joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406460
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x80ff4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40473c
call fcn.004070c1
push 4
mov dword [esp + 0x18], 0
call fcn.00407f66
mov edi, eax
add esp, 4
test edi, edi
je 0x4064d4
push ebx
call fcn.00406f99
mov dword [edi], eax
call fcn.00406d58
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407082
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4064c8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004070aa
pop ebx
jmp 0x4064d6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4089d1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813520]
jne 0x4089db
repz ret
jmp fcn.0040d12c
Function at 0x411d72
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x813520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b0d1
and dword [ebp - 0x14], 0
cmp dword [0x816374], 0
mov dword [ebp - 0x18], eax
jne 0x411e25
push GetFileAttributesA
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je GetLastError
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403948
push ebx
call edi
test eax, eax
je GetConsoleAliasW
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403938
push ebx
mov dword [0x816374], eax
call edi
push eax
call esi
push 0x403924
push ebx
mov dword [0x816378], eax
call edi
push eax
call esi
push 0x403908
push ebx
mov dword [0x81637c], eax
call edi
push eax
call esi
mov dword [0x816384], eax
test eax, eax
je 0x411e25
push 0x4038f0
push ebx
call edi
push eax
call esi
mov dword [0x816380], eax
mov eax, dword [0x816380]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411e7e
cmp dword [0x816384], ecx
je 0x411e7e
push eax
call esi
push dword [GetTempPathW]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411e7e
test ebx, ebx
je EnumSystemLocalesA
call edi
test eax, eax
je 0x411e75
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411e75
test byte [ebp - 8], 1
jne 0x411e7e
or dword [ebp + 0x10], 0x200000
jmp 0x411eb1
mov eax, dword [0x816378]
cmp eax, dword [ebp - 0x18]
je 0x411eb1
push eax
call esi
test eax, eax
je 0x411eb1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411eb1
mov eax, dword [0x81637c]
cmp eax, dword [ebp - 0x18]
je 0x411eb1
push eax
call esi
test eax, eax
je 0x411eb1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x816374]
call esi
test eax, eax
je 0x411ecd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411ecf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004089d1
leave
ret
Function at 0x80ea50
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0xb9b100], 0x37
jne 0x80eae8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x4042b4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x4042e8
push 0x404360
push 0x404388
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0xb9b104]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81b164]
mov byte [ecx + esi], al
add esp, 0xc0c
ret
Function at 0x80ed50
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file
Read .ini file

Disassembly:
mov eax, dword [0xb9b100]
mov ecx, dword [0x81b164]
sub esp, 0xdbc
push ebx
push ebp
shr eax, 3
xor ebx, ebx
push esi
push edi
cmp eax, ebx
jbe 0x80ef64
mov edi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x80ed86
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0xb9b100], 0x1c
jne 0x80ed9d
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x814700]
mov eax, dword [0x814704]
mov esi, dword [edi]
mov ebp, dword [0x814708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x81470c]
mov edi, 0xc6ef3720
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], 0x20
jmp 0x80edda
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x30]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0xb9a084], ebx
mov eax, dword [esp + 0x18]
add dword [0xb9a084], eax
mov edx, dword [0xb9a084]
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
cmp dword [0xb9b100], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x80ee74
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0xb9b100], 0x979
mov dword [0xb9a088], 0xff6b3619
mov dword [0xb9a08c], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x80eedf
push 0x404120
push 0
lea eax, [esp + 0x5d0]
push eax
push 0x4041c8
push 0x404240
push 0x4042a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
lea ecx, [esp + 0x1cc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0xb9b100]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x80ef01
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x80edd8
cmp eax, 0x8d4
jne 0x80ef1d
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
cmp dword [0xb9b100], 0x17
jne 0x80ef53
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x80ed80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdbc
ret
Function at 0x401060
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401120
mov dword [esp], eax
call 0x4010d0
jmp dword [sym.imp.ucrtbase.dll_exit]

Function at 0x401120
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00401110
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40118e
xor ecx, ecx
xor edx, edx
jmp 0x401166
cmp al, 0x5c
jne 0x4011e8
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x401183
cmp al, 9
je 0x40116e
cmp al, 0x20
jne 0x401150
test ecx, ecx
je 0x401183
xor edx, edx
jmp 0x40115b
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401180
cmp al, 0x20
je 0x401180
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x4011a9
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401000
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x401172
and edx, 1
jne 0x401172
xor ecx, 1
jmp 0x40115b
Function at 0x448860
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
cmp word [0x5a2440], 1
push ebx
push esi
push edi
jne 0x44889e
mov eax, dword [ecx + 8]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 0x10]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x10], eax
jmp 0x4489a1
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
movzx ebx, byte [ecx + 7]
movzx esi, byte [ecx + 0xb]
shl edx, 8
or edx, eax
shl esi, 8
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
movzx edi, byte [ecx + 0x17]
movzx eax, byte [ecx + 6]
or ebx, eax
shl edi, 8
movzx eax, byte [ecx + 5]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 0xa]
or esi, eax
movzx eax, byte [ecx + 9]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 8]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 4], esi
movzx esi, byte [ecx + 0xf]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xd]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xc]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x12]
mov dword [ebp - 8], esi
movzx esi, byte [ecx + 0x13]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x11]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x10]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x16]
or edi, eax
movzx eax, byte [ecx + 0x15]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x14]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1a]
mov dword [ebp - 0xc], edi
movzx edi, byte [ecx + 0x1b]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x19]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x18]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1e]
mov dword [ebp - 0x10], edi
movzx edi, byte [ecx + 0x1f]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1d]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1c]
shl edi, 8
or edi, eax
mov ecx, dword [ebp + 8]
mov eax, edx
and eax, 0x3ffffff
shr edx, 0x1a
mov dword [ecx], eax
mov eax, ebx
shl eax, 6
or edx, eax
shr ebx, 0x13
and edx, 0x1ffffff
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 0xd
or eax, ebx
shr edx, 0xd
mov ebx, dword [ebp - 8]
and eax, 0x3ffffff
mov dword [ecx + 8], eax
mov eax, ebx
shl eax, 0x13
or eax, edx
shr ebx, 6
mov edx, dword [ebp - 0xc]
and eax, 0x1ffffff
mov dword [ecx + 0xc], eax
mov eax, esi
and eax, 0x1ffffff
shr esi, 0x19
mov dword [ecx + 0x14], eax
mov eax, edx
shl eax, 7
or esi, eax
mov dword [ecx + 0x10], ebx
mov ebx, dword [ebp - 0x10]
and esi, 0x3ffffff
mov eax, ebx
shr edx, 0x13
shl eax, 0xd
or eax, edx
shr ebx, 0xc
and eax, 0x1ffffff
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
mov eax, edi
shl eax, 0x14
or eax, ebx
shr edi, 6
and eax, 0x3ffffff
and edi, 0x1ffffff
mov dword [ecx + 0x24], edi
pop edi
pop esi
mov dword [ecx + 0x20], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d340
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x456190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x45627f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xa
push str.STEAM_SPLIT_GUID
push esi
call ebx
mov ecx, eax
test ecx, ecx
je 0x4561f9
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4561f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4561f9
mov edx, dword [ebp + 0x10]
mov edi, 1
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_GUIDD
push esi
call ebx
test eax, eax
je 0x456238
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456238
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456238
mov edx, dword [ebp + 0xc]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_MINSTANCE
push esi
call ebx
pop ebx
test eax, eax
je 0x456278
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456278
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456278
mov edx, dword [ebp + 0x14]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 3
pop edi
sete al
pop esi
pop ebp
ret
Function at 0x457f70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x114
mov ecx, dword [0x6acf18]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x652078]
cmp eax, dword [ecx + 4]
jg 0x4580a3
mov eax, dword [0x652074]
test eax, eax
jne 0x457fab
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
push esi
call eax
test eax, eax
je 0x457fe1
lea eax, [ebp - 8]
push eax
mov eax, ebx
or eax, 0x20019
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x457fea
cmp eax, 2
jne 0x457fe3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457ff0
sub ecx, edx
cmp byte [ecx + edi - 1], 0x5c
lea esi, [ecx + edi]
je 0x458009
mov byte [esi], 0x5c
inc esi
mov byte [esi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x458082
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.00575df0
push ebx
push edi
push dword [ebp + 8]
call fcn.00457f70
add esp, 0x18
test eax, eax
jne 0x458082
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x458034
mov byte [esi - 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push ebx
push edi
push dword [ebp + 8]
call dword [0x652074]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x652078
call fcn.0056b84d
add esp, 4
cmp dword [0x652078], 0xffffffff
jne 0x457f99
push str.RegDeleteKeyExA
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x652078
mov dword [0x652074], eax
call fcn.0056b803
add esp, 4
jmp 0x457f99
Function at 0x45dd30
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x591c6d
push eax
mov dword fs:[0], esp
sub esp, 0x68
cmp byte [0x6526f0], 0
push ebx
push esi
je 0x45deda
mov eax, dword [0x652a00]
test eax, eax
je 0x45deda
cmp byte [eax], 0
je 0x45deda
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesEventLogApplicationSteam_Client_Service
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x45dde7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.0045ae70
push esi
push str.Could_not_create_the_registry_key_for_event_log_source:_gle:__u_n
lea ecx, [eax + 0x20]
push ecx
lea ecx, [eax + 8]
push ecx
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045eca0
add esp, 0x2c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov eax, esp
mov ecx, 0x59934c
mov dword [eax], 0x6526f0
mov eax, dword [0x652a00]
test eax, eax
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.00470330
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00471940
push eax
push str.EventMessageFile
push dword [ebp - 0x10]
call fcn.004642c0
add esp, 0xc
test eax, eax
je 0x45de3f
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.0045ae70
push str.Could_not_set_the_event_message_file._n
jmp 0x45de73
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 7
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45deb5
push 0
push 0
lea ecx, [ebp - 0x74]
call fcn.0045ae70
push str.Could_not_set_the_supported_types_for_event_log_source._n
lea ecx, [eax + 0x20]
push ecx
lea ecx, [eax + 8]
push ecx
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045eca0
add esp, 0x28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
xor bl, bl
call fcn.00470790
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
mov bl, 1
call fcn.00470790
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Could_not_get_path_to_current_executable_n
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045eca0
mov ecx, dword [ebp - 0xc]
add esp, 0x28
xor al, al
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ee20
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ee5c
test al, 3
je 0x45ee4c
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45ee5c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
pop esi
sete al
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x45ee70
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45eeda
test al, 3
je 0x45ee9d
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45eeda
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45eec5
test al, 3
je 0x45eec5
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45eeda
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
pop edi
sete al
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x45f550
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0
push dword [ebp + 8]
xor bl, bl
mov byte [ebp - 1], bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45f695
call fcn.0047f570
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45f67d
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push str.StringFileInfo040904b0OriginalFilename
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f67d
mov ecx, dword [ebp + 0xc]
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45f5c5
sub edx, esi
mov esi, dword [ebp - 8]
sar edx, 1
lea eax, [edx + 1]
cmp esi, eax
jne 0x45f67d
mov edx, dword [ebp - