joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57d3c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x5df160
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 4], 0
je 0x57d41d
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043f980
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
push 1
push 0
push 0x5df184
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x57d430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x57d474
cmp dword [ebp - 4], 0xffffffff
je 0x57d474
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x57d476
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x57d480
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 0x818], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x800
lea ecx, [ebp - 0x808]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov edx, dword [ebp - 4]
shr edx, 2
mov dword [ebp - 0x80c], edx
mov dword [ebp - 0x810], 0
jmp 0x57d4d9
mov eax, dword [ebp - 0x810]
add eax, 1
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [ebp - 0x80c]
jge 0x57d5aa
mov edx, dword [ebp - 0x810]
cmp dword [ebp + edx*4 - 0x808], 0x14
jae 0x57d4fd
jmp 0x57d4ca
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp + eax*4 - 0x808]
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x57d5a5
mov dl, byte [0x5db20a]
mov byte [ebp - 0x920], dl
push 0x103
push 0
lea eax, [ebp - 0x91f]
push eax
call fcn.0043fa10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x920]
push ecx
push 0
mov edx, dword [ebp - 0x814]
push edx
call sub.PSAPI.DLL_GetModuleBaseNameA
lea eax, [ebp - 0x920]
push eax
call fcn.00443e88
add esp, 4
lea ecx, [ebp - 0x920]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00441910
add esp, 8
test eax, eax
jne 0x57d598
push 0
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x57d4ca
mov ecx, dword [ebp - 0x818]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x57d660
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57d81f
mov edx, dword [ebp - 8]
push edx
call fcn.0043d429
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040d030
lea ecx, [ebp - 0xc]
call fcn.00408f90
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x57d817
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x57d785
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push str.VarFileInfoTranslation
lea ecx, [ebp - 0xc]
call fcn.00408f90
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x57d780
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
shl ecx, 0x10
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 2]
or ecx, eax
push ecx
push str.StringFileInfo_08x_s
push 0x6048f0
call fcn.0043fe06
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0x6048f0
lea ecx, [ebp - 0xc]
call fcn.00408f90
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x57d780
push 0xff
mov eax, dword [ebp - 0x18]
push eax
push 0x6048f0
call fcn.00441110
add esp, 0xc
mov byte [eax + 0xff], 0
mov dword [ebp - 0x24], 0x6048f0
lea ecx, [ebp - 0xc]
call fcn.00409170
mov eax, dword [ebp - 0x24]
jmp 0x57d824
jmp 0x57d817
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0x5df0ec
lea ecx, [ebp - 0xc]
call fcn.00408f90
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x57d817
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._u._u._u._u
push 0x6048d0
call fcn.0043fe06
add esp, 0x18
mov dword [ebp - 0x28], 0x6048d0
lea ecx, [ebp - 0xc]
call fcn.00409170
mov eax, dword [ebp - 0x28]
jmp 0x57d824
lea ecx, [ebp - 0xc]
call fcn.00409170
mov eax, 0x5db207
mov esp, ebp
pop ebp
ret
Function at 0x57d8a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x57d940
mov dword [ebp - 0x138], 0x128
push 0x124
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.0043fa10
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x57d936
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.0040ad60
add esp, 8
test eax, eax
jne 0x57d922
mov edx, dword [ebp - 0x130]
mov dword [ebp - 4], edx
jmp 0x57d936
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x57d900
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret

Function at 0x57d960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
push 0x90
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.0043fa10
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x57da42
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], edx
cmp dword [ebp - 0xa4], 4
je 0x57d9d1
cmp dword [ebp - 0xa4], 5
je 0x57d9d8
cmp dword [ebp - 0xa4], 6
je 0x57da0d
jmp 0x57da42
mov eax, 1
jmp 0x57da44
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x57d9f8
cmp dword [ebp - 0xa8], 1
je 0x57d9ff
jmp 0x57da06
mov eax, 2
jmp 0x57da44
mov eax, 3
jmp 0x57da44
mov eax, 4
jmp 0x57da44
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0xac], 0
je 0x57da2d
cmp dword [ebp - 0xac], 1
je 0x57da34
jmp 0x57da3b
mov eax, 5
jmp 0x57da44
mov eax, 6
jmp 0x57da44
mov eax, 7
jmp 0x57da44
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret

Function at 0x57da60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00441010
add esp, 8
push 0x5dee78
mov eax, dword [ebp + 8]
push eax
call fcn.00441020
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret

Function at 0x57dac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00441010
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x57db10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5e6068
push 0x44aee0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffdcc
mov eax, dword [0x5ed130]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 0x1e
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.0043fa10
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x240]
push ecx
call fcn.0043fa10
add esp, 0xc
push 0x100
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.0043fa10
add esp, 0xc
mov dword [ebp - 0x13c], 3
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.00441010
add esp, 8
lea edx, [ebp - 0x240]
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x134], eax
mov ecx, 0x14
mov word [ebp - 0x130], cx
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x57dbf9
mov byte [ebp - 0x241], 1
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x241]
jmp 0x57dc3e
mov byte [ebp - 0x242], 0
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x242]
jmp 0x57dc3e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret

Function at 0x57dcc0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x57dd4e
mov edx, dword [ebp - 0x130]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x57dd39
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 8], eax
jmp 0x57dd03
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x57dfe0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x57e05e
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x14]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x57e054
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x57e054
mov byte [ebp - 5], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 5]
test eax, eax
je 0x57e093
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x57e07a
cmp dword [ebp - 0x1c], 1
je 0x57e086
jmp 0x57e093
push 0
push 1
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x57e093
push 0x40004
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
Function at 0x581450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jg 0x581466
xor al, al
jmp 0x5815aa
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x581476
xor al, al
jmp 0x5815aa
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043d429
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
mov dword [ebp - 4], 0
jmp 0x5814b9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jge 0x5815a8
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov edx, dword [ebp - 0x10]
mov dword [ecx + eax], edx
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov dword [edx + eax + 8], 1
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x10]
add ecx, dword [edx + 4]
push ecx
push 0x5813e0
push 0
push 0
call fcn.0044151c
add esp, 0x18
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 4]
mov dword [edx + ecx + 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 4], 0
jne 0x581551
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov dword [edx + eax + 8], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 8], 2
je 0x5815a3
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov dword [edx + eax + 8], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx + eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [eax + ecx + 4], 0
jmp 0x5814b0
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x5818d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push str._s_oleacc.dll
push str.regsvr32.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x5818f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
add eax, 0x110
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x5819aa
mov edx, dword [ebp + 0xc]
add edx, 0x13c
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x2e
je 0x581984
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00441010
add esp, 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x110]
and ecx, 0x10
neg ecx
sbb ecx, ecx
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xc
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
call ecx
add esp, 0xc
movzx edx, al
test edx, edx
jne 0x581984
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x581a94
mov ecx, dword [ebp + 0xc]
add ecx, 0x110
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x581919
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x5df5c0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00441010
add esp, 8
mov edx, dword [ebp + 0xc]
add edx, 0x110
push edx
mov eax, dword [ebp + 0xc]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x581a92
mov ecx, dword [ebp + 0xc]
add ecx, 0x13c
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp eax, 0x2e
je 0x581a6d
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x110]
and edx, 0x10
je 0x581a6d
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00441010
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.0043f980
add esp, 4
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00441010
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005818f0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x581a6d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x581a94
mov eax, dword [ebp + 0xc]
add eax, 0x110
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x5819df
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x581aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE_bclient
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x581b09
mov edx, dword [ebp + 8]
push edx
call fcn.0043f980
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.version
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x581f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x58207b
mov dword [ebp - 0x21c], str.USB_Device_ID:
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0043f980
add esp, 4
push eax
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, 0x1c
call fcn.00438d80
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x1c
call fcn.00401700
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 8]
push ecx
push 8
push str.:_br__br_
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x38
call fcn.00413f00
jmp 0x581fdb
lea ecx, [ebp - 0x224]
call fcn.00402080
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x38
call fcn.00401800
push eax
lea ecx, [ebp - 0x224]
call fcn.0041eaa0
movzx edx, al
test edx, edx
je 0x582071
lea ecx, [ebp - 0x224]
call fcn.00402060
mov ecx, eax
call fcn.00401700
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00441010
add esp, 8
lea ecx, [ebp - 0x218]
push ecx
call fcn.0043f980
add esp, 4
mov dword [ebp - 8], eax
push 4
push str._br_
mov edx, dword [ebp - 8]
lea eax, [ebp + edx - 0x218]
push eax
call fcn.0043dec0
add esp, 0xc
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
add edx, 4
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x581fd0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x583140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5ed130]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0
push 0x20
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0043fa10
add esp, 0xc
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2c], 0
jmp 0x583187
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 1
jae 0x5831cd
mov edx, dword [ebp - 0x2c]
shl edx, 4
add edx, 0x5df5d0
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x14], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0xc], ecx
push 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x5831cb
jmp 0x5831cd
jmp 0x58317e
cmp dword [ebp - 0x28], 0
je 0x5831f1
push 0
push 0
push 0
push 0x5830c0
push 0
push 0
call fcn.0044151c
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dd0c
mov esp, ebp
pop ebp
ret
Function at 0x4021b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x4e77ae
mov esi, edx
push ebx
mov edi, ecx
call fcn.00404843
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push ebx
call fcn.004047ca
xor ebx, ebx
mov dword [ebp - 0x10], 1
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 8], ebx
mov byte [ebp - 1], bl
jb 0x4021ef
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402297
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x402216
mov eax, dword [esi]
jmp 0x402218
mov eax, esi
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0xea
jne 0x402292
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.0048f9a2
cmp dword [esi + 0x14], 0x10
mov edi, eax
pop ecx
jb 0x402251
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push edi
mov byte [edi + eax], 0
call fcn.00404843
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.004047ca
push edi
call fcn.004a43b1
pop ecx
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x402292
mov al, 1
jmp 0x402299
push dword [ebp - 0xc]
call ebx
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret