joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5744e5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00574461
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x574654
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x574654
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x574609
jg 0x574541
test eax, eax
je 0x5745ff
push 1
push 0x1000
call fcn.0056537e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x574564
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5745f6
push 0x8000
push ebx
call fcn.0055f8e6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x57458d
jg 0x574588
cmp ecx, 0x1000
jb 0x57458d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00569456
add esp, 0x10
cmp eax, 0xffffffff
je 0x5745d2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x574588
jl 0x5745b9
test ecx, ecx
jne 0x57457a
push dword [ebp - 0xc]
push ebx
call fcn.0055f8e6
push esi
call fcn.00565344
add esp, 0xc
xor ebx, ebx
jmp 0x574662
cmp byte [edi + 0x24], 0
je 0x5745e9
cmp dword [edi + 0x20], 5
jne 0x5745e9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5745f4
mov ebx, dword [edi + 0x18]
jmp 0x5745f6
xor ebx, ebx
push esi
call fcn.00565344
pop ecx
jmp 0x574662
test ecx, ecx
jg 0x5745cb
jl 0x574609
test eax, eax
jae 0x5745cb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00569878
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x574629
cmp byte [edi + 0x1c], 0
je 0x5745cb
jmp 0x57465a
push ebx
call fcn.0056bef2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5745cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x574662
cmp byte [edi + 0x1c], 0
je 0x57465f
mov ebx, dword [edi + 0x18]
jmp 0x574662
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00569878
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x575cf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x575d1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x575d1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100053c2
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x1001ac1b
call fcn.1001a456
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 1
ja 0x100053ea
mov ecx, dword [0x10029d48]
call fcn.100043a3
test al, al
jne 0x100053ea
xor cl, cl
jmp 0x100053ec
mov cl, 1
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x10], cl
test edx, edx
jne 0x1000542c
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
cmp dword [esi + 8], 0
je 0x1000541d
movzx eax, cl
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.100153c8
mov esi, dword [esi]
mov cl, byte [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
jne 0x10005403
jmp 0x10005550
mov edi, dword [ebx + 0xc]
xor cl, cl
mov esi, dword [edi]
jmp 0x1000543f
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x10]
je 0x10005445
mov esi, dword [esi]
cmp esi, edi
jne 0x10005435
jmp 0x10005492
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov eax, ecx
or eax, edx
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
je 0x10005477
call dword [sym.imp.kernel32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jne 0x10005473
cmp eax, 0x1388
jbe 0x10005477
mov edi, esi
jmp 0x1000548c
movzx eax, byte [ebp - 0x10]
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.100153c8
mov cl, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, eax
jne 0x100054c7
test cl, cl
jne 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
mov ecx, dword [esi + 8]
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.100153c8
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054ab
jmp 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x100054ec
mov ecx, dword [esi + 8]
cmp edx, dword [ecx + 0x10]
je 0x100054e5
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.100153c8
mov edx, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054cd
mov ecx, dword [edi + 8]
push 1
push dword [ebp - 0x10]
push 0x80043074
call fcn.100153c8
push 0
lea ecx, [ebx + 0x3c]
call fcn.100153c8
mov esi, 0x10029eb0
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10029d58]
test eax, eax
je 0x1000552b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x10029d58], 0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x10005550
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
xor eax, eax
call fcn.1001a427
ret 0xc
Function at 0x1000ddaa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1001b43b
call fcn.1001a456
and dword [ebp - 0x14], 0
xor ecx, ecx
and dword [ebp - 0x18], 0
inc ecx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xd], cl
test edi, edi
jne 0x1000ddd5
mov esi, 0x80070057
jmp 0x1000df49
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], 0x1b
jne 0x1000de05
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
lea ecx, [ebx - 0x14]
push eax
call fcn.100153c8
mov esi, eax
test esi, esi
js 0x1000de02
cmp byte [ebp + 0xf], 0
je 0x1000de02
mov byte [ebp - 0xd], 0
jmp 0x1000de64
xor ecx, ecx
inc ecx
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1000de33
sub eax, 1
je 0x1000de2c
sub eax, 3
je 0x1000de25
sub eax, 1
jne 0x1000de64
mov eax, dword [0x10029d28]
jmp 0x1000de38
mov eax, dword [0x10029d30]
jmp 0x1000de38
mov eax, dword [0x10029d24]
jmp 0x1000de38
mov eax, dword [0x10029d2c]
test eax, eax
je 0x1000de64
cmp dword [ebx + 0xc4], 0
jne 0x1000de4d
cmp dword [ebx + 0x18], 0
jne 0x1000de4d
xor cl, cl
push ecx
