joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc40100
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0xbcd15b
call fcn.00bc12f8
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0xb178dc
mov dword [esi + 4], 0xb178cc
mov dword [esi + 8], 0xb178bc
mov dword [esi + 0xc], 0xb178ac
lea eax, [esi + 0x55c]
mov dword [ebp - 4], 4
cmp word [eax], 0
je 0xc4015c
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0xc4015c
mov ecx, dword [ebp + 4]
mov edx, 0x91
push 0xb3f288
call fcn.00c2616d
mov ecx, esi
call fcn.00c431f9
lea ecx, [esi + 0x780]
call fcn.00b88a49
lea ecx, [esi + 0x77c]
call fcn.00b8ba6f
lea ecx, [esi + 0x778]
call fcn.00b8ba6f
lea ecx, [esi + 0x774]
call fcn.00b8ba6f
mov dword [esi + 0x14], 0xc0000001
call fcn.00bc12c6
ret

Function at 0xc42ba1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, 0x104
mov word [edi], ax
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
jne 0xc42c12
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc42bf4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc42bfb
mov esi, 0x80004005
mov edx, 0x2be
mov ecx, dword [ebp + 4]
push esi
push 0xb3f288
call fcn.00bc2921
mov eax, esi
jmp 0xc42c8a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateGuid]
mov esi, eax
test esi, esi
jns 0xc42c2a
mov edx, 0x2c1
jmp 0xc42c00
push 0x27
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jg 0xc42c5a
mov ecx, dword [ebp + 4]
mov esi, 0x80004005
push esi
push 0xb3f288
mov edx, 0x2c4
call fcn.00bc28ed
jmp 0xc42c0e
push 0xb3f27c
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x78]
push eax
push 0xb3f368
push ebx
push edi
call fcn.00b55e8f
mov esi, eax
add esp, 0x18
test esi, esi
jns 0xc42c88
mov edx, 0x2c6
jmp 0xc42c00
xor eax, eax
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
Function at 0xc43a21
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x214]
xor ebx, ebx
mov esi, edx
push 0xffffffffffffffff
push 0xb2ba6c
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
call fcn.00b7ace0
push 0xb2a700
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0xc43b63
xor esi, esi
lea ecx, [ebp - 0x220]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
call fcn.00b7ace0
lea ecx, [ebp - 0x220]
call fcn.00c4455d
test eax, eax
js 0xc43b54
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.00bc259b
mov dword [ebp - 0x25c], esi
lea eax, [ebp - 0x208]
push 0x202
xor esi, esi
push esi
push eax
call fcn.00bc259b
add esp, 0x18
mov dword [ebp - 0x248], 0x101
lea eax, [ebp - 0x208]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x24c], eax
call fcn.00b7abdc
lea eax, [ebp - 0x25c]
push eax
push esi
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0xc43b3a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc43b33
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc43b3a
mov ebx, 0x80004005
shr ebx, 0x1f
xor bl, 1
je 0xc43b54
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x214]
call fcn.00c43d8f
lea ecx, [ebp - 0x220]
call fcn.00b7a9bd
test bl, bl
jne 0xc43b73
push 0xb3f378
lea ecx, [ebp - 0x214]
call fcn.00c43d8f
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x214]
and dword [ebp - 0x214], 0
and dword [ebp - 0x20c], 0
and dword [ebp - 0x210], 0
mov dword [edi], eax
call fcn.00b7a9bd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4

Function at 0xc44a75
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx + 0xc], edx
je 0xc44ad4
test edx, edx
mov dword [ecx + 0xc], edx
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0xb288f0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc44ad1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0xb2b1f4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 4
Function at 0xc47f93
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov ebx, ecx
cmp dword [edi + 0x10], 4
jb 0xc47fb8
mov al, 1
cmp dword [edi + 0x448], ecx
je 0xc47fba
mov al, cl
cmp byte [ebp + 0x10], cl
je 0xc480d2
test al, al
je 0xc48096
mov ebx, dword [ebp + 0x14]
mov esi, ecx
test ebx, ebx
je 0xc48053
push ecx
push dword [ebp + 0x18]
push 0x419
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0xc48066
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetCursorPos]
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
push 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_MapWindowPoints]
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x445
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov ecx, dword [ebp - 8]
cmp ecx, eax
jne 0xc4803c
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
push 2
shl esi, 0x10
pop ebx
or esi, eax
jmp 0xc48068
push ecx
push ebx
push 0xfffffffffffffffe
mov dword [ebp - 4], 1
call fcn.00c46c45
mov ebx, dword [ebp - 4]
mov esi, eax
jmp 0xc48068
movzx esi, word [4]
mov ebx, ecx
movzx eax, word [ecx]
shl esi, 0x10
or esi, eax
jmp 0xc4806a
mov ebx, esi
xor ecx, ecx
cmp dword [edi + 0x10], 4
jb 0xc4807f
push 0xffffffffffffffff
push ecx
push esi
push 0x406
push edi
call fcn.00c49864
mov esi, dword [ebp + 0xc]
xor eax, eax
push 0x16
push eax
push eax
push eax
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
jmp 0xc48099
mov esi, dword [ebp + 0xc]
push 0xc451b0
call fcn.00c4a4f7
mov ecx, eax
call fcn.00b54cb0
test al, al
je 0xc480e5
push 0xc451b0
call fcn.00c4a4f7
mov ecx, dword [ebp - 0xc]
xor eax, eax
add ecx, 0x60
cmp esi, ecx
setne al
xor esi, esi
push eax
push esi
push edi
push ebx
call fcn.00c45e10
jmp 0xc480e5
test al, al
je 0xc480e5
push 0xffffffffffffffff
push ecx
push ecx
push 0x407
push edi
call fcn.00c49864
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0xc4894c
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
call fcn.00c1c84c
cmp dword [ebp + 0xc], 0x5de
mov edi, eax
jne 0xc4897d
push dword [ebp + 0x14]
mov ecx, dword [esi + 0xf8]
call fcn.00c3cfcc
jmp 0xc48a24
cmp dword [ebp + 0x14], 0
jne 0xc48a24
xor ebx, ebx
cmp dword [esi + 0x1a4], ebx
je 0xc4899c
mov dword [esi + 0x1a4], ebx
jmp 0xc48a24
mov eax, dword [esi + 0xf8]
push 5
mov byte [eax + 0x2c], bl
mov eax, dword [esi + 0xf8]
push dword [eax + 0x20]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
mov ecx, dword [esi + 0xf8]
push ebx
call fcn.00c3cebe
push ebx
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00ba4fa1
mov edi, eax
test edi, edi
je 0xc48a24
cmp dword [edi + 0x10], 4
jb 0xc489e7
xor ebx, ebx
cmp dword [esi + 0xd8], ebx
setne bl
sub ebx, 2
push 0
push dword [ebp + 0xc]
push 0x419
push dword [ebp + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
cmp dword [esi + 0xd8], 0
mov ecx, esi
push eax
push dword [ebp + 0x10]
movzx eax, byte [esi + 0xb8]
push eax
setne al
movzx eax, al
push eax
push ebx
push edi
call fcn.00c47c02
mov byte [esi + 0xb8], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0xc4ad80
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0xc4ada4
push 0
push dword [esi + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
jmp 0xc4ae27
call fcn.00c4ad2a
xor edi, edi
test dword [0xd0a5c0], 0x400
je 0xc4adda
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0xc4adc2
mov eax, edi
jmp 0xc4adca
push ecx
push 3
call fcn.00b560d1
push eax
mov edx, 0xb3dcd0
mov ecx, 0xd08200
call fcn.00b8eed4
mov ecx, esi
call fcn.00c4ae30
mov ecx, dword [ebp + 0xc]
mov bl, al
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff0
add ecx, 0x57
push ecx
push edi
push edi
push edi
push edi
push edi
push dword [esi + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
test bl, bl
jne 0xc4ae0c
push 1
mov ecx, esi
call fcn.00c4b32a
test dword [0xd0a5c0], 0x400
je 0xc4ae27
mov edx, 0xb3dd30
mov ecx, 0xd08200
call fcn.00b8e628
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xc5caa0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf
pop ecx
mov esi, 0xb3fb14
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1ca
lea eax, [ebp - 0x1ce]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0xc5cb13
mov ecx, dword [ebp + 4]
mov esi, 0x80004005
push esi
push 0xb2fad8
mov edx, 0xb5d
call fcn.00bc28ed
mov eax, esi
jmp 0xc5cb7c
push 0x38
lea eax, [ebp - 0x244]
mov dword [ebp - 0x248], 0x3c
push esi
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x234], 0xb3fb58
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], 5
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x240], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0xc5cb7a
mov ecx, dword [ebp + 4]
mov edx, 0xb64
push 0xb2fad8
call fcn.00c206ae
jmp 0xc5cb7c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xc5d791
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
push 0
push 0xb27ee8
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
test eax, eax
je 0xc5d7d6
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
test eax, eax
je 0xc5d7d6
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4

Function at 0xc5f0e9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push 0xb3fc78
push 0xb26d00
push reloc.SHCORE.dll_Ordinal_1
mov dword [edi], 1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jne 0xc5f13c
mov eax, dword [ebp - 4]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x490
je 0xc5f132
cmp esi, 2
je 0xc5f132
test esi, esi
jle 0xc5f158
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc5f16b
mov ecx, dword [ebp + 4]
push esi
push 0xb3eac4
push 0x70
pop edx
call fcn.00bc28ed
mov eax, esi
jmp 0xc5f134
Function at 0xc665be
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
sub eax, 0x55c
je 0xc66613
sub eax, 1
jne 0xc66600
cmp dword [ebp + 0xc], eax
je 0xc66600
xor edi, edi
push edi
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_479]
push dword [0xd0a20c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0xc], 0
je 0xc665e7
mov ecx, dword [ebx + 0x1d0]
xor edi, edi
push edi
push 0x10002
push 0x128
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [ebx + 0x1d0]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
push eax
push 1
push 0x459
push dword [0xd0a20c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [ebx + 0x1d0]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push edi
test ax, ax
jns 0xc666ad
push 0x409
push dword [ebx + 0x4c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push edi
mov esi, eax
push edi
jmp 0xc666b6
mov eax, dword [ebx + 0x19c]
mov esi, dword [eax + 0x10]
push dword [ebx + 0x2c]
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_479]
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetFocus]
jmp 0xc66600

Function at 0xc6d108
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x18], 0xb42874
lea esi, [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0xb4285c
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc6d167
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
jne 0xc6d167
cmp dword [ebp - 8], 0
je 0xc6d167
add esi, 8
lea ecx, [ebp - 8]
cmp esi, ecx
jne 0xc6d130
mov al, 1
jmp 0xc6d169
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0xc6e844
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push 0x100
xor ebx, ebx
mov dword [ebp - 0x33c], ecx
push ebx
push eax
mov dword [ebp - 0x338], edi
mov esi, 0x80004005
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0x344], 0x100
add esp, 0xc
mov word [edi], ax
cmp dword [0xd0b71c], eax
jne 0xc6e99a
push 0x104
lea eax, [ebp - 0x330]
mov dword [0xd0b71c], 1
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0xc6e98d
push 0xb42a24
mov edx, 0x104
lea ecx, [ebp - 0x330]
call fcn.00c6d3f9
test eax, eax
js 0xc6e98d
push ecx
lea ecx, [ebp - 0x330]
call fcn.00caaf9f
mov dword [ebp - 0x334], eax
test eax, eax
je 0xc6e98d
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
and dword [0xd0b71c], eax
inc ebx
rep stosd dword es:[edi], eax
push ecx
push ecx
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x28]
push eax
call fcn.00c6ef3e
mov esi, eax
test esi, esi
js 0xc6e97a
lea edx, [ebp - 0x340]
lea ecx, [ebp - 0x28]
call fcn.00c6e5e2
mov edi, dword [ebp - 0x334]
mov esi, eax
test esi, esi
js 0xc6e980
push ecx
lea eax, [ebp - 0x128]
mov ecx, edi
push eax
push dword [ebp - 0x340]
call fcn.00c6f128
mov esi, eax
test esi, esi
js 0xc6e980
mov ecx, dword [ebp - 0x338]
lea eax, [ebp - 0x128]
push eax
push 0x20
pop edx
call fcn.00c6d449
mov esi, eax
xor ebx, ebx
test esi, esi
sets bl
jmp 0xc6e980
mov edi, dword [ebp - 0x334]
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov edi, dword [ebp - 0x338]
cmp dword [0xd0b71c], 0
jne 0xc6e99a
test ebx, ebx
je 0xc6e9e2
lea eax, [ebp - 0x344]
mov esi, 0x80004005
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0xb428d0
push dword [ebp - 0x33c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc6e9e2
lea eax, [ebp - 0x128]
mov ecx, edi
push eax
push 0x20
pop edx
call fcn.00c6d449
mov esi, eax
test esi, esi
js 0xc6e9e2
mov esi, 0x40203
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x10

Function at 0xc6ef3e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 0x40
push 0
push eax
mov esi, ecx
mov edi, 0x80004005
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x48], 0x40
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0xb2ffb8
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc6efa4
mov word [ebp - 0x22], ax
mov ecx, ebx
lea eax, [ebp - 0x44]
push eax
push 0x12
pop edx
call fcn.00c6d449
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0xc
Function at 0xc6f128
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x108], eax
mov ebx, 0x80004005
mov eax, edi
shr eax, 4
push 0x400
inc eax
movzx eax, ax
push eax
push 6
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
test eax, eax
je 0xc6f215
push eax
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test eax, eax
je 0xc6f215
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov esi, eax
test esi, esi
je 0xc6f215
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00bc259b
add esp, 0xc
and edi, 0xf
jbe 0xc6f1bd
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0xc6f1af
movzx edi, word [esi]
mov ecx, 0x80
cmp edi, ecx
jae 0xc6f215
lea eax, [esi + 2]
mov edx, ecx
push eax
lea ecx, [ebp - 0x104]
call fcn.00c6d449
mov ebx, eax
test ebx, ebx
jns 0xc6f1e8
cmp ebx, 0x8007007a
jne 0xc6f215
lea eax, [edi + edi]
cmp eax, 0x100
jae 0xc6f22a
xor ecx, ecx
mov edx, 0x80
mov word [ebp + eax - 0x104], cx
lea eax, [ebp - 0x104]
mov ecx, dword [ebp - 0x108]
push eax
call fcn.00c6d449
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0xc
call fcn.00bc0ff0
int3
Function at 0xc6f7e3
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0xb26690
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [edi], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0xc6f8be
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0xb2f3a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0xc6f8b5
mov eax, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
push ebx
push esi
push 0xb266fc
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0xc6f8ac
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
push 0xb2f380
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0xc6f8ac
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x14]
jne 0xc6f8ac
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0xc6f8ac
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.00bc6363
add esp, 0xc
test eax, eax
jne 0xc6f8ac
mov dword [edi], 1
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0xc70643
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, 0xb1d24c
xor ebx, ebx
mov eax, 0xb1d26c
cmp eax, esi
push edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
push dword [esi]
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteKeyW]
inc ebx
lea esi, [esi + 4]
cmp ebx, edi
jne 0xc7065e
pop edi
pop esi
pop ebx
ret

Function at 0xc71a24
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
lea edx, [ebp - 0x20c]
mov ecx, 0xb42c28
call fcn.00cde2fa
test eax, eax
js 0xc71aa5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathQuoteSpacesW]
push 0x38
lea eax, [ebp - 0x244]
mov dword [ebp - 0x248], 0x3c
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x22c], 1
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x234], 0xb42c50
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xc71ab3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x224]
xor ebx, ebx
mov dword [ebp - 0x224], 0x208
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x210]
mov dword [edi], ebx
push eax
push ebx
push 0xb42cd4
push 0xb42d78
mov esi, 0x80004005
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetUSValueW]
test eax, eax
jne 0xc71b39
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHCORE.dll_Ordinal_200]
test eax, eax
je 0xc71b39
push edi
push 0xb433fc
push 2
push 4
push ebx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_Ordinal_866]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8