joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3aaa163e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x2cc
mov eax, 0x3ab49920
call fcn.3ab359d8
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x298]
push edx
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
xor ebx, ebx
cmp eax, ebx
jl 0x3aaa185f
push dword [ebp - 0x298]
lea ecx, [ebp - 0x288]
call fcn.3ab3c1f6
mov dword [ebp - 4], ebx
push dword [ebp - 0x298]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, ebx
je 0x3aaa1692
lea eax, [esi + 0x28]
jmp 0x3aaa1694
xor eax, eax
sub esp, 0x10
mov edi, esp
mov esi, 0x3ab672b4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x26c]
push eax
movsd dword es:[edi], dword [esi]
call fcn.3ab17d80
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2d8]
push 0x3aa666b8
push eax
mov byte [ebp - 4], 1
call fcn.3aa97158
push 0x3aa666a8
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 2
call fcn.3aaa357c
add esp, 0x18
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 4
call fcn.3ab3c1f6
push 0x3aa61348
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.3aaa357c
lea ecx, [ebp - 0x288]
push ecx
push eax
lea eax, [ebp - 0x250]
push eax
mov byte [ebp - 4], 5
call fcn.3aa971a4
add esp, 0x18
push ebx
push edi
lea ecx, [ebp - 0x2bc]
call fcn.3ab3c1f6
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x3aaa174d
lea eax, [ebp - 0x24c]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x3aaa176f
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x294]
push ecx
push 0x20019
push ebx
push eax
push esi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3aaa1826
lea eax, [ebp - 0x2a0]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x294]
mov dword [ebp - 0x290], edi
mov edi, 0x104
mov dword [ebp - 0x28c], edi
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x3aaa17ef
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x294]
mov dword [ebp - 0x28c], edi
call dword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
jne 0x3aaa17f5
mov dword [ebp - 0x290], ebx
push dword [ebp - 0x294]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x290], ebx
je 0x3aaa1826
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x3aaa181e
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x250]
call fcn.3ab3c1f6
push ebx
push esi
lea ecx, [ebp - 0x234]
call fcn.3ab3c1f6
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.3ab3c1f6
push ebx
push esi
lea ecx, [ebp - 0x288]
call fcn.3ab3c1f6
xor eax, eax
call fcn.3ab35a6a
ret 4
Function at 0x3aaa934d
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x3ab4f375
call fcn.3ab359d8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x3aaa9375
test cx, cx
je 0x3aaa937e
push eax
call edi
movzx ecx, word [eax]
cmp cx, 0x20
je 0x3aaa936d
cmp word [eax], 0
mov esi, eax
je 0x3aaa9428
cmp word [esi], 0x22
jne 0x3aaa9397
push 0x22
push esi
call edi
jmp 0x3aaa939b
push 0x20
mov eax, esi
call fcn.3ab3c1f6
cmp word [esi], 0x22
mov ebx, eax
jne 0x3aaa93b0
push esi
call edi
mov dword [ebp - 0x30], eax
jmp 0x3aaa93b3
mov dword [ebp - 0x30], esi
cmp word [esi], 0x22
jne 0x3aaa93be
push esi
call edi
jmp 0x3aaa93c0
mov eax, esi
mov ecx, ebx
sub ecx, dword [ebp - 0x30]
lea esi, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
call fcn.3ab3c1f6
mov ecx, dword [ebp - 0x34]
xor esi, esi
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov eax, dword [ecx + 4]
push edx
push eax
call fcn.3ab3c1f6
cmp word [ebx], si
je 0x3aaa941d
push ebx
jmp 0x3aaa93f4
test ax, ax
je 0x3aaa9401
push esi
call edi
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x20
je 0x3aaa93ee
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
cmp word [esi], 0
jne 0x3aaa938a
jmp 0x3aaa9428
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret 4

Function at 0x3aaa9a60
Capabilities:
Print debug messages

Disassembly:
push 0x64
mov eax, 0x3ab4811b
call fcn.3ab359d8
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push 0x400
mov dword [ebp - 0x30], esi
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageW]
push dword [ebp - 0x30]
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x70]
call fcn.3ab3c1f6
mov ebx, eax
push 0x3aa66cb8
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
call fcn.3ab3c1f6
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.3aa971a4
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x54]
call fcn.3ab3c1f6
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.3ab3c1f6
push dword [edi + 4]
lea ecx, [ebp - 0x34]
call fcn.3ab3c1f6
mov byte [ebp - 4], 5
cmp dword [ebp - 0x34], esi
je 0x3aaa9b0b
push esi
push 2
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
call fcn.3ab3c1f6
push edi
call fcn.3aaa99be
push dword [ebp - 0x30]
call dword [sym.imp.kernel32.dll_LocalFree]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x34]
cmp eax, esi
je 0x3aaa9b25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret
Function at 0x3aaa9dbb
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x50
mov eax, 0x3ab4db35
call fcn.3ab359d8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x34], eax
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x3aaa9ded
sub eax, ecx
sar eax, 1
cmp esi, ebx
je 0x3aaa9e1b
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x44]
push ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.3aaa9b3b
mov dword [ebp - 0x34], eax
jmp 0x3aaa9e22
mov dword [ebp - 0x34], 0x57
cmp dword [ebp - 0x34], ebx
jne 0x3aaa9f3f
lea eax, [ebp - 0x3c]
push eax
mov edi, 0xf003f
push edi
push ebx
push dword [ebp - 0x4c]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3aaa9e9e
lea eax, [ebp - 0x5c]
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push dword [ebp - 0x50]
mov dword [ebp - 0x5c], ebx
push dword [ebp - 0x3c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push esi
mov dword [ebp - 0x48], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x48], ebx
jne 0x3aaa9e9e
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x3aa66cd8
call fcn.3ab3c1f6
push dword [ebp - 0x40]
call fcn.3aaa99be
mov eax, 0x80004005
jmp 0x3aaa9f65
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
push ebx
push 0x3aa614f0
push ebx
push dword [ebp - 0x4c]
push esi
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x3aaa9ec7
mov edi, dword [ebp - 0x40]
call fcn.3aaa9a60
jmp 0x3aaa9e94
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x3aa66d70
call fcn.3ab3c1f6
mov edi, dword [ebp - 0x40]
push dword [edi + 4]
lea esi, [ebp - 0x30]
call fcn.3aaa98d0
mov dword [ebp - 4], ebx
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.3aac470d
mov esi, eax
cmp esi, ebx
jl 0x3aaa9f21
push dword [ebp - 0x44]
push dword [ebp - 0x38]
push 3
push ebx
push dword [ebp - 0x50]
push dword [ebp - 0x3c]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
je 0x3aaa9f29
call fcn.3aaa9a60
mov dword [ebp - 0x34], 0x80004005
jmp 0x3aaa9f29
call fcn.3aaa9a60
mov dword [ebp - 0x34], esi
push dword [ebp - 0x3c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
jmp 0x3aaa9f44
call fcn.3aaa9a60
cmp dword [ebp - 0x38], ebx
je 0x3aaa9f62
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp ecx, ebx
je 0x3aaa9f59
mov byte [eax], bl
inc eax
dec ecx
jne 0x3aaa9f53
push dword [ebp - 0x38]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x34]
call fcn.3ab35a6a
ret 0xc
Function at 0x3aaab234
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x3ab49869
call fcn.3ab359d8
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], ebx
cmp dword [eax + 0xc], ebx
jne 0x3aaab337
call fcn.3ab3c1f6
mov esi, dword [eax + 0x10]
lea ecx, [ebp - 0x2c]
call fcn.3aa95baf
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x3aaab29e
push dword [0x3ab6a234]
lea ecx, [ebp - 0x54]
call fcn.3ab3c1f6
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
mov dword [ebp - 0x34], 1
call fcn.3ab1f6b9
mov byte [ebp - 0x2d], 1
test al, al
jne 0x3aaab2a1
mov byte [ebp - 0x2d], bl
mov dword [ebp - 4], ebx
test byte [ebp - 0x34], 1
je 0x3aaab2b5
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.3ab3c1f6
cmp byte [ebp - 0x2d], bl
je 0x3aaab30e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push 0x3aa6134c
push eax
call fcn.3aa97158
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.3ab3c1f6
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.3ab3c1f6
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x3aaab2f6
lea eax, [ebp - 0x28]
push 1
push ebx
push ebx
push eax
mov eax, dword [ebp - 0x38]
push 0x3aa67054
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x3aaab32c
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x3aa67060
call fcn.3ab3c1f6
mov eax, dword [ebp - 0x38]
push dword [eax + 0x58]
call fcn.3aab55fc
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
xor eax, eax
call fcn.3ab35a6a
ret 8
Function at 0x3aaae0b7
Capabilities:
Accept command line arguments

Disassembly:
push 0x38
mov eax, 0x3ab4ac5c
call fcn.3ab359d8
mov byte [ebp - 0x2f], 0
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push 0x3aa63db0
call fcn.3ab3c1f6
test eax, eax
je 0x3aaae0df
mov byte [ebp - 0x2f], 1
push 0x3aa63e30
mov byte [ebp - 0x2e], 0
call fcn.3ab3c1f6
test eax, eax
je 0x3aaae0f5
mov byte [ebp - 0x2e], 1
push 0x3aa68920
mov byte [ebp - 0x2d], 0
call fcn.3ab3c1f6
test eax, eax
je 0x3aaae10b
mov byte [ebp - 0x2d], 1
xor esi, esi
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x3c]
lea eax, [edi + 0x94c]
push edx
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x3c]
call fcn.3ab3c1f6
pop ecx
test eax, eax
je 0x3aaae134
mov byte [ebp - 0x2d], 1
mov dword [ebp - 0x34], esi
lea edx, [ebp - 0x34]
lea eax, [edi + 0xe8c]
push edx
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x34]
call fcn.3ab3c1f6
pop ecx
mov ecx, edi
call fcn.3aa9cc5c
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 2
mov esi, dword [edi + 0x184]
push 0x3aa63dec
lea ecx, [ebp - 0x44]
call fcn.3ab3c1f6
mov ebx, eax
push 0x3aa63e7c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.3ab3c1f6
mov byte [ebp - 4], 4
mov ebx, dword [ebx]
mov eax, dword [eax]
mov ecx, dword [esi]
lea edx, [ebp - 0x38]
push edx
push ebx
push eax
push esi
call dword [ecx + 0x20]
push dword [ebp - 0x40]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
mov byte [ebp - 4], 2
push dword [ebp - 0x44]
call esi
test ebx, ebx
jl 0x3aaae1f0
lea ecx, [ebp - 0x2c]
call fcn.3aa95baf
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 5
call fcn.3ab3c1f6
push 0x3aa61344
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
test eax, eax
jne 0x3aaae1e4
mov byte [ebp - 0x2d], 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
cmp byte [ebp - 0x2e], 0
jne 0x3aaae218
cmp byte [edi + 0x1155], 0
jne 0x3aaae218
cmp byte [edi + 0x24e], 0
jne 0x3aaae218
cmp byte [ebp - 0x2d], 0
jne 0x3aaae218
cmp byte [ebp - 0x2f], 0
jne 0x3aaae218
mov bl, 1
jmp 0x3aaae21a
xor bl, bl
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x3c]
call esi
mov al, bl
call fcn.3ab35a6a
ret
Function at 0x3aac49ae
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x40
mov eax, 0x3ab4a66f
call fcn.3ab35965
lea eax, [ebp - 0x4c]
xor esi, esi
push eax
mov dword [ebp - 0x10], esi
call fcn.3aac3864
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], esi
call fcn.3aaa9493
test al, al
jne 0x3aac49f2
xor edi, edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x3aa729e8
call fcn.3aa987fc
mov eax, edi
call fcn.3ab35a51
ret 0xc
push dword [ebp + 0xc]
push 4
push dword [ebp + 8]
call dword [ebp - 0x44]
mov edi, eax
cmp edi, esi
je 0x3aac4a20
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push 0x3aa726f8
call fcn.3ab3c1f6
mov ecx, dword [ebp + 0x10]
call fcn.3aac39f6
jmp 0x3aac49d9
push 0x20a
push 0x40
mov dword [ebp - 0x18], esi
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x3aac4a63
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push 0x3aa72780
call fcn.3ab3c1f6
mov ecx, dword [ebp + 0x10]
call fcn.3aac39f6
call esi
mov edi, eax
jmp 0x3aac49d9
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
jmp 0x3aac4ade
lea eax, [ebp - 0x10]
push eax
push 0x60008
push esi
push dword [ebp - 0x1c]
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x3aac4b0c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.3aac49ae
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp eax, esi
je 0x3aac4ac9
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x3aa728e8
call fcn.3ab3c1f6
mov ecx, dword [ebp + 0x10]
call fcn.3aac39f6
cmp edi, esi
jne 0x3aac4b1c
inc dword [ebp - 0x18]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x105
call ebx
mov edi, eax
cmp edi, esi
je 0x3aac4a75
cmp edi, 0x103
jne 0x3aac4afc
xor edi, edi
jmp 0x3aac4b37
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push 0x3aa727f0
jmp 0x3aac4b2a
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push 0x3aa72880
jmp 0x3aac4b2a
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push 0x3aa72960
call fcn.3ab3c1f6
mov ecx, dword [ebp + 0x10]
call fcn.3aac39f6
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x3aac49d9
Function at 0x3aad550e
Capabilities:
Accept command line arguments

Disassembly:
push 0x2c
mov eax, 0x3ab4686a
call fcn.3ab359d8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x3aad5536
test cx, cx
je 0x3aad553f
push eax
call edi
movzx ecx, word [eax]
cmp cx, 0x20
je 0x3aad552e
cmp word [eax], 0
mov esi, eax
mov byte [ebp - 0x2d], 1
je 0x3aad55fa
cmp word [esi], 0x22
jne 0x3aad555c
push 0x22
push esi
call edi
jmp 0x3aad5560
push 0x20
mov eax, esi
call fcn.3ab3c1f6
cmp word [esi], 0x22
mov ebx, eax
jne 0x3aad5575
push esi
call edi
mov dword [ebp - 0x34], eax
jmp 0x3aad5578
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x3aad5583
push esi
call edi
jmp 0x3aad5585
mov eax, esi
mov ecx, ebx
sub ecx, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
call fcn.3ab3c1f6
xor esi, esi
cmp byte [ebp - 0x2d], 0
mov dword [ebp - 4], esi
jne 0x3aad55b4
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 0x34]
add ecx, 0x30
lea edx, [ebp - 0x2c]
push edx
push eax
call fcn.3ab3c1f6
mov byte [ebp - 0x2d], 0
cmp word [ebx], si
je 0x3aad55ef
push ebx
jmp 0x3aad55c6
test ax, ax
je 0x3aad55d3
push esi
call edi
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x20
je 0x3aad55c0
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
cmp word [esi], 0
jne 0x3aad554f
jmp 0x3aad55fa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret 4
Function at 0x3aadc568
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x3ab48ea4
call fcn.3ab35a13
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x3aadc5c0
call fcn.3aaa426e
mov esi, eax
jmp 0x3aadc6d6
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x3aadc5d9
call fcn.3aaa426e
jmp 0x3aadc6c8
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x3aadc5cf
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x3aadc62f
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3aadc625
lea eax, [ebp - 0x418]
call fcn.3aae43fb
mov eax, 0x8007000e
jmp 0x3aadc6f1
push 2
mov byte [ebp - 4], 2
call fcn.3ab3c1f6
cmp eax, 0x400
jbe 0x3aadc650
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.3ab3c1f6
jmp 0x3aadc65c
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x3aadc67a
cmp dword [ebp - 0x418], esi
jne 0x3aadc689
mov esi, 0x8007000e
jmp 0x3aadc6ca
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x3aadc5cf
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.3ab3c1f6
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3aadc6ef
