joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb5a890
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0xd0a210], 0
push esi
mov esi, ecx
je 0xb5a9b3
cmp dword [esi + 8], 0
ja 0xb5a9c8
inc dword [esi]
cmp dword [esi], 0x708
jae 0xbe1787
cmp dword [esi + 4], 0
je 0xb5a9f7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0xb5a939
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x18]
jne 0xb5a9a4
inc dword [esi + 0x14]
push edi
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edi, eax
sub edi, dword [ebp - 0xc]
cmp edi, dword [esi + 4]
jae 0xb5a940
cmp edi, dword [esi + 0xc]
pop edi
jae 0xbe1829
mov eax, dword [esi + 0x14]
push 0
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push dword [0xb28b1c]
push dword [0xb28b18]
call dword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
mov esi, eax
or esi, 0x10000000
jl 0xbe1850
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x1c], 0
jne 0xb5a8ff
mov ecx, 0xd0a320
mov byte [esi + 0x1c], 1
call fcn.00b5b9de
cmp eax, 5
jne 0xbe17d5
cmp dword [0xd0a360], 0
jne 0xb5aa38
mov cl, 1
cmp eax, 1
je 0xbe17ec
test cl, cl
je 0xb5a8ff
lea edx, [esi + 0x1d]
mov ecx, esi
call fcn.00b848e7
call fcn.00b84b5e
test eax, eax
js 0xbe17f9
xor cl, cl
call fcn.00bc3511
test eax, eax
jns 0xb5a8ff
jmp 0xbe1811
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
jmp 0xb5a8ee
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [esi + 0x10], eax
mov byte [0xd0a210], 1
jmp 0xb5a8a8
push 0x3e8
push 0
push 0x3e8
push dword [esi + 0x20]
push dword [0xd0ac3c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetCoalescableTimer]
test eax, eax
je 0xbe1770
mov dword [esi + 8], 0
jmp 0xb5a8b2
mov al, byte [esi + 0x1d]
test al, al
jne 0xbe17ae
mov ecx, 0x7530
mov dword [esi + 4], ecx
test al, al
jne 0xbe17b8
mov eax, 0xb2a530
lea ecx, [ebp - 4]
mov edx, 0xb288f0
push ecx
push eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00b52a81
test eax, eax
js 0xb5a8ca
jmp 0xbe17c2
xor cl, cl
jmp 0xb5a96c
mov ecx, dword [ebp + 4]
mov edx, 0x55
push 0xb2fc6c
call fcn.00c2616d
jmp 0xb5a9eb
mov ecx, esi
call fcn.00c6c354
test eax, eax
jns 0xb5a8c0
mov ecx, dword [ebp + 4]
mov edx, 0x5d
push eax
push 0xb2fc6c
call fcn.00b913f8
jmp 0xb5a8c0
mov ecx, 0x1f40
jmp 0xb5aa07
mov eax, 0xb409d4
jmp 0xb5aa17
mov eax, dword [ebp - 4]
test eax, eax
je 0xb5a8ca
mov dword [esi + 4], eax
jmp 0xb5a8ca
cmp eax, 7
je 0xb5a95d
cmp eax, 6
jne 0xb5aa38
jmp 0xb5a95d
test cl, cl
je 0xb5a8ff
jmp 0xb5a979
mov ecx, dword [ebp + 4]
mov edx, 0x8d
push eax
push 0xb2fc6c
call fcn.00b913f8
jmp 0xb5a990
mov ecx, dword [ebp + 4]
mov edx, 0x8e
push eax
push 0xb2fc6c
call fcn.00b913f8
jmp 0xb5a8ff
mov ecx, esi
call fcn.00c6c354
test eax, eax
jns 0xb5a909
mov ecx, dword [ebp + 4]
mov edx, 0x94
push eax
push 0xb2fc6c
call fcn.00b913f8
jmp 0xb5a909
mov ecx, dword [ebp + 4]
mov edx, 0x6e
push esi
push 0xb29dd8
call fcn.00bc2921
mov ecx, dword [ebp + 4]
mov edx, 0x96
push esi
push 0xb2fc6c
call fcn.00b913f8
jmp 0xb5a939
Function at 0xb5dab9
Capabilities:
Capture webcam image

Disassembly:
push 8
mov eax, 0xbc8a7f
call fcn.00bc132b
mov edi, ecx
mov ecx, dword [edi + 0x1d0]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x18]
cmp esi, fcn.00b5c160
jne 0xbe378e
call fcn.00b5c160
test al, al
jne 0xb5db65
mov eax, dword [edi + 0x19c]
mov ebx, dword [ebp + 8]
push ebx
mov dword [eax + 0x24], ebx
mov ecx, dword [edi + 0x1a0]
call fcn.00b5772e
mov ecx, dword [edi + 0x1a4]
push ebx
call fcn.00b5772e
mov ecx, dword [edi + 0x1ac]
push ebx
call fcn.00b5772e
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00b82546
push 0
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00b5d087
test eax, eax
js 0xb5db4c
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0xd0cffc]
