joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x4071c8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403dcd
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x407268
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x407280
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x407298
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x4072b4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x403de0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4071c8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403e5f
push 0x407268
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x407280
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x407298
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x4072b4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x4043b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x4075bc]
jbe 0x4044b7
mov ecx, dword [0x4075bc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x4075c8
jmp 0x4043f5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
cmp dword [edx], ecx
jne 0x404405
sub dword [ebp - 8], 4
add dword [ebp - 0xc], 4
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 4
jae 0x4043dd
cmp dword [ebp - 8], 0
je 0x404487
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
sub eax, ecx
mov dword [ebp - 0x14], eax
jne 0x404490
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x404487
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
sub ecx, edx
mov dword [ebp - 0x14], ecx
jne 0x404490
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x404487
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx]
sub edx, eax
mov dword [ebp - 0x14], edx
jne 0x404490
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x404487
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
sub eax, ecx
mov dword [ebp - 0x14], eax
jne 0x404490
mov dword [ebp - 0x18], 0
jmp 0x4044a4
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x14], 0
jg 0x4044a4
mov dword [ebp - 0x18], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x4044b7
mov eax, 1
jmp 0x4044eb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4044e6
mov eax, dword [ebp - 4]
and eax, 2
jne 0x4044e2
mov ecx, dword [ebp - 4]
and ecx, 4
jne 0x4044e2
mov edx, dword [ebp - 4]
and edx, 1
je 0x4044e6
xor eax, eax
jmp 0x4044eb
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x404700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push 0x100
push 0
lea eax, [ebp - 0x100]
push eax
call fcn.00402820
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.00401a60
add esp, 0xc
push 0x5c
push 0
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x404788
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0
mov eax, dword [ebp - 0x104]
push eax
call fcn.00402820
add esp, 0xc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x104], ecx
push 0x44
push 0
lea edx, [ebp - 0x160]
push edx
call fcn.00402820
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00402820
add esp, 0xc
mov dword [ebp - 0x160], 0x44
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x160]
push edx
mov eax, dword [ebp - 0x104]
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x4047f0
Capabilities:
Delete file
Delete registry value
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x80
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404882
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.00402820
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
push 0
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x404882
push 0x4018d4
mov eax, dword [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea ecx, [ebp - 0x100]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret

Function at 0x4048a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4048bd
jmp 0x4048c9
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4048d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x128
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00402820
add esp, 0xc
mov dword [ebp - 0x128], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call sub.KERNEL32.dll_Process32First
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404943
mov edx, dword [ebp - 0x120]
push edx
call fcn.004048a0
add esp, 4
jmp 0x40497e
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404967
mov edx, dword [ebp - 0x120]
push edx
call fcn.004048a0
add esp, 4
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404943
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x405070
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4050df
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4050d5
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4050f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push 0x9c
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00402820
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 5
jbe 0x405135
xor eax, eax
jmp 0x40513a
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4057b0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x401958
call fcn.00405c90
add esp, 0xc
cmp dword [ebp - 4], 3
jae 0x405814
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 4
push 4
lea edx, [ebp - 4]
push edx
push 0x401964
call fcn.00405bb0
add esp, 0x10
push 0x401970
call fcn.00405260
add esp, 4
push 0
push 1
push 1
push 0
push 0x401984
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExA]
mov esp, ebp
pop ebp
ret
Function at 0x405a00
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x4073ac
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405a7c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
push 0x4019e8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x405a80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405b31
push 0xff
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.00402820
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x4019f8
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0x401a04
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x405b40
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405b9d
push 0x401a14
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x405bb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push str.SoftwareWindowsId_Manager_Reader
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 8], 0
je 0x405c12
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x405c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWindowsId_Manager_Reader
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 8], 0
je 0x405d08
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x405cf7
mov dword [ebp - 0xc], 0
jmp 0x405cfe
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x2983700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0298378f
jae 0x298370e
xor ecx, ecx
call fcn.0298378f
jae 0x298373d
xor eax, eax
call fcn.0298378f
jae 0x298374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0298378f
adc al, al
jae 0x298372f
jne 0x2983779
stosb byte es:[edi], al
jmp 0x2983711
call fcn.0298379b
sub ecx, ebx
jne 0x2983756
call fcn.02983799
jmp 0x2983775
lodsb al, byte [esi]
shr eax, 1
je 0x2983783
adc ecx, ecx
jmp 0x2983772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02983799
cmp eax, 0x7d00
jae 0x2983772
cmp ah, 5
jae 0x2983773
cmp eax, 0x7f
ja 0x2983774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2983711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x70fc3b23
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x70fd011c]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xf003f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.70fc33b3
cmp eax, esi
jne 0x70fc3bc4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x70fc3b7b
lea eax, [ebp - 0x204]
push eax
call fcn.70fc3b23
cmp eax, esi
jne 0x70fc3bc3
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x70fc3b6b
call fcn.70fc3340
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.70fc3340
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.70fc8976
leave
ret 4

Function at 0x70fc42e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0x10]
call fcn.70fc2a64
push 2
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x70fc433c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x70fc4327
call esi
mov esi, eax
jmp 0x70fc4402
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x70fc4402
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x70fc435d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x70fc4382
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x70fc4370
call esi
jmp 0x70fc43f7
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x70fc43f9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x70fc43c1
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.70fced00
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov byte [eax + ebx], 0
mov edi, esp
test edi, edi
jne 0x70fc43c9
xor eax, eax
jmp 0x70fc43eb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.70fced00
mov eax, esp
push esi
push edi
push eax
call fcn.70fc3041
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.70fc41a6
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x70fcd39d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
cmp eax, edi
pop ecx
je 0x70fcd3c0
push dword [ebp + 8]
mov ecx, eax
call fcn.70fcd156
mov esi, eax
jmp 0x70fcd3c2
xor esi, esi
cmp esi, edi
je 0x70fcd3ff
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 8], eax
je 0x70fcd3f6
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x70fcd387
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
je 0x70fcd3f6
xor eax, eax
jmp 0x70fcd404
push 1
mov ecx, esi
call fcn.70fc8b28
mov eax, 0x8007000e
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret 8
Function at 0x550280
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5e67bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005daf59
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x550302
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005d8e70
mov eax, dword [eax]
push 0x70a220
push eax
call fcn.005cae04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005db1e4
test bl, bl
je 0x550302
push 0x70a220
lea ecx, [esp + 0xc]
call fcn.005db574
push 0x70ddb8
lea ecx, [esp + 0xc]
call fcn.005db574
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x55033e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005db1e4
jmp 0x550409
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x5503c2
lea edx, [esp + 0x7c]
push 0x70ddb4
push edx
call fcn.005cae04
add esp, 8
test eax, eax
je 0x5503c2
lea eax, [esp + 0x7c]
push 0x70ddb0
push eax
call fcn.005cae04
add esp, 8
test eax, eax
je 0x5503c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x550352
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005db1e4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x550c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x550c62
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x550c70
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5e683b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x71ce44]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x550da8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x550cd6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005db1e4
xor eax, eax
jmp 0x550e1f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.005db321
push esi
lea ecx, [esp + 0xc]
call fcn.005db5b0
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x550dfd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00550c00
test eax, eax
jne 0x550dfd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00550c00
test eax, eax
jne 0x550dfd
lea eax, [esp + 0x14]
push 0x70ddcc
push eax
call fcn.005cbf50
mov esi, eax
add esp, 8
test esi, esi
jne 0x550ddc
lea ecx, [esp + 0x14]
push 0x70ddc8
push ecx
call fcn.005cbed0
mov esi, eax
add esp, 8
test esi, esi
jne 0x550ddc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x550ddf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.005db2d1
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x550cee
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.005db1e4
xor eax, eax
jmp 0x550e1f
mov byte [esi], 0
push 0x70ddc4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.005db1e4
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4