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push dword [edi + 8]
push eax
call fcn.1000d1e8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000dee1
cmp dword [ebx + 0xc4], 4
jne 0x1000de7a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1000dee1
cmp dword [edi + 4], 0x100
je 0x1000de8c
cmp dword [edi + 4], 0x101
jne 0x1000dea7
cmp dword [edi + 8], 0x1b
jne 0x1000dea7
cmp dword [ebx + 0xc4], 0
jne 0x1000dea7
cmp dword [ebx + 0x18], 0
jne 0x1000dea7
cmp byte [ebp - 0xd], 0
jne 0x1000dee1
mov ecx, dword [ebx + 0x34]
xor esi, esi
test ecx, ecx
je 0x1000dec0
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x1001d700
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x1000df49
cmp dword [ebp - 0x18], 0
jne 0x1000ded5
mov esi, 0x8000ffff
jmp 0x1000df49
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, 1
jne 0x1000df3e
cmp dword [edi + 4], 0x100
jne 0x1000df0c
cmp dword [edi + 8], 9
jne 0x1000df3e
push 0
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push 9
push dword [0x10029d40]
call fcn.1000d1e8
jmp 0x1000df41
cmp dword [edi + 4], 0x104
jne 0x1000df3e
cmp dword [edi + 8], 0x79
jne 0x1000df3e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x1000df3e
push 0x10
call edi
test bx, ax
je 0x1000df3e
xor eax, eax
xor esi, esi
jmp 0x1000df41
mov eax, dword [ebp - 0x14]
test eax, eax
push 1
pop eax
cmovne esi, eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000df5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1001a427
ret 8
Function at 0x100153c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100153d7
pop dword [ebp - 0x18]
mov eax, 0x8563ba1f
add eax, 0x8a9d99b8
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4510835
add dword [ebp - 0x28], 0x4a013d16
mov dword [ebp - 0x24], 0xed8a1d6
add dword [ebp - 0x24], 0x235aaa6f
mov dword [ebp - 0x20], 0xd85e2f0e
add dword [ebp - 0x20], 0x73ee1520
mov dword [ebp - 0x1c], 0xdb9c344
add dword [ebp - 0x1c], 0xf2463cbc
lea eax, [ebp - 0x28]
push eax
mov eax, 0xbda5b562
sub eax, 0xada3e55a
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xef8c5392
sub dword [ebp - 0x28], 0x7b19ea3c
mov dword [ebp - 0x24], 0x44d741e9
sub dword [ebp - 0x24], 0x36ae074
mov dword [ebp - 0x20], 0x46350047
sub dword [ebp - 0x20], 0xe2c593db
mov dword [ebp - 0x1c], 0x48da81ab
sub dword [ebp - 0x1c], 0x48da81ab
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xd5d653a2
sub eax, 0xc5d48376
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38852
push 0
call eax
mov ecx, 0x49ed0b20
add ecx, 0xb61335ab
xor edx, edx
add edx, eax
mov ebx, 0x4a6e3320
sub ebx, 0x3a6b5320
add ebx, dword [ebp - 0x18]
mov esi, 0x46f634c8
add esi, 0xebd51169
add dword [ebp - 8], 0x9011022d
mov edi, dword [ebx]
xor dword [ebp - 0xc], 0x38f39c2f
sub edi, esi
mov dword [edx], edi
sub dword [ebp - 0x14], 0xe39439ad
add edx, 0x4bd47339
sub edx, 0x4bd47335
add ebx, 0xbea3fa1
sub ebx, 0xbea3f9d
loop 0x100154fb
add eax, 0x6face4aa
add eax, 0x90541155
xor ebx, ebx
add ebx, eax
add eax, 0x5738a256
sub eax, 0x5738a251
mov ecx, 0xe29d25fb
add ecx, 0x2d62da05
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40cc7b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434ad7
call fcn.004339e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004028e9
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004028e9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004028e9
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40d3e4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434bff
call fcn.004339e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004029bc
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004029bc
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004029bc
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004029bc
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.004029bc
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.004029bc
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.004029bc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40dd71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40dd80
pop dword [ebp - 0x4c]
mov eax, 0x98c8e25b
sub eax, 0x988804db
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x37c27
push 0
mov eax, 0xd3a1815f
sub eax, 0xd35e012f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3c62
mov esi, eax
mov edi, 0x44c600
add edi, dword [ebp - 0x4c]
mov edx, 0xc0b3c8d
add dword [ebp - 0x14], 0xba56ab3b
mov ebx, dword [edi]
xor dword [ebp - 0x40], ebx
sub ebx, edx
xor dword [ebp - 0x40], edi
mov dword [esi], ebx
xor dword [ebp - 0x28], 0x3b97dac6
add esi, 4
add edi, 0x98ba4c20
add edi, 0x6745b3e4
loop 0x40ddcd
add eax, 0x4db30249
add eax, 0xb24de212
mov ebx, eax
add eax, 5
mov ecx, 0xe1c23af2
add ecx, 0x1e7dc50e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x412d32
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x412d5f
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x444740]
xor eax, edi
inc esi
cmp esi, edx
jb 0x412d3e
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401443
pop dword [ebp - 0x10]
mov eax, 0x401443
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd0a272b0
add dword [ebp - 0x20], 0x7dafd29b
mov dword [ebp - 0x1c], 0xd5f5bf29
sub dword [ebp - 0x1c], 0xa3c272e4
mov dword [ebp - 0x18], 0xed24c766
sub dword [ebp - 0x18], 0xa0d88338
mov dword [ebp - 0x14], 0x98e28954
add dword [ebp - 0x14], 0x671d76ac
