joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100044f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov al, 0x45
push ebx
mov byte [esp + 0x31], al
mov byte [esp + 0x34], al
mov al, 0x4c
push ebp
mov byte [esp + 0x39], al
mov byte [esp + 0x20], al
push esi
lea eax, [esp + 0x20]
push edi
lea ecx, [esp + 0x3c]
push eax
xor edi, edi
mov bl, 0x65
push ecx
push edi
mov byte [esp + 0x48], 0x4b
mov byte [esp + 0x4a], 0x52
mov byte [esp + 0x4b], 0x4e
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x32
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], 0x6c
mov byte [esp + 0x54], 0
mov byte [esp + 0x30], 0x46
mov byte [esp + 0x31], 0x72
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x62
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], 0x79
mov byte [esp + 0x3b], 0
call fcn.10003890
mov ebp, eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x48]
push edx
push eax
push edi
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x46
mov byte [esp + 0x50], 0x72
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0
call fcn.10003890
lea ecx, [esp + 0x64]
lea edx, [esp + 0x54]
mov dword [esp + 0x28], eax
push ecx
mov al, 0x73
push edx
push edi
mov byte [esp + 0x70], 0x47
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x74
mov byte [esp + 0x73], 0x50
mov byte [esp + 0x74], 0x72
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x63
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], al
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], 0x48
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], 0x61
mov byte [esp + 0x7d], 0x70
mov byte [esp + 0x7e], 0
call fcn.10003890
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x60]
push eax
push ecx
push edi
mov byte [esp + 0x48], 0x48
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], 0x61
mov byte [esp + 0x4b], 0x70
mov byte [esp + 0x4c], 0x46
mov byte [esp + 0x4d], 0x72
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0
call fcn.10003890
mov esi, dword [esp + 0x90]
add esp, 0x30
cmp esi, edi
mov ebx, eax
je 0x100046de
cmp dword [esi + 0x10], edi
je 0x10004693
mov edx, dword [esi]
mov eax, dword [esi + 4]
push edi
push edi
mov ecx, dword [edx + 0x28]
push eax
add ecx, eax
call ecx
mov dword [esi + 0x10], edi
cmp dword [esi + 8], edi
je 0x100046c1
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x100046b5
mov edx, dword [esi + 8]
mov eax, dword [edx + edi*4]
cmp eax, 0xffffffff
je 0x100046ad
push eax
call ebp
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x1000469f
mov eax, dword [esi + 8]
push eax
call fcn.10003af0
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x100046d4
push 0x8000
push 0
push eax
call dword [esp + 0x1c]
push esi
push 0
call dword [esp + 0x1c]
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x10004980
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100049df
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp]
inc eax
push eax
lea eax, [esp + 8]
push eax
push 1
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.1001a1dc
add esp, 4
test eax, eax
je 0x10004a02
mov dword [eax], 0x1002348c
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
xor eax, eax
add esp, 0x108
ret
xor eax, eax
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
xor eax, eax
add esp, 0x108
ret
Function at 0x10006780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x10020ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp esi, edi
jne 0x100067f6
xor eax, eax
cmp ecx, edi
je 0x100067e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x10006804
cmp ecx, edi
je 0x1000689f
push ecx
jmp 0x10006899
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x1000686a
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.10006780
mov ebx, eax
cmp ebx, edi
jne 0x100068bb
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x1000682c
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1000687d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1000689f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x100068ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x100068a1
Function at 0x10006d10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1008
call fcn.1001a410
push esi
push 0
push 0
mov esi, dword [esp + 0x1018]
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10006d5a
xor eax, eax
pop esi
add esp, 0x1008
ret 4
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x10006da1
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push esi
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10006d4e
mov al, byte [esp + 0xc]
test al, al
je 0x10006d4e
mov eax, 1
pop esi
add esp, 0x1008
ret 4
xor ecx, ecx
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x1008
ret 4
Function at 0x10012780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10021e84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.GDI32.dll_DeleteDC]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0xb4]
lea ebx, [esi + 4]
lea edi, [esi + 0x9c]
mov dword [esi], 0x10023b24
test eax, eax
mov dword [ebx], 0x10023b14
mov dword [esi + 0x4c], 0x10023b08
mov dword [esi + 0x6c], 0x10023ae4
mov dword [esi + 0x70], 0x10023ac8
mov dword [esi + 0x74], 0x10023a68
mov dword [esi + 0x78], 0x10023a3c
mov dword [esi + 0x7c], 0x10023a00
mov dword [esi + 0x80], 0x100239d4
mov dword [esi + 0x84], 0x100239c0
mov dword [esi + 0x88], 0x10023998
mov dword [esi + 0x8c], 0x10023988
mov dword [esi + 0x90], 0x10023970
mov dword [esi + 0x94], 0x10023b64
mov dword [esi + 0x98], 0x10023b50
mov dword [edi], 0x10023950
mov dword [esi + 0xa8], 1
je 0x10012854
push eax
call ebp
mov dword [esi + 0xb4], 0
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x1001286b
push eax
call ebp
mov dword [esi + 0xb8], 0
push 0x1013e1ac
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esp + 0x14], edi
mov eax, dword [edi + 8]
lea esi, [edi + 4]
mov ebp, 2
mov byte [esp + 0x20], 1
cmp eax, ebp
mov edi, esi
jl 0x100128a7
mov edi, dword [esi]
mov eax, dword [esi + 4]
cmp eax, ebp
jge 0x100128b3
lea eax, [esi + eax*4]
jmp 0x100128b8
mov ecx, dword [esi]
lea eax, [ecx + eax*4]
cmp edi, eax
jae 0x100128cd
mov eax, dword [edi]
test eax, eax
je 0x100128c8
mov edx, dword [eax]
push eax
call dword [edx + 8]
add edi, 4
jmp 0x100128a7
cmp dword [esi + 4], 1
jle 0x100128de
mov eax, dword [esi]
push eax
call fcn.1001a1ea
add esp, 4
mov esi, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], ebp
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
test eax, eax
je 0x100128f8
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x18]
mov byte [esp + 0x20], 6
test eax, eax
je 0x1001290a
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esi + 0x14]
mov byte [esp + 0x20], 5
test eax, eax
je 0x1001291c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x10]
mov byte [esp + 0x20], 4
test eax, eax
je 0x1001292e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esi + 0xc]
mov byte [esp + 0x20], 3
test eax, eax
je 0x10012940
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 8]
mov byte [esp + 0x20], 2
test eax, eax
je 0x10012952
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov esi, dword [esi + 4]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x10012967
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x410c61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x410c70
pop dword [ebp - 0x40]
mov eax, 0x798d3841
add eax, 0x86b3d42f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa55800f6
add dword [ebp - 0x50], 0xa8fa4455
mov dword [ebp - 0x4c], 0xcc3ef248
sub dword [ebp - 0x4c], 0x9a0ba603
mov dword [ebp - 0x48], 0x8e7d7cca
sub dword [ebp - 0x48], 0x4231389c
mov dword [ebp - 0x44], 0x6a18b73d
add dword [ebp - 0x44], 0x95e748c3
lea eax, [ebp - 0x50]
push eax
mov eax, 0x64ac8ccd
add eax, 0x9b9383bf
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x697e1e9a
add dword [ebp - 0x50], 0xaf44abc
mov dword [ebp - 0x4c], 0x88dab015
sub dword [ebp - 0x4c], 0x476e4ea0
mov dword [ebp - 0x48], 0x5a9d6782
add dword [ebp - 0x48], 0x8d204ea
mov dword [ebp - 0x44], 0x304e0f16
sub dword [ebp - 0x44], 0x304e0f16
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x443bda75
sub eax, 0x43fbc991
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41828
push 0
call eax
mov ecx, 0x157b47bb
add ecx, 0xea8511d4
mov edi, eax
mov esi, 0x17f4ee9
add esi, 0xfec77917
add esi, dword [ebp - 0x40]
mov ebx, 0xc1db52cd
sub ebx, 0x6c3520a4
add dword [ebp - 0x20], edi
mov edx, dword [esi]
xor dword [ebp - 0x2c], edx
sub edx, ebx
sub dword [ebp - 0x28], ecx
mov dword [edi], edx
add dword [ebp - 0x28], edi
add edi, 0xde563432
sub edi, 0xde56342e
add esi, 0xa1f03e59
sub esi, 0xa1f03e55
loop 0x410d92
add eax, 0x3792bccf
sub eax, 0x379163c0
mov ebx, eax
add eax, 0x7279827f
sub eax, 0x7279827a
mov ecx, 0x52a80af6
add ecx, 0xad97f50a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x42b224
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b1b9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004162c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b273
cmp dword [ebp - 0x1c], 5
jb 0x42b28b
jmp 0x42b287
cmp dword [ebp - 0x10], 1
jne 0x42b28b
cmp dword [ebp - 0x1c], 4
ja 0x42b287
jne 0x42b28b
cmp dword [ebp - 0x18], 0
jbe 0x42b28b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4327a4
call fcn.0042b08d
test eax, eax
jge 0x42b2ac
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416063
add ebp, 0x78
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x437140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a000]
push edi
jmp 0x43715a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437150
mov eax, 1
add ebx, ebx
jne 0x437173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437168
jne 0x437184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437168
xor ecx, ecx
sub eax, 3
jb 0x437198
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43720a
mov ebp, eax
add ebx, ebx
jne 0x4371a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4371b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4371d4
inc ecx
add ebx, ebx
jne 0x4371c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4371b5
jne 0x4371d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4371b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4371f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4371e5
jmp 0x437156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4371f4
add edi, ecx
jmp 0x437156
pop esi
mov edi, esi
mov ecx, 0xbe1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x437212
cmp byte [edi], 7
jne 0x437212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x437217
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x43728f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4fdc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4fe60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x437244
mov ecx, edi
jns 0x437273
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4fe64]
or eax, eax
je 0x437289
mov dword [ebx], eax
add ebx, 4
jmp 0x437261
call dword [esi + 0x4fe74]
mov ebp, dword [esi + 0x4fe68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4372c3
sub esp, 0xffffff80
jmp 0x414da6

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5902157e
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff8c
neg esi
sbb esi, esi
and esi, ecx
lea eax, [esi + 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x4c]
test esi, esi
je 0x590215a6
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x59022c73
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
ret 8
Function at 0x59040f6e
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop esi
ret 0xc

Function at 0x59040f9a
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x59040fa5
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x59047054
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047067
mov eax, 0x80004003
jmp 0x590470ee
push 5
push 0x6c
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047093
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x5904709a
mov eax, 0x8000ffff
jmp 0x590470ee
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x590472a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590472bc
mov eax, 0x80004003
jmp 0x59047343
push 5
push 0x6d
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x590472e8
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x590472ef
mov eax, 0x8000ffff
jmp 0x59047343
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x590474b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590474c9
mov eax, 0x80004003
jmp 0x59047550
push 5
push 0x6b
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x590474f5
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x590474fc
mov eax, 0x8000ffff
jmp 0x59047550
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x590476c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590476d6
mov eax, 0x80004003
jmp 0x5904775d
push 5
push 0x6e
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047702
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047709
mov eax, 0x8000ffff
jmp 0x5904775d
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8
Function at 0x590478d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x590478e3
mov eax, 0x80004003
jmp 0x5904796a
push 5
push 0x6f
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x5904790f
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047916
mov eax, 0x8000ffff
jmp 0x5904796a
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8

Function at 0x59047add
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x59047af0
mov eax, 0x80004003
jmp 0x59047b77
push 5
push 0x69
push dword [0x590b24f0]
call dword [sym.imp.vsansi.dll_FindResourceW]
test eax, eax
je 0x59047b1c
push eax
push dword [0x590b24f0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x59047b23
mov eax, 0x8000ffff
jmp 0x59047b77
push ebx
push edi
mov edi, dword [esp + 0x10]
push 1
lea ebx, [edi + 0x10]
push ebx
push eax
call fcn.5906172f
mov dword [esi], 0x1c
push dword [edi + 0x18]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
push dword [edi + 0x1c]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x14], eax
push dword [edi + 0x20]
mov ecx, edi
call fcn.59045fcb
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x24]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop ebx
pop esi
ret 8