call esi
push 0
push ebx
push 0x419
push dword [edi + 0x4c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
lea ecx, [ebp - 0x14]
call fcn.00b82546
call fcn.00bc12da
ret 4
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb5dae4
Function at 0xb5f9d3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp byte [ecx + 0x88], 0
jne 0xbe460c
push 2
pop eax
push dword [ebp + 0x10]
push esi
push edi
push edx
push eax
push edi
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetTimeFormatEx]
cmp byte [ebp + 0x14], 0
je 0xb5fa51
push 6
lea eax, [ebp - 0x10]
push eax
push 0x6c
push edi
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
test eax, eax
jle 0xb5fa51
push 0xb29f68
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
jne 0xb5fa51
mov ecx, edi
cmp word [esi], di
je 0xb5fa51
mov eax, esi
cmp word [eax], 0x3a
je 0xb5fa63
inc ecx
lea eax, [esi + ecx*2]
cmp word [eax], di
jne 0xb5fa42
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x2236
mov word [eax], dx
jmp 0xb5fa48
mov eax, edi
jmp 0xb5f9ff
Function at 0xb5ff97
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x28], eax
mov esi, ecx
mov byte [eax], 0
lea eax, [ebp - 0x24]
push edi
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetLocalTime]
cmp byte [esi + 0x1cf], 0
mov dx, word [ebp - 0x1a]
mov di, word [ebp - 0x1c]
je 0xb600ee
cmp byte [esi + 0x88], 0
lea ecx, [esi + 0x8e]
push 2
mov word [esi + 0x8a], di
mov word [esi + 0x8c], dx
pop ebx
jne 0xbe46ce
mov eax, ebx
push 0x28
push ecx
push 0
lea ecx, [ebp - 0x24]
push ecx
push eax
push 0
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetTimeFormatEx]
cmp byte [esi + 0x88], 0
lea edi, [esi + 0xde]
jne 0xbe46d5
push 0x28
push edi
push 0
lea eax, [ebp - 0x24]
push eax
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetTimeFormatEx]
push 6
lea eax, [ebp - 0x14]
push eax
push 0x6c
push ebx
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
test eax, eax
jle 0xb60072
push 0xb29f68
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
jne 0xb60072
mov ecx, ebx
cmp word [edi], bx
je 0xb60072
mov eax, edi
cmp word [eax], 0x3a
je 0xb600e1
inc ecx
lea eax, [edi + ecx*2]
cmp word [eax], bx
jne 0xb60063
push ebx
push 0x28
lea eax, [esi + 0x12e]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x40
push ebx
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetDateFormatEx]
push ebx
push 0x28
lea eax, [esi + 0x17e]
push eax
push 0xb29e4c
lea eax, [ebp - 0x24]
push eax
push 0x40
push ebx
call dword [sym.imp.api_ms_win_core_datetime_l1_1_1.dll_GetDateFormatEx]
mov eax, dword [ebp - 0x28]
mov byte [esi + 0x1cf], bl
mov byte [eax], 1
cmp byte [esi + 0x88], 0
jne 0xbe46dc
movzx eax, word [ebp - 0x18]
push 0x3c
pop ecx
sub ecx, eax
imul eax, ecx, 0x3e8
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
mov edx, 0x2236
mov word [eax], dx
jmp 0xb60069
cmp byte [esi + 0x1ce], 0
je 0xb5ffd6
movsx ecx, word [esi + 0x8a]
movzx eax, di
cmp eax, ecx
jne 0xb5ffd6
movsx ecx, word [esi + 0x8c]
movzx eax, dx
cmp eax, ecx
je 0xb600b2
jmp 0xb5ffd6
xor eax, eax
jmp 0xb5fffc
xor ebx, ebx
jmp 0xb60021
movzx ecx, word [ebp - 0x16]
mov eax, 0x3e8
sub eax, ecx
jmp 0xb600ce
Function at 0xb76b32
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
push dword [esi + 0xc]
mov dword [esi + 0x34], edi
call dword [sym.imp.api_ms_win_shcore_path_l1_1_0.dll_Ordinal_170]
test eax, eax
jne 0xb76b64
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push 2
push 0x42
call dword [sym.imp.SHLWAPI.dll_AssocQueryKeyW]
test eax, eax
jns 0xb76b6a
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push edi
push edi
push 0xb2a4c0
push edi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
je 0xb76b8b
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xb76b64
mov dword [esi + 0x34], 1
jmp 0xb76b80
Function at 0xb777d9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x20
mov eax, 0xbcad0e
call fcn.00bc12f8
mov esi, ecx
cmp byte [esi + 0x19], 0
mov dword [ebp - 0x20], 8
jne 0xb7787e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0xb7787e
push 4
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x10
call dword [sym.imp.api_ms_win_power_base_l1_1_0.dll_CallNtPowerInformation]
test eax, eax
js 0xb77826
test byte [ebp - 0x18], 2
jne 0xb778bc
cmp byte [ebp + 8], 0
jne 0xbf1326
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 0x1c]
setb bl
xor eax, eax
mov edi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp bl, byte [esi + 0x18]
jne 0xb77886
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0xb778fd
test edi, edi
jne 0xb77919
call fcn.00bc12c6
ret 4
test bl, bl
je 0xb778c3
cmp dword [esi + 0x40], 0
je 0xb7789f
cmp dword [esi + 0x24], 0
je 0xb7789f
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [esi + 0x20], eax
mov byte [esi + 0x18], bl
test bl, bl
je 0xb778f7
mov eax, dword [esi + 0x1c]
push eax
push 0x12c
push dword [esi + 0x10]
push 0
call dword [sym.imp.api_ms_win_core_threadpool_legacy_l1_1_0.dll_ChangeTimerQueueTimer]
jmp 0xb77861
mov bl, 1
jmp 0xb7783f
cmp dword [esi + 0x24], 0
je 0xb7789f
cmp dword [esi + 0x40], 0
je 0xb7789f
cmp dword [esi + 0x20], 0
je 0xb7789f
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [esi + 0x20]
lea ecx, [ebp - 0x2c]
push 0xffffffffffffffff
push dword [esi + 0x40]
mov dword [ebp - 0x14], eax
call fcn.00b7ace0
and dword [esi + 0x20], 0
mov edi, dword [ebp - 0x2c]
jmp 0xb7789f
imul eax, dword [esi + 0x1c], 5
jmp 0xb778a9
test edi, edi
je 0xb7787e
push eax
push edi
push 2
pop edx
mov ecx, 0xb2ba98
call fcn.00b80eb2
jmp 0xb77876
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb7787e
xor bl, bl
cmp dword [ebp - 0x1c], 0
je 0xb7783f
jmp 0xb77830
Function at 0xb7a7ff
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
and dword [esp + 4], 0
lea eax, [esp + 4]
push ebx
push esi
push edi
push eax
push 0x20019
push 0
mov edi, 0xb300d0
mov dword [esp + 0x24], edx
push edi
push reloc.SHCORE.dll_Ordinal_1
mov dword [esp + 0x28], ecx
xor bl, bl
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0xb7a84a
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xb7a87b
cmp esi, 0x80070002
je 0xb7a87b
push edi
push 0xb30440
push esi
push 0xb30450
push 0xd8
push dword [ebp + 4]
call fcn.00caa094
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.00c1dccf
jmp 0xb7a896
mov ebx, esi
shr ebx, 0x1f
xor bl, 1
cmp dword [esp + 0x10], 0
je 0xb7a894
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor esi, esi
test esi, esi
js 0xb7a93e
test bl, bl
je 0xb7a93e
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 4
push eax
xor ebx, ebx
push ebx
push 0x10
push edi
push 0xb300d0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jle 0xb7a8e3
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xb7a90e
test edi, edi
jne 0xb7a8ee
mov edi, 0xb284a8
push edi
push 0xb300d0
push 0xb45318
push esi
push 0xb30450
push 0x4f
push dword [ebp + 4]
call fcn.00caa094
add esp, 0x1c
jmp 0xb7a914
mov ebx, dword [esp + 0x20]
xor esi, esi
test esi, esi
js 0xb7a93e
mov eax, dword [esp + 0x18]
test eax, ebx
je 0xb7a93e
cmp eax, 1
jne 0xb7a930
lea ecx, [esp + 0x14]
call fcn.00ca9e82
jmp 0xb7a93e
cmp eax, 2
jne 0xb7a93e
lea ecx, [esp + 0x14]
call fcn.00ca9e2a
lea eax, [ebp + 8]
xor dl, dl
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 4]
and dword [esp + 0x40], 0
mov dword [esp + 0x38], eax
mov eax, 0x86
push ecx
mov dword [esp + 0x40], 0xb29dd8
mov word [esp + 0x48], ax
call fcn.00b55378
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0xb16b84
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x48]
lea eax, [esp + 0x38]
push eax
push 0x79780d
call fcn.00b7a6fa
lea edx, [esp + 0x48]
lea ecx, [esp + 0x24]
call fcn.00b7a5f3
lea ecx, [esp + 0x48]
call fcn.00b7a73f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xb7ae56
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov eax, esi
mov edi, 0x80004005
shr eax, 4
push 0
inc eax
movzx eax, ax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
test eax, eax
je 0xb7aec7
push eax
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test eax, eax
je 0xb7aec7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0xb7aec7
and esi, 0xf
jbe 0xb7aeb1
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub esi, 1
jne 0xb7aea3
movzx eax, word [ecx]
test ax, ax
je 0xb7aed0
add ecx, 2
push eax
push ecx
mov ecx, ebx
call fcn.00b7ace0
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0xb284a8
jmp 0xb7aebc
Function at 0xb7c256
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
call fcn.00b7c3b8
mov edi, eax
test edi, edi
js 0xb7c2cd
push 0x1f0003
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventExW]
mov dword [ebx + 0x20], eax
test eax, eax
je 0xbf28e5
push esi
lock inc dword [0xd0addc]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0xd0cffc]
call esi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0xb84c70
push edi
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test eax, eax
je 0xbf290c
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xbf28fc
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0xb7c2cd
mov edi, 0x80004005
jmp 0xb7c2cd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xbf2923
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0xbf292a
mov edi, 0x80004005
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
push dword [ebx + 0x28]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
and dword [ebx + 0x28], 0
lock dec dword [0xd0addc]
jmp 0xb7c2cc
Function at 0xb7c5e1
Capabilities:
Allocate thread local storage
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x214], ecx
cmp dword [0xd08c18], 0xffffffff
je 0xb7c626
mov ecx, dword [ebp - 0x214]
mov eax, dword [0xd08c18]
mov dword [ecx], eax
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
push 0xb2b254
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0x10
test esi, esi
js 0xb7c608
push ebx
push edi
cmp dword [0xd08c18], 0xffffffff
jne 0xb7c6b3
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov edi, eax
test edi, edi
je 0xbf2afe
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
push eax
push 1
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSemaphore]
test eax, eax
je 0xbf2ae8
push 0
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x210]
mov dword [0xd08c18], eax
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
jns 0xb7c64e
pop edi
pop ebx
jmp 0xb7c608
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x12a
je 0xb7c67c
jmp 0xb7c6a8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0xbf2b48
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
je 0xbf2b48
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 1]
push eax
push edi
push 0
call dword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_CreateSemaphoreW]
mov ebx, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test ebx, ebx
je 0xbf2b78
cmp eax, 0xb7
je 0xbf2b6f
mov dword [0xd08c18], edi
jmp 0xb7c6af
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xbf2b5f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb7c6af
mov esi, 0x80004005
jmp 0xb7c6b3
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0xbf2b90
mov esi, eax
test esi, esi
jle 0xbf2b89
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xbf2b90
mov esi, 0x80004005
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
jmp 0xb7c6af
Function at 0xb84431
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push ebx
push esi
push edi
push 0xf0000000
push 1
push eax
push eax
lea eax, [ebp - 8]
mov ebx, edx
push eax
mov edi, ecx
call dword [sym.imp.CRYPTSP.dll_CryptAcquireContextW]
mov esi, eax
test esi, esi
je 0xb844d1
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.CRYPTSP.dll_CryptCreateHash]
mov esi, eax
test esi, esi
je 0xb844c6
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xb8447e
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.CRYPTSP.dll_CryptHashData]
mov esi, eax
test esi, esi
je 0xb844bd
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x10
push eax
push ebx
push 2
push dword [ebp - 4]
call dword [sym.imp.CRYPTSP.dll_CryptGetHashParam]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.CRYPTSP.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.CRYPTSP.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb84bd5
Capabilities:
Create thread

Disassembly:
push 0x56
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
je 0xb84bf3
xor ecx, ecx
mov edx, 0xd0a64c
inc ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0xb84bf4
ret
push 0
push 8
push 0
push 0xbbe430
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
ret

Function at 0xb84d43
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push 2
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20000070
push ecx
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jle 0xb84d69
cmp dword [ebp - 4], 1
sete bl
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb8b6ae
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x424], ecx
push eax
call fcn.00b8b7c0
xor ebx, ebx
test eax, eax
lea eax, [ebp - 0x41c]
push eax
jne 0xbd366f
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], 0x208
push eax
push ebx
push 2
push 0xb266fc
push 0xb26690
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
test eax, eax
jne 0xbd36f5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_PathRemoveArgsW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveBlanksW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
mov esi, eax
cmp word [esi], bx
je 0xb8b7b1
mov al, bl
mov edi, ebx
mov byte [ebp - 0x415], al
test al, al
jne 0xb8b79c
mov ecx, dword [ebp - 0x424]
mov ecx, dword [ecx + edi*4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb8b762
mov eax, dword [ebp - 0x424]
sub ecx, edx
sar ecx, 1
push ecx
push dword [eax + edi*4]
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpNIW]
test eax, eax
jne 0xb8b7b8
mov al, 1
mov byte [ebp - 0x415], al
inc edi
cmp edi, 1
jl 0xb8b752
test al, al
je 0xbd3707
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
mov esi, 0xb28bf4
jmp 0xb8b748
mov al, byte [ebp - 0x415]
jmp 0xb8b78e
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], ebx
push eax
lea eax, [ebp - 0x414]
mov edi, 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x430]
push eax
sub esp, 0x10
call fcn.00c6f7e3
mov esi, eax
test esi, esi
jne 0xbd36d9
cmp dword [ebp - 0x41c], ebx
je 0xbd36d9
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x430]
lea ecx, [ebp - 0x42c]
call fcn.00c6f8c9
mov esi, eax
cmp dword [ebp - 0x42c], ebx
je 0xbd36fa
push dword [ebp - 0x428]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [ebp - 0x42c], ebx
jmp 0xbd36fa
mov esi, 0x103
test esi, esi
jne 0xb8b79c
jmp 0xb8b71a
push 0xb3e220
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
test eax, eax
jne 0xb8b79e
jmp 0xb8b79c

Function at 0xb8b7c0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 4]
mov dword [edi], esi
push eax
push 0x20019
push esi
push 0xb26708
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xb8b7f4
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
xor esi, esi
inc esi
mov dword [edi], esi
jmp 0xb8b7ec