joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401410
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x518
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.InternetOpenUrlA
push str.wininet.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.InternetOpenA
push str.wininet.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push str.InternetReadFile
push str.wininet.dll
mov ebp, eax
call esi
push eax
call edi
push str.InternetCloseHandle
push str.wininet.dll
mov ebx, eax
call esi
push eax
call edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x530]
push edi
push edi
push edi
push edi
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov esi, 1
call ebp
cmp eax, edi
mov dword [esp + 0x20], eax
je 0x401624
mov ecx, dword [esp + 0x52c]
push edi
push 0x80000000
push edi
push edi
push ecx
push eax
call dword [esp + 0x30]
mov ebp, eax
cmp ebp, edi
je 0x401624
mov edx, dword [esp + 0x52c]
push str..exe
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4015af
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401360
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push 2
push 0
push 0
lea ecx, [esp + 0x38]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x401582
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x128]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x12c]
push 0x400
push eax
push ebp
call ebx
test esi, esi
je 0x40154f
cmp word [esp + 0x128], 0x5a4d
jne 0x401577
mov edx, dword [esp + 0x10]
xor esi, esi
lea ecx, [esp + 0x14]
push esi
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x130]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
test eax, eax
ja 0x40151a
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x401616
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x518
ret
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x128]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0x400
push edx
push ebp
call ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x534]
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x128]
lea edi, [eax + edx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add edx, eax
test eax, eax
mov dword [esp + 0x14], edx
jbe 0x401616
mov eax, edx
cmp eax, 0xc800
jb 0x4015af
mov esi, dword [esp + 0x1c]
push ebp
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x518
ret
Function at 0x4016a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4016d4
pop edi
pop esi
add esp, 0x128
ret
push ebx
mov ebx, dword [esp + 0x138]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40170a
lea edx, [esp + 0x34]
push ebx
push edx
call ebp
test eax, eax
je 0x4016e3
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x128
ret
Function at 0x1004d33
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
jbe 0x1004d9e
cmp dword [ebp - 4], 2
jbe 0x1004d8a
cmp dword [ebp - 4], 7
jne 0x1004d9e
mov ecx, dword [edi]
test cl, 1
jne 0x1004d9e
shr ecx, 1
cmp ecx, 2
jb 0x1004d9e
cmp esi, ebx
je 0x1004da1
cmp word [esi + ecx*2 - 2], bx
jne 0x1004d9e
cmp word [esi + ecx*2 - 4], bx
jmp 0x1004d9c
mov ecx, dword [edi]
test cl, 1
jne 0x1004d9e
cmp esi, ebx
je 0x1004da1
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x1004da1
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1006a1f
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 2
pop eax
push 6
mov word [ebp - 0x14], ax
push 1
xor eax, eax
push 2
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006a77
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1006a70
mov dword [edi], esi
jmp 0x1006a7d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100736d
leave
ret 4

Function at 0x1006a92
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1006acc
mov cx, word [ebp - 0x12]
mov word [esi], cx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100736d
leave
ret 8
Function at 0x1007266
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x100b5e0
call fcn.010072a8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x100d76c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1007021
cmp eax, esi
jne 0x1007014
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1007024
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006ffb
xor esi, esi
inc esi
mov eax, dword [0x100d768]
cmp eax, esi
jne 0x1007037
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1007066
mov eax, dword [0x100d768]
test eax, eax
jne 0x1007060
mov dword [0x100d768], esi
push 0x1001228
push 0x100121c
call fcn.01006f5d
pop ecx
pop ecx
test eax, eax
je 0x1007066
jmp 0x100718a
mov dword [0x100d3a0], esi
mov eax, dword [0x100d768]
cmp eax, esi
jne 0x100708a
push 0x1001218
push 0x10011fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100d768], 2
cmp dword [ebp - 0x20], ebx
jne 0x1007097
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100d778], ebx
je 0x10070b8
push 0x100d778
call fcn.010076a9
pop ecx
test eax, eax
je 0x10070b8
push ebx
push 2
push ebx
call dword [0x100d778]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100718a
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1007122
cmp cx, bx
je 0x10070dd
cmp dword [ebp - 0x1c], ebx
jne 0x1007122
movzx ecx, word [eax]
cmp cx, bx
je 0x10070f2
cmp cx, 0x20
ja 0x10070f2
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10070dd
test byte [ebp - 0x40], 1
je 0x10070fe
movzx ecx, word [ebp - 0x3c]
jmp 0x1007101
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x100d39c], eax
cmp dword [0x100d390], ebx
jne 0x1007167
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1007133
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10070c7
cmp dword [0x100d3a0], ebx
jne 0x1007175
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100d39c]
jmp 0x1007196
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010072ed
ret
call fcn.010077ee
jmp 0x1006fbe
Function at 0x100822f
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
cmp eax, 0xc0000120
je 0x100835e
cmp dword [edi + 0x20], ecx
jne 0x100835e
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebx + 8]
cmp eax, ecx
je 0x10082bd
cmp eax, 0x3e3
je 0x1008343
cmp eax, 0x2775
je 0x10082a4
cmp eax, 0x2746
je 0x10082a4
cmp eax, 0x274c
je 0x10082a4
cmp eax, 0x2742
je 0x10082a4
cmp eax, 0x2736
je 0x10082a4
cmp eax, 0x274a
je 0x10082a4
cmp eax, 0x2745
jne 0x1008343
cmp esi, 0xffffffff
je 0x10082b0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, edi
call fcn.01008410
push ebx
jmp 0x1008376
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
add ebx, 0x50
push ebx
mov ecx, edi
call fcn.01007f65
test eax, eax
jl 0x1008331
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1008331
push 4
lea eax, [edi + 0xc]
push eax
push 0x700b
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x6c
call fcn.01006dea
pop ecx
cmp eax, ebx
je 0x100830b
mov ecx, eax
call fcn.01008f00
mov ebx, eax
test ebx, ebx
je 0x1008331
push dword [ebp + 8]
mov ecx, ebx
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call fcn.0100958c
test eax, eax
jl 0x100833d
push ebx
mov ecx, 0x100d6e0
call fcn.01008769
jmp 0x100833d
cmp esi, 0xffffffff
je 0x100833d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, dword [ebp + 0x10]
or esi, 0xffffffff
push 0
push edi
push 0x1008387
push ebx
push esi
push dword [edi + 0xc]
call fcn.01009bf2
test eax, eax
je 0x100837b
jmp 0x10082a4
mov eax, dword [edi + 0x18]
cmp eax, ecx
je 0x100836c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, edi
call fcn.0100816e
push dword [ebp + 0x10]
call fcn.01008962
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1009762
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [0x100d6da], bl
je 0x100977c
mov eax, 0x3eb
jmp 0x1009802
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x100979b
push dword [ebp + 0x10]
xor esi, esi
call fcn.010088d2
mov ebx, eax
mov ecx, ebx
test ebx, ebx
jne 0x100979e
push 8
pop eax
jmp 0x1009801
mov esi, dword [ebp + 0x14]
push edi
lea edx, [ecx + 0x18]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
and dword [ecx + 0x2c], 0
mov dword [ecx + 0xc], edi
mov edi, dword [ebp + 0x1c]
push edx
mov dword [ecx + 0x10], edi
mov edi, dword [ebp + 0x20]
push 0x100d760
push dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov dword [ecx + 0x14], edi
lea ecx, [ecx + esi + 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
test eax, eax
jne 0x10097fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x10097fd
test ebx, ebx
je 0x10097ff
push ebx
call fcn.01008962
jmp 0x10097ff
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x100980c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x100d6da], 0
je 0x1009821
mov eax, 0x3eb
jmp 0x1009877
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
lea edx, [ecx + 0x18]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 0xc], esi
mov esi, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x10], esi
mov esi, dword [ebp + 0x20]
push 0x100d760
push dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov dword [ecx + 0x14], esi
lea ecx, [ecx + edx + 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
test eax, eax
jne 0x1009875
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009877
xor eax, eax
pop ebp
ret 0x1c

Function at 0x10098e8
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x90], eax
call dword [sym.imp.WS2_32.dll_ntohs]
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
xor esi, esi
lea eax, [ebp - 0x82]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push esi
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1009952
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x10099e8
push edi
push esi
push 0x100973c
push ebx
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
push 4
lea eax, [ebp - 0x88]
push eax
push 0x1001
mov edi, 0xffff
push edi
mov dword [ebp - 0x88], esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push ebx
call esi
and dword [ebp - 0x88], 0
push 4
lea eax, [ebp - 0x88]
push eax
push 0x1002
push edi
push ebx
call esi
mov eax, dword [ebp + 8]
pop edi
cmp eax, 0xffffffff
je 0x10099ec
push dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.01009880
push 0x80
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x10099ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebx
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
jmp 0x10099f6
mov eax, dword [ebp - 0x90]
mov dword [eax], ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100736d
leave
ret 0xc
Function at 0x1009aaa
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1009b10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1009b34
test esi, esi
je 0x1009b24
lea eax, [ebp - 0x84]
push eax
call fcn.010098c9
mov eax, dword [eax]
mov dword [esi], eax
test edi, edi
je 0x1009b32
mov ax, word [ebp - 0x82]
mov word [edi], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100736d
leave
ret 0xc
Function at 0x4010ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push esi
push 0x63
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401107
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
push esi
push 0
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret

Function at 0x401128
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401178
mov dword [ebp + 0x10], esi
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401178
cmp esi, dword [ebp + 0x10]
jne 0x401178
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40117a
xor al, al
pop edi
pop esi
pop ebp
ret

Function at 0x401194
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push dword [ebp + 0x10]
call fcn.0040117e
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401128
add esp, 0x14
test al, al
je 0x401207
lea eax, [ebp - 0x18c]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
call sub.LZ32.dll_LZOpenFileA
mov edi, eax
test edi, edi
jl 0x401207
lea eax, [ebp - 0x18c]
push 0x1002
push eax
push dword [ebp + 0x14]
call sub.LZ32.dll_LZOpenFileA
mov esi, eax
test esi, esi
jl 0x401207
push esi
push edi
call sub.LZ32.dll_LZCopy
test eax, eax
jge 0x40120b
xor eax, eax
jmp 0x401227
push edi
call sub.LZ32.dll_LZClose
push esi
call sub.LZ32.dll_LZClose
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x40122b
Capabilities:
Accept command line arguments
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 1
xor esi, esi
mov ebx, fcn.00401194
call fcn.004010ee
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4012a7
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call fcn.0040117e
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.00401194
add esp, 0x18
test eax, eax
je 0x4013b7
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4013b7
push 0x401080
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4012e0
lea eax, [ebp - 4]
push eax
push 2
call fcn.004010ee
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4012e0
lea eax, [ebp - 0x364]
push eax
push dword [ebp + 8]
call fcn.0040117e
lea eax, [ebp - 0x364]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call ebx
add esp, 0x18
test eax, eax
jne 0x401301
test esi, esi
je 0x4013b7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4013b7
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x40131b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x260]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
xor cl, cl
cmp byte [edi], 0x22
jne 0x40132d
inc cl
inc edi
mov al, byte [edi]
test al, al
je 0x401340
cmp al, 0x20
jne 0x40133b
test cl, cl
je 0x401340
cmp al, 0x22
jne 0x40132c
inc edi
lea eax, [ebp - 0x15c]
push 0x40107c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x15c]
push eax
call esi
lea eax, [ebp - 0x15c]
push 0x401078
push eax
call esi
lea eax, [ebp - 0x15c]
push edi
push eax
call esi
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [ebp - 0x14]
xor edi, edi
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push 0x20
push 1
push edi
lea eax, [ebp - 0x15c]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4013bb
lea eax, [ebp - 0x364]
push eax
call ebx
xor al, al
jmp 0x4013ff
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x364]
push eax
call ebx
test eax, eax
jne 0x4013fd
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x64
jl 0x4013e2
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2291596b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
cmp dword [ebp + 8], ebx
je 0x22915a9b
mov eax, dword [ebp + 0x10]
call fcn.22914d04
test al, al
jne 0x22915a9b
cmp dword [ebp + 0x14], ebx
je 0x22915a9b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x22915a01
push eax
lea esi, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
call fcn.22914d1b
test eax, eax
jbe 0x22915abd
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push 0x16
push ebx
call fcn.22915eb7
add esp, 0x14
cmp dword [ebp + 0xc], ebx
je 0x22915abd
push dword [ebp + 0xc]
call sub.msvcrt.dll____V_YAXPAX_Z
pop ecx
jmp 0x22915abd
cmp dword [ebp - 0x10], 1
je 0x22915a12
push edi
push dword [ebp + 0x10]
push 0x18
jmp 0x22915ab4
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x22915a1f
push edi
jmp 0x22915aaf
shr eax, 1
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll____U_YAPAXI_Z
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x22915abd
xor ecx, ecx
mov word [eax + edi*2], cx
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x22915aa0
push eax
lea esi, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.22914d1b
test eax, eax
jbe 0x22915a8d
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x16
push ebx
call fcn.22915eb7
add esp, 0x14
cmp dword [ebp + 8], ebx
je 0x22915a8d
push dword [ebp + 8]
call sub.msvcrt.dll____V_YAXPAX_Z
pop ecx
push dword [ebp - 8]
call sub.msvcrt.dll____V_YAXPAX_Z
pop ecx
mov dword [ebp - 8], ebx
jmp 0x22915abd
mov byte [ebp - 1], bl
jmp 0x22915ac2
mov eax, dword [ebp - 8]
call fcn.22914d04
test al, al
je 0x22915ac0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0xe
push ebx
call fcn.22915eb7
add esp, 0x10
mov byte [ebp - 1], bl
pop edi
pop esi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, byte [ebp - 1]
pop ebx
leave
ret 0x10
Function at 0x22915eb7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [0x2291a8bc]
push edi
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x22915ee7
push ebx
push 8
push 0x22914488
call fcn.22918345
mov dword [0x2291a8bc], eax
lea ecx, [ebp - 0x10]
push ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push dword [ebp + 0xc]
push eax
push 0x900
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, eax
cmp edi, ebx
je 0x22915f7c
test byte [0x2291a8c4], 1
push esi
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], esi
jne 0x22915f34
or dword [0x2291a8c4], 1
xor eax, eax
cmp byte [ebp + 8], bl
setne al
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x2291a8c0], eax
cmp esi, ebx
je 0x22915f72
mov esi, dword [0x2291a8c0]
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
push ebx
lea eax, [ebp - 8]
push eax
jne 0x22915f64
push edi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x22915f72
lea eax, [edi + edi]
push eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop edi
pop ebx
leave
ret