lea eax, [ebp - 0x418]
call fcn.3aae43fb
mov eax, esi
call fcn.3ab35a7e
ret 0xc

Function at 0x3aafc8a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ab66114]
jne 0x3aafc8b0
repz ret
jmp fcn.3ab011ac
Function at 0x3ab12ca7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x3ab78694], 0
push esi
jne 0x3ab12c15
call fcn.3ab12b31
test eax, eax
je 0x3ab12c58
mov eax, dword [0x3ab78694]
cmp eax, 1
jne 0x3ab12c36
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x3ab12c58
pop esi
ret
push eax
call dword [0x3ab7869c]
test eax, eax
jne 0x3ab12ca0
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x3ab12c5c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x3ab78694]
call dword [0x3ab7869c]
mov edi, eax
test edi, edi
je 0x3ab12c81
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
jmp 0x3ab12c9d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x3ab78694]
call dword [0x3ab78698]
add edi, 0x10
cmp edi, esi
jb 0x3ab12c89
mov eax, edi
pop edi
pop esi
ret
jmp 0x3ab12c02
Function at 0x3ab15ea6
Capabilities:
Read .ini file

Disassembly:
push 0x850
mov eax, 0x3ab3f823
call fcn.3ab359d8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x858], ecx
push eax
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x85c], eax
call fcn.3ab3c1f6
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x840]
cmp eax, 4
jbe 0x3ab160d4
add eax, 0xfffffffc
push eax
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
cmp word [eax], 0x2e
jne 0x3ab160d4
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push edi
push eax
call fcn.3ab033f0
xor eax, eax
push 0x208
mov word [ebp - 0x634], ax
lea eax, [ebp - 0x632]
push edi
push eax
call fcn.3ab033f0
add esp, 0x18
push 0x105
lea eax, [ebp - 0x634]
push eax
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov esi, 0x104
cmp eax, edi
jbe 0x3ab15fa0
push edi
push edi
push edi
push edi
push 0x101
lea eax, [ebp - 0x838]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.3ab3c1f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.3ab3c1f6
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.3ab3c1f6
add esp, 0x3c
push 0x3aa64b80
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.3ab3c1f6
xor eax, eax
push ebx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push edi
push eax
call fcn.3ab033f0
add esp, 0x18
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x3aa540d4
push 0x3aa53c70
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x3ab1600d
call fcn.3ab3c1f6
movzx eax, ax
push 0xa
lea ecx, [ebp - 0x428]
movzx eax, ax
push ecx
push eax
call fcn.3ab3c1f6
add esp, 0xc
push 0x3aa64b94
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.3ab3c1f6
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x840]
add eax, 0xfffffffd
push eax
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
cmp dword [ebp - 0x83c], 8
mov eax, dword [ebp - 0x850]
jae 0x3ab16053
lea eax, [ebp - 0x850]
push edi
push eax
call fcn.3ab3c1f6
pop ecx
pop ecx
test eax, eax
je 0x3ab160be
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
mov eax, dword [ebp - 0x840]
push 0x3aa540c8
add eax, 0xfffffffd
push eax
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
cmp dword [ebp - 0x83c], 8
mov eax, dword [ebp - 0x850]
jae 0x3ab160a0
lea eax, [ebp - 0x850]
push edi
push eax
call fcn.3ab3c1f6
pop ecx
pop ecx
test eax, eax
je 0x3ab160be
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 0x840]
ja 0x3ab160f0
mov ecx, dword [ebp - 0x858]
xor eax, eax
mov word [ecx], ax
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
xor eax, eax
call fcn.3ab35a6a
ret 0xc
cmp dword [ebp - 0x83c], 8
mov eax, dword [ebp - 0x850]
jae 0x3ab16105
lea eax, [ebp - 0x850]
push eax
push ecx
push dword [ebp - 0x858]
call fcn.3ab3c1f6
add esp, 0xc
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x854]
call fcn.3ab3c1f6
xor eax, eax
inc eax
jmp 0x3ab160e8