lea eax, [ebp - 0x20]
push eax
mov eax, 0xd2b741ff
sub eax, 0xd276c0fb
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe0b8896e
add dword [ebp - 0x20], 0x93b9dfe8
mov dword [ebp - 0x1c], 0x18566dee
sub dword [ebp - 0x1c], 0xd6ea0c79
mov dword [ebp - 0x18], 0x246260da
add dword [ebp - 0x18], 0x3f0d0b92
mov dword [ebp - 0x14], 0x7e6dd106
sub dword [ebp - 0x14], 0x7e6dd106
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x6a9dd210
add eax, 0x95a2aef0
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39f56
push 0
call eax
mov ecx, 0x4eac
xor edx, edx
add edx, eax
mov ebx, 0x55c0a49f
sub ebx, 0x5579c09f
add ebx, dword [ebp - 0x10]
mov edi, 0x50428d36
add edi, 0x68ea8902
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
mov dword [ebp - 4], 0x6a78c935
xor esi, edi
add dword [ebp - 0xc], ebx
mov dword [edx], esi
xor dword [ebp - 8], ecx
add edx, 0x5468cae7
sub edx, 0x5468cae3
add ebx, 0xf9a53dcd
add ebx, 0x65ac237
loop 0x40155c
add eax, 0x12d83
mov ebx, eax
add eax, 5
mov ecx, 0xa783e0
sub ecx, 0x6783e0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x407d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4f021c
call fcn.004a237d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407d2e
xor eax, eax
jmp 0x407dae
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407d45
xor eax, eax
jmp 0x407dae
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x407d91
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x407d91
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x407d68
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x407d9d
xor eax, eax
jmp 0x407dae
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x407dab
xor eax, eax
jmp 0x407dae
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40a310
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov ecx, 0x4f0499
call fcn.004a237d
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a4d9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x40a388
mov dword [ebp - 0x10], 0x64
mov dword [ebp - 8], 0
jmp 0x40a39a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jae 0x40a4d9
mov dword [ebp - 4], 0
push 0x104
push 0
lea edx, [ebp - 0x228]
push edx
call fcn.004a4810
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0x104
push 0x104
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.004a4810
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
push str._04u
push 0x104
lea edx, [ebp - 0x124]
push edx
call fcn.004091a0
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a430
jmp 0x40a391
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push str.NetCfgInstanceId
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a463
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a391
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402620
push eax
call fcn.004aadc9
add esp, 8
test eax, eax
je 0x40a48e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a391
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push str.Characteristics
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a4ca
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a4d9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a391
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x40b6c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4beec5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
mov ecx, 0x4f0715
call fcn.004a237d
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40b6f9
mov al, 1
jmp 0x40b824
push 0x208
push 0
lea eax, [ebp - 0x260]
push eax
call fcn.004a4810
add esp, 0xc
mov dword [ebp - 0x1c], 0
push 0x104
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x58], 0x3c
push 0x38
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004a4810
add esp, 0xc
mov dword [ebp - 0x4c], 0x4c7c80
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x14]
call fcn.00404640
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
test eax, eax
je 0x40b782
push str._upprivi__can_ins_d
lea ecx, [ebp - 0x14]
call fcn.00404e80
jmp 0x40b78f
push str._upprivi
lea ecx, [ebp - 0x14]
call fcn.00404e80
lea ecx, [ebp - 0x14]
call fcn.00404f60
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40b80e
push str.GPT_Chrome
lea ecx, [ebp - 0x18]
call fcn.00404590
mov byte [ebp - 4], 1
push 0x4c7ce0
lea ecx, [ebp - 0x18]
call fcn.00405120
push 4
push 0x4c7d04
lea ecx, [ebp - 0x18]
call fcn.00404f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x40b7ea
push 0
call fcn.004ab4d4
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00404b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404b70
mov al, byte [ebp - 0xd]
jmp 0x40b824
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404b70
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x4f0d35
call fcn.004a237d
push 0x4ca2f4
push 0x81
call fcn.00412c70
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d5bf
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call fcn.00412c70
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d5b5
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412c70
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x40d5b5
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041ac10
add esp, 0xc
push 0
push ecx
mov ecx, esp
push str.res.xml
call fcn.0040d420
call fcn.0040d450
mov ecx, eax
call fcn.00420e10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret