joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4e8568
xor eax, eax
jmp 0x4e85d4
xor edx, edx
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 4]
push ecx
push 0x7dfc40
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e85d1
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e85c9
push dword [ebp + 0xc]
push 0x7dfc67
lea eax, [ebp - 0x110]
push eax
call fcn.0067132c
add esp, 0xc
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4e85d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [0x6eba04]
test eax, eax
je 0x4e864c
mov edx, dword [ebp + 8]
test edx, edx
je 0x4e864c
lea ecx, [ebp - 4]
push ecx
push 0x7dfc6a
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e864c
push dword [ebp + 0xc]
push 0x7dfc91
lea eax, [ebp - 0x104]
push eax
call fcn.006712b0
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
call fcn.0066ce38
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x4e869c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push 0x7dfc94
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e870a
mov dword [ebp - 0xc], 0x100
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push edx
push 0
push str.XPBurn
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e8702
lea ecx, [ebp - 0x10]
push ecx
push 0x7dfcc2
lea eax, [ebp - 0x110]
push eax
call fcn.0067132c
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4e8714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push 0x7dfcc5
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e8782
mov dword [ebp - 0xc], 0x100
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push edx
push 0
push str.XPErase
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e877a
lea ecx, [ebp - 0x10]
push ecx
push 0x7dfcf4
lea eax, [ebp - 0x110]
push eax
call fcn.0067132c
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e958c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [0x7dfa78]
test edx, edx
je 0x4e95d5
mov dword [ebp - 0x74], 0x40
lea ecx, [ebp - 0x74]
push ecx
call dword [0x7dfa78]
test eax, eax
je 0x4e95d5
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4e95fb
lea eax, [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00674923
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sar edx, 3
sub dword [ebp - 0x14], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4eb598
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push str.SoftwareAheadShared
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4eb61e
mov dword [ebp - 0xc], 0x400
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x410]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x7dff15
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4eb616
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x4eb616
lea eax, [ebp - 0x410]
push eax
push 0xb3b5c0
call fcn.0066ce08
add esp, 8
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4eb6cc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
call fcn.004eb628
test eax, eax
je 0x4eb6e5
mov eax, 1
jmp 0x4eb743
call sub.KERNEL32.DLL_GetVersion
mov dword [ebp - 4], eax
mov dl, byte [ebp - 4]
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp eax, 5
jb 0x4eb741
push 0x830b18
push 0x7dff3b
lea edx, [ebp - 0x110]
push edx
call fcn.006712b0
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x4eb741
mov dword [0x7dfa60], 2
mov eax, 1
jmp 0x4eb743
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ed030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ed064
xor eax, eax
jmp 0x4ed129
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x100
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x114]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ed0a9
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4ed129
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x100
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push str.CurrentBuild
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ed0eb
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4ed129
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._d._d
lea edx, [ebp - 0x114]
push edx
call fcn.0067132c
add esp, 0x10
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x14], ecx
push dword [ebp - 0x14]
call fcn.00674df8
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4f7e84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff638
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4f7e9b
xor eax, eax
jmp 0x4f80be
push 0x7e22c7
push dword [ebp + 8]
call fcn.0066f334
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4f7ebc
xor eax, eax
jmp 0x4f80be
push 0
push 0
push dword [ebp - 4]
call fcn.0066f6b4
add esp, 0xc
push dword [ebp - 4]
push 1
push 0x8c0
lea edx, [ebp - 0x8c4]
push edx
call fcn.0066f614
add esp, 0x10
cmp eax, 1
je 0x4f7ef9
push dword [ebp - 4]
call fcn.0066ee38
pop ecx
xor eax, eax
jmp 0x4f80be
lea edx, [ebp - 0x8c4]
push edx
call fcn.0044b6a0
pop ecx
test eax, eax
jne 0x4f7f1a
push dword [ebp - 4]
call fcn.0066ee38
pop ecx
xor eax, eax
jmp 0x4f80be
xor edx, edx
mov dword [0x7e225c], edx
push 0x831dcf
push str._sprj_log.txt
lea ecx, [ebp - 0x9c8]
push ecx
call fcn.006712b0
add esp, 0xc
push 0x7e22d9
lea eax, [ebp - 0x9c8]
push eax
call fcn.0066f334
add esp, 8
mov dword [0x7e2260], eax
mov edx, dword [0x7e2260]
test edx, edx
je 0x4f7f9a
push dword [ebp + 8]
push str.Project:__s_n
push dword [0x7e2260]
call fcn.0066f368
add esp, 0xc
push 0x7e22ea
push dword [0x7e2260]
call fcn.0066f368
add esp, 8
push 0x7e2314
push dword [0x7e2260]
call fcn.0066f368
add esp, 8
mov ecx, dword [0x6fb3a4]
mov dword [ecx + 0x50], 0x8c0
push dword [ebp - 4]
push dword [0x6fb3a4]
call fcn.004f7d72
add esp, 8
mov eax, dword [0x7e2260]
test eax, eax
je 0x4f8003
push 0x7e2335
push dword [0x7e2260]
call fcn.0066f368
add esp, 8
mov edx, dword [0x7e225c]
test edx, edx
je 0x4f7ff7
push dword [0x7e225c]
push 0x7e2356
push dword [0x7e2260]
call fcn.0066f368
add esp, 0xc
push dword [0x7e2260]
call fcn.0066ee38
pop ecx
mov ecx, dword [0x7e225c]
test ecx, ecx
je 0x4f8094
mov eax, dword [0x7e2260]
test eax, eax
je 0x4f8068
push 0x61b3
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
push 0
call fcn.00462af8
add esp, 8
test eax, eax
je 0x4f8094
push 5
push 0x831dcf
push 0
lea edx, [ebp - 0x9c8]
push edx
push 0x7e236b
push dword [0x6eba34]
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x4f8094
push 0x61b2
call fcn.00402b9c
pop ecx
push eax
push 0xa00988
call fcn.006712b0
add esp, 8
push 0xa00988
push dword [0x6eba34]
call fcn.00462ac8
add esp, 8
xor ecx, ecx
mov dword [0x7e2260], ecx
push 0x104
lea eax, [ebp - 0x313]
push eax
call fcn.004196f8
add esp, 8
push dword [ebp - 4]
call fcn.0066ee38
pop ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4fba06
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcac
push dword [ebp + 8]
lea eax, [ebp - 0x354]
push eax
call fcn.0066ce08
add esp, 8
push 0x7e379c
lea edx, [ebp - 0x354]
push edx
call fcn.0066cd2c
add esp, 8
lea ecx, [ebp - 0x14c]
push ecx
lea eax, [ebp - 0x354]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4fbb3d
push 0x7e37a1
lea edx, [ebp - 0x120]
push edx
call fcn.0066cdbc
add esp, 8
test eax, eax
je 0x4fbb1e
push 0x7e37a3
lea ecx, [ebp - 0x120]
push ecx
call fcn.0066cdbc
add esp, 8
test eax, eax
je 0x4fbb1e
test byte [ebp - 0x14c], 0x10
je 0x4fbae0
push dword [ebp + 8]
lea eax, [ebp - 0x250]
push eax
call fcn.0066ce08
add esp, 8
push 0x7e37a6
lea edx, [ebp - 0x250]
push edx
call fcn.0066cd2c
add esp, 8
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x250]
push eax
call fcn.0066cd2c
add esp, 8
lea edx, [ebp - 0x250]
push edx
call fcn.004fba06
pop ecx
jmp 0x4fbb1e
inc dword [0x7e369c]
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 8], eax
push 0
push 0x800
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add eax, 0x800
adc edx, 0
sub eax, 1
sbb edx, 0
call fcn.00674923
add dword [0x7e36a0], eax
lea edx, [ebp - 0x14c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4fba54
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x509cd4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp edx, 4
jne 0x509d0c
push dword [0x6ebc4c]
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x238]
mov edx, dword [ebp + 0x10]
add eax, edx
push eax
push dword [ebp + 0xc]
call fcn.0047630c
add esp, 0x10
jmp 0x509df6
mov ecx, dword [0x7e5a38]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
imul dword [edx + 0xc]
cdq
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x228]
adc edx, dword [ecx + 0x22c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp edx, 0xffffffff
jne 0x509d60
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x509d60
xor eax, eax
jmp 0x509df6
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
imul edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
cmp edx, 0x930
jne 0x509d91
push 0
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x20]
push dword [ebp + 0xc]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_ReadFile
jmp 0x509df1
mov dword [ebp - 0x28], 0x8685f8
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jge 0x509df1
push 0x930
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.0066cc18
add esp, 0xc
add dword [ebp - 0x24], 0x930
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
add dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x14]
cmp edx, ecx
jl 0x509dc1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x50a550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
add eax, 0x128
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x3b0], eax
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
cmp ecx, 4
je 0x50a599
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x280]
test edx, edx
je 0x50a5a7
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x230]
mov dword [ebp - 0xc], eax
jmp 0x50a5c7
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
cdq
push edx
push eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x230]
mov edx, dword [ecx + 0x234]
call fcn.0067499b
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
sub eax, edx
imul ecx, eax, 0x930
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 0
push dword [ebp + 8]
push 0x509dfc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esp, ebp
pop ebp
ret
Function at 0x52dffc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov eax, dword [ebp + 8]
test eax, eax
jne 0x52e013
xor eax, eax
jmp 0x52e282
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0066cc88
add esp, 0xc
xor ecx, ecx
mov dword [0x80c0a0], ecx
mov dword [0xbcca78], 1
mov dword [0xbcca74], 0x300
push dword [ebp + 8]
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x80c0a4], eax
mov eax, dword [0x80c0a4]
test eax, eax
jne 0x52e062
xor eax, eax
jmp 0x52e282
push 1
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca48], eax
mov edx, dword [0xbcca48]
test edx, edx
jne 0x52e08a
call fcn.0052e288
xor eax, eax
jmp 0x52e282
call dword [0xbcca48]
mov dword [0xbcca70], eax
mov edx, dword [0xbcca70]
cmp edx, 0xffffffff
je 0x52e0ab
mov ecx, dword [0xbcca70]
cmp ecx, 0xfffffffe
jne 0x52e0b7
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 3
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca68], eax
mov edx, dword [0xbcca68]
test edx, edx
jne 0x52e0df
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 4
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca4c], eax
mov edx, dword [0xbcca4c]
test edx, edx
jne 0x52e107
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 5
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca50], eax
mov edx, dword [0xbcca50]
test edx, edx
jne 0x52e12f
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 6
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca6c], eax
mov edx, dword [0xbcca6c]
test edx, edx
jne 0x52e157
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 7
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca54], eax
mov edx, dword [0xbcca54]
test edx, edx
jne 0x52e17f
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 8
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca58], eax
mov edx, dword [0xbcca58]
test edx, edx
jne 0x52e1a7
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 9
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca60], eax
mov edx, dword [0xbcca60]
test edx, edx
jne 0x52e1cf
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 0xa
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca64], eax
mov edx, dword [0xbcca64]
test edx, edx
jne 0x52e1f7
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 0xd
push dword [0x80c0a4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbcca5c], eax
mov edx, dword [0xbcca5c]
test edx, edx
jne 0x52e21c
call fcn.0052e288
xor eax, eax
jmp 0x52e282
push 0xbcca74
call fcn.0052e2a8
pop ecx
push 0xbcca78
call fcn.0052e2fc
pop ecx
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x52e255
imul ecx, dword [ebp - 4], 0x118
add ecx, 0xbca748
push ecx
push dword [ebp - 4]
call fcn.0052e5f0
add esp, 8
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [0xbcca78]
cmp eax, edx
jl 0x52e239
push 0xbcca80
call dword [0xbcca60]
pop ecx
call fcn.0052e6a0
mov dword [0x80c0a0], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x52fc44
Capabilities:
Create process on windows
Get common file path
Read file on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x418
push eax
push str._sautorun.inf
lea edx, [ebp - 0x114]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea ecx, [ebp - 0x114]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movsx edx, byte [eax + 0x418]
push edx
push str.explorer.exe__e__root__c:_
lea ecx, [ebp - 0x114]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x52fd58
call fcn.00560fe8
test eax, eax
jne 0x52fd50
lea edx, [ebp - 0x24c]
push edx
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
je 0x52fd50
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
jne 0x52fd50
mov eax, dword [ebp - 0x228]
cmp eax, 0x10000
jae 0x52fd50
mov edx, dword [ebp - 0x228]
add edx, 0xa
push edx
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x52fd50
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x228]
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x52fd48
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x228]
cmp edx, ecx
jne 0x52fd48
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0052fa38
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LocalFree
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x218]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, dword [ebp - 4]
add ecx, 0x418
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 5
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_WinExec
lea edx, [ebp - 0x218]
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x53bcac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0x14
push 0
push dword [ebp + 0xc]
call fcn.0066cc88
add esp, 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x53bd23
push str.c_APEDecompress_Create
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
push str.c_APEDecompress_Destroy
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
push str.c_APEDecompress_GetData
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 0xc]
mov dword [edx + 8], eax
push str.c_APEDecompress_Seek
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
push str.c_APEDecompress_GetInfo
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x53bd54
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
test edx, edx
je 0x53bd54
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
test eax, eax
je 0x53bd54
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x53bd54
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
jne 0x53bd59
or eax, 0xffffffff
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x53be9c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [ebp + 8]
mov edx, dword [eax]
test edx, edx
je 0x53beb8
mov eax, 1
jmp 0x53bfff
push 0x816ea8
call sub.KERNEL32.DLL_LoadLibraryA
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
jne 0x53befa
push 0x830b18
push 0x816eaf
lea edx, [ebp - 0x10c]
push edx
call fcn.006712b0
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
jne 0x53bf0a
xor eax, eax
jmp 0x53bfff
push str.c_APECompress_Create
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
push str.c_APECompress_Destroy
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
push str.c_APECompress_Start
mov ecx, dword [ebp + 8]
push dword [ecx]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
push str.c_APECompress_AddData
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
push str.c_APECompress_Finish
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x53bfa5
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x53bfa5
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
test edx, edx
je 0x53bfa5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x53bfa5
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x14]
test ecx, ecx
jne 0x53bfa9
xor eax, eax
jmp 0x53bfff
push 0x816f27
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x53bfd6
push 0
push 1
push 0xf82
call dword [ebp - 4]
test eax, eax
je 0x53bfd6
xor eax, eax
jmp 0x53bfff
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call dword [ecx + 4]
mov edx, dword [ebp + 8]
mov dword [edx + 0x11c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x11c]
test ecx, ecx
jne 0x53bffa
xor eax, eax
jmp 0x53bfff
mov eax, 1
mov esp, ebp
pop ebp
ret