6
push ecx
push 0
push eax
push 1
call dword [0x1000d892]
cmp eax, 1
jne 0x100020b2
call dword [0x1000d896]
inc edi
mov eax, edi
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x10002244
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
popal
leave
ret 4

Function at 0x10002313
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x6b
push dword [0x1000d8a6]
call sub.user32.dll_IsDlgButtonChecked
cmp eax, 1
jne 0x10002363
mov esi, 0x1000dd11
push dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_lstrcpyA
push str..BAK
push esi
call sub.KERNEL32.DLL_lstrcatA
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x1000235c
push 0
push esi
push dword [ebp + 8]
call sub.KERNEL32.DLL_CopyFileA
mov al, 0
jmp 0x1000235e
mov al, 1
mov byte [0x1000e52d], al
popal
leave
ret 4

Function at 0x10002368
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x6b
push dword [0x1000d8a6]
call sub.user32.dll_IsDlgButtonChecked
cmp eax, 1
jne 0x1000240c
mov esi, 0x1000dd11
cmp dword [ebp + 8], 0
jne 0x100023b4
cmp byte [0x1000e52d], 0
jne 0x100023a3
push 0
push 0x1000d911
push esi
call sub.KERNEL32.DLL_CopyFileA
cmp byte [0x1000e52d], 0
jne 0x1000240c
push esi
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x1000240c
mov eax, 1
cmp byte [0x1000e95c], 1
jne 0x100023d0
cmp byte [0x1000e95d], 0
jne 0x100023d0
mov eax, 0
cmp eax, 1
jne 0x1000240a
push 0x400
push 0x10012e3d
push 0xd
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10012e3d
call sym.dup2patcher.dll_AddMsg
push esi
call sym.dup2patcher.dll_AddMsg
push dword [0x1000e511]
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
jmp 0x1000240c
jmp 0x100023a3
popal
leave
ret 4
Function at 0x10002411
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
lea esi, [ebp - 0x400]
push dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_lstrcpyA
push str..tmp
push esi
call sub.KERNEL32.DLL_lstrcatA
push esi
call sub.KERNEL32.DLL_DeleteFileA
push esi
push dword [ebp + 8]
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
jne 0x1000245e
push 1
push dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_CopyFileA
cmp eax, 1
jne 0x1000245e
mov eax, 1
pop esi
leave
ret 4
Function at 0x100028d8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x1000e515]
or esi, esi
je 0x100029bd
test dword [ebp + 0xc], 0x20
je 0x10002912
call fcn.100029ef
or eax, eax
je 0x10002908
push 0x1000d19a
call sym.dup2patcher.dll_AddMsg
jmp 0x10002912
push str.PE_
call sym.dup2patcher.dll_AddMsg
push dword [0x1000e521]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [0x1000e525]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0x1000e51d
push dword [0x1000e529]
push esi
call sub.KERNEL32.DLL_SetFilePointer
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push esi
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp + 8]
call fcn.10002368
push dword [0x1000e511]
push 0x1000d911
call sub.KERNEL32.DLL_SetFileAttributesA
test dword [ebp + 0xc], 0x10
je 0x100029bd
push 0
push 0x82
push 3
push 0
push 0
push 0xc0000000
push 0x1000d911
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x1000e515], eax
cmp eax, 0xffffffff
je 0x100029bd
push 0x1000f191
push 0x1000f189
push 0x1000f181
push dword [0x1000e515]
call sub.KERNEL32.DLL_SetFileTime
push dword [0x1000e515]
call sub.KERNEL32.DLL_CloseHandle
push 0x1000d1c8
call sym.dup2patcher.dll_AddMsg
popal
leave
ret 8

Function at 0x10002a7d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
push 1
push 8
push dword [0x1000d8a2]
call fcn.10001460
or eax, eax
je 0x10002ad1
mov esi, eax
push 0x1000e111
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push str._bassmod.dll
push 0x1000e111
call sub.KERNEL32.DLL_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
push 0x1000e111
call sym.dup2patcher.dll_write_disk_file
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret
Function at 0x100038cc
Capabilities:
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
push esi
push edi
push ebx
push 0x70
push dword [0x1000d8a6]
call sub.user32.dll_GetDlgItem
or eax, eax
je 0x10003a8a
mov dword [ebp - 0x404], eax
push 0
push dword [ebp - 0x404]
call sub.user32.dll_ShowWindow
mov esi, 0x1000f15f
push 9
push dword [0x1000d8aa]
call fcn.10002a53
mov dword [esi + 4], eax
push eax
call fcn.10006c90
or eax, eax
je 0x10003a8a
push dword [0x1000d8a6]
pop dword [esi]
lea ebx, [ebp - 0x414]
push ebx
push dword [ebp - 0x404]
call sub.user32.dll_GetWindowRect
lea edi, [ebp - 0x424]
push edi
push dword [0x1000d8a6]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx]
sub eax, dword [edi]
mov dword [esi + 8], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, dword [edi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
lea ecx, [esi + 0xc]
push ecx
push eax
push dword [0x1000d8a6]
call fcn.100018b0
push 1
push 0x12
push dword [0x1000d8a2]
call fcn.10001460
or eax, eax
je 0x10003990
mov eax, dword [eax + 1]
mov dword [esi + 0x1d], eax
push 1
push 0xb
push dword [0x1000d8a2]
call fcn.10001460
or eax, eax
je 0x100039ab
mov eax, dword [eax + 1]
jmp 0x100039bd
cmp dword [esi + 0x1d], 0
je 0x100039b8
mov eax, 0xfe
jmp 0x100039bd
mov eax, 0xff
mov byte [esi + 0x1c], al
lea ebx, [ebp - 0x460]
push 0x3c
push ebx
call sub.KERNEL32.DLL_RtlZeroMemory
mov dword [ebx], 7
mov byte [ebx + 0x17], 1
mov byte [ebx + 0x1a], 4
push 0x1000d2de
lea eax, [ebx + 0x1c]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 1
push 0x13
push dword [0x1000d8a2]
call fcn.10001460
or eax, eax
je 0x10003a7b
mov edi, eax
push dword [edi + 0x11]
pop dword [esi + 0x18]
push dword [edi + 5]
pop dword [ebx]
test dword [edi + 9], 1
je 0x10003a1a
mov dword [ebx + 0x10], 0x2bc
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [edi + 0x15]
push edx
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea edx, [edi + 0x95]
push edx
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea edx, [edi + 0x9b]
mov ecx, dword [edi + 0xd]
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
call fcn.10003a8f
lea edx, [edi + 0x15]
cmp byte [edx], 0
jne 0x10003a71
xor ebx, ebx
jmp 0x10003a7b
push edx
lea eax, [ebx + 0x1c]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push ebx
call sub.gdi32.dll_CreateFontIndirectA
mov dword [esi + 0x14], eax
push esi
call fcn.10001b8b
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10004616
Capabilities:
Get file size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
push ebx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x54], ecx
add ecx, ecx
mov dword [ebp - 0x58], ecx
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x5c], ecx
mov esi, dword [ebp + 8]
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x1000d911
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x10004787
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x1000477d
mov dword [ebp - 0x34], eax
push 0x1000d6a7
call sym.dup2patcher.dll_AddMsg
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
push dword [ebp - 0x5c]
pop dword [ebp - 0x4c]
mov dword [ebp - 8], 0
push dword [ebp - 0x4c]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 2
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x10004737
mov dword [ebp - 0x38], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
cmp edx, 0xffffffff
je 0x100046e9
sub edx, dword [ebp - 8]
push edx
cmp dword [ebp - 0x4c], 0
je 0x100046fa
mov edx, dword [ebp - 0x58]
add edx, ecx
sub edx, 1
jmp 0x10004700
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x44]
push edx
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [ebp - 0x38]
call sym.dup2patcher.dll_SearchAndReplace
add dword [ebp - 8], eax
or dword [ebp - 4], eax
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_UnmapViewOfFile
cmp dword [ebp - 0x4c], 0
jne 0x10004739
jmp 0x10004766
jmp 0x10004775
mov eax, dword [ebp - 0x58]
mov edx, 0
add dword [ebp - 0x44], eax
adc dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x48], ecx
jne 0x10004761
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x3c]
jb 0x10004761
mov dword [ebp - 0x4c], 0
jmp 0x100046c2
mov ecx, dword [esi]
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x100046a1
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x10004787
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10005516
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push esi
push edi
push ebx
mov byte [ebp - 1], 0
push 0x400
push 0x1001e23d
push 4
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001e23d
call sym.dup2patcher.dll_AddMsg
lea eax, [ebp - 0x401]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push str._regpatch.reg
lea eax, [ebp - 0x401]
push eax
call sub.KERNEL32.DLL_lstrcatA
mov esi, dword [ebp + 8]
test dword [esi + 5], 8
je 0x1000557a
call fcn.100040cf
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x410], eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0x408], eax
lea eax, [esi + 9]
push dword [ebp - 0x408]
push eax
call fcn.100057a2
mov ecx, dword [ebp - 0x408]
test dword [esi + 5], 1
je 0x100055fb
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x414], eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
push dword [ebp - 0x408]
call fcn.100056f6
mov ecx, dword [ebp - 0x40c]
push eax
push ecx
lea eax, [ebp - 0x401]
push eax
call sym.dup2patcher.dll_write_disk_file
test eax, eax
je 0x1000569c
mov edi, 0x1000d911
push str._s__
push edi
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x401]
push eax
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0x1000d701
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0x3c
lea eax, [ebp - 0x450]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x44c], 0x40
mov dword [ebp - 0x444], 0x1000d6f7
mov dword [ebp - 0x440], str.regedit.exe
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x434], 0
lea eax, [ebp - 0x450]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0xffffffffffffffff
push dword [ebp - 0x418]
call sub.KERNEL32.DLL_WaitForSingleObject
mov byte [ebp - 1], 1
push 0x4000
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call sub.KERNEL32.DLL_VirtualFree
test dword [esi + 5], 1
je 0x100056d1
push 0x4000
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call sub.KERNEL32.DLL_VirtualFree
lea eax, [ebp - 0x401]
push eax
call sub.KERNEL32.DLL_DeleteFileA
test dword [esi + 5], 8
je 0x100056eb
call fcn.100040fa
movzx eax, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x100056f6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push ebx
mov eax, dword [ebp + 0x10]
add eax, 0x100000
mov dword [ebp - 8], eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov esi, dword [ebp - 4]
or eax, eax
je 0x10005783
push dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_lstrcmpA
or eax, eax
je 0x10005778
mov bl, 0
jmp 0x1000576e
lodsb al, byte [esi]
cmp word [esi], 0x5b0a
jne 0x10005750
mov bl, 1
cmp al, 0x5c
jne 0x10005764
or bl, bl
jne 0x10005764
cmp byte [esi], 0x5c
je 0x10005764
cmp byte [esi - 2], 0x5c
je 0x10005764
stosb byte es:[edi], al
stosb byte es:[edi], al
cmp word [esi], 0xd5d
jne 0x1000576e
mov bl, 0
cmp byte [esi], 0
jne 0x10005746
mov byte [edi], 0
jmp 0x10005783
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_lstrcpyA
push 0x4000
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualFree
push dword [ebp + 0xc]
call fcn.10006c90
pop ebx
pop edi
pop esi
leave
ret 0xc