joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023ef
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x428388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
mov dword [ebp - 0x674], 0x44
lea eax, [ebp - 0x670]
push ebx
push eax
call fcn.004078e2
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov esi, edi
xorps xmm0, xmm0
neg esi
movups xmmword [ebp - 0x630], xmm0
sbb esi, esi
push str.WatsonLaunchQueuedReportingInstanceVerification
and esi, 0x3a980
call fcn.00401f26
test eax, eax
je 0x402516
test esi, esi
je 0x40245d
test edi, edi
je 0x40245d
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0040204a
test eax, eax
je 0x402516
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x71
push eax
push str.__s____c__u
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.00401cad
add esp, 0x18
lea eax, [ebp - 0x620]
push ebx
push eax
push ebx
push 0x72
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x4024b9
cmp dword [ebp - 0x620], ebx
jne 0x402516
test edi, edi
je 0x4024d1
push 7
pop eax
mov dword [ebp - 0x648], 1
mov word [ebp - 0x644], ax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402516
push dword [ebp - 0x630]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x62c]
call esi
xor eax, eax
inc eax
jmp 0x402518
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004067cd
mov esp, ebp
pop ebp
ret 8

Function at 0x402838
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x428388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, 0x104
push esi
xor esi, esi
inc eax
cmp dword [ebp + 8], esi
je 0x402886
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x402872
cmp eax, ebx
jbe 0x40289b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x30303030
call fcn.00405d82
xor eax, eax
jmp 0x4028fd
push eax
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402878
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.PCHealthErrorRep_
call fcn.004035c1
cmp dword [ebp + 8], esi
jne 0x4028cb
push str.QRegular
lea eax, [ebp - 0x20c]
push eax
call fcn.004026d0
test eax, eax
push 1
pop eax
cmovne esi, eax
push str.QSignoff
lea eax, [ebp - 0x20c]
push eax
call fcn.004026d0
test eax, eax
je 0x4028e3
or esi, 2
push str.QHeadles
lea eax, [ebp - 0x20c]
push eax
call fcn.004026d0
test eax, eax
je 0x4028fb
or esi, 4
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004067cd
mov esp, ebp
pop ebp
ret 4
Function at 0x402aec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x428388]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x464]
push edi
push 0x40
xor edi, edi
mov dword [ebp - 0x468], 0x44
push edi
push eax
call fcn.004078e2
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x424], xmm0
push esi
call fcn.00403000
cmp eax, 0x104
jg 0x402b9a
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push 0x6b
push esi
push str.__s____c__u
push 0x208
push eax
call fcn.00401cad
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push edi
push edi
push 0x4000020
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402b9a
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
jmp 0x402ba4
push 0x30303030
call fcn.00405d82
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004067cd
mov esp, ebp
pop ebp
ret 8
Function at 0x402f89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.004025bb
test eax, eax
je 0x402ffa
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ffa
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push str.DWReporteeName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402ff0
cmp dword [ebp - 0x10], 1
je 0x402ff0
mov word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4045b2
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x428388]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x408], eax
test esi, esi
jne 0x4045fb
xor eax, eax
jmp 0x404760
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.004056b0
mov edx, dword [ebp - 0x408]
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
xor ebx, ebx
and dword [ebp - 0x41c], ebx
not eax
and eax, edi
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x404662
mov eax, edx
shr eax, 0x17
push ecx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 0x408]
mov dword [esi], eax
mov eax, dword [ebp - 0x414]
cmp dword [esi], ebx
jne 0x404705
test eax, eax
je 0x404705
xor eax, eax
push edi
lea eax, [ebp - 0x40c]
push eax
push edx
call fcn.00405466
test eax, eax
je 0x4046f5
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x418]
shr eax, 0x19
and eax, edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 0x408]
call fcn.0040559a
mov eax, dword [ebp - 0x410]
cmp eax, 5
jne 0x4046f7
cmp dword [ebp - 0x41c], ebx
jne 0x4046f7
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x41c], edi
jmp 0x40463c
mov eax, ebx
cmp dword [esi], ebx
je 0x404705
xor ebx, ebx
cmp eax, 0xb7
setne bl
cmp dword [esi], 0
je 0x40470f
cmp dword [esi], 0xffffffff
jne 0x404729
cmp dword [ebp - 0x414], 0
je 0x404722
push 0x1631e1
call fcn.00405d82
and dword [esi], 0
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x420]
test edx, edx
je 0x404750
mov ecx, dword [ebp - 0x418]
mov eax, 0x41f680
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp + 0x14]
push edx
call fcn.0040ec3f
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x40475c
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004067cd
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4052c3
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x428388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x4052ef
push 0x15b3c8
jmp 0x405327
cmp dword [0x428ed0], esi
je 0x405306
mov eax, dword [0x428328]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x405432
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405333
push 0x15b3c9
call fcn.00405d82
mov edi, esi
jmp 0x405432
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x405351
push 0x15b3ca
jmp 0x405327
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x405363
push 0x15b3cb
jmp 0x405327
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.0040478c
mov esi, dword [ebp - 0x4c]
test al, al
jne 0x405386
push 0x15b3cc
call fcn.00405d82
xor edi, edi
jmp 0x405425
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x4053a0
push 0x15b3cd
jmp 0x40537a
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004078e2
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4053d2
push 0x15b3ce
jmp 0x40537a
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
je 0x405458
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jae 0x405418
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x405407
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x405416
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x4053de
mov dword [ebx], edi
mov dword [0x428ed0], edi
mov eax, dword [ebx]
mov dword [0x428328], eax
test esi, esi
je 0x405430
push esi
call fcn.0040ef41
pop ecx
xor esi, esi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x405443
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004067cd
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov dword [0], 1
int 0x29

Function at 0x41370a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004133b8
Function at 0x41bdb3
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x41e21f
call fcn.0040680b
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41bdcd
xor al, al
jmp 0x41be9e
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x41bdde
xor ecx, ecx
cmp dword [0x429fd4], ecx
jmp 0x41bde8
push esi
call fcn.0041bbc6
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x41bdc6
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.0041b021
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
jmp 0x41be72
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x41be28
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.0041bbf0
push ebx
test eax, eax
je 0x41be8c
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x42a2c0
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x428b08], edi
call fcn.0041babd
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.0041b136
mov edi, eax
test edi, edi
je 0x41be1c
jmp 0x41be91
call fcn.0041c497
lea ecx, [ebp + 0xf]
call fcn.0041b066
test edi, edi
sete al
call fcn.004067dc
ret 8
Function at 0x41bfdf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x41c005
cmp dword [0x429fd4], edi
je 0x41c0f6
push 2
pop esi
jmp 0x41c01e
cmp edi, 1
jne 0x41c0f6
push ebx
call fcn.0041bbc6
test al, al
je 0x41c0f6
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.0041b021
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x41c0a5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41c053
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.0041bbf0
push dword [ebp - 4]
test eax, eax
je 0x41c0be
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x42a2c0
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x428b08], esi
call fcn.0041babd
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.0041b136
mov esi, eax
test esi, esi
je 0x41c03f
jmp 0x41c0ee
call fcn.0041c497
test esi, esi
jne 0x41c0ee
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x41c10b
cmp dword [ebp - 0x10], 3
jne 0x41c0eb
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x41c0eb
and cl, 0xf
cmp cl, 4
je 0x41c10b
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.0041b066
inc edi
cmp edi, 2
jl 0x41bfed
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.0041b066
xor eax, eax
jmp 0x41c102
Function at 0x41cbd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41cc1b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x41cc1b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41cc1b
cmp word [eax + 2], 0
je 0x41cc1b
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x41cc1b
add eax, 0x30
jmp 0x41cc20
mov eax, 0x4254a8
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5ac82907
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x56150499
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xd61af0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd61b2f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xd80763
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00d80423

Function at 0xd83eb2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00d83d31

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x50ec7dfa
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb0179e5
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401088
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40109f
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4010d4
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4010d0
cmp edi, eax
jae 0x4010d4
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4010c2
cmp edi, eax
jb 0x4010d8
xor eax, eax
jmp 0x4010e1
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x40b477
Capabilities:
Create directory

Disassembly:
push 4
mov eax, 0x450408
call fcn.00434cdd
and dword [ebp - 4], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
call fcn.0040890f
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040ca08
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40b4dd
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b4dd
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, esi
call fcn.00434db5
ret 0x10
mov ecx, dword [ebp + 8]
push 1
push dword [ebp + 0x14]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0040a703
mov esi, eax
jmp 0x40b4bd

Function at 0x40b656
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x40b679
test byte [ebp - 4], 0x20
jne 0x40b679
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x40d8c5
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x46d64c], 0
jne 0x40d8f5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d8ee
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46d650], eax
mov byte [0x46d64c], 1
mov eax, dword [0x46d650]
test eax, eax
je 0x40d90d
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x40d919
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4

Function at 0x40d9ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40da51
cmp dword [ebp + 0xc], 1
je 0x40da29
cmp dword [ebp + 0xc], 2
je 0x40da29
push 0xd
pop eax
jmp 0x40da51
mov eax, dword [ebp - 4]
test edi, edi
je 0x40da4b
test eax, eax
je 0x40da46
test al, 1
jne 0x40da24
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40da4b
jmp 0x40da24
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40da55
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc

Function at 0x40daa8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40dab6
push 0xd
pop eax
jmp 0x40dae9
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40dabd
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40daed
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x46a2c8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040d974
mov ebx, eax
cmp ebx, esi
je 0x40db56
lea esi, [ebp - 0x214]
call fcn.0040d91c
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004312e6
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40db74
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040daed
cmp eax, esi
jne 0x40dbbb
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x40db5e
lea esi, [ebp - 0x214]
call fcn.0040d91c
push dword [ebp - 0x21c]
mov esi, edi
call fcn.0040d8c5
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.0040d91c
mov eax, edi
jmp 0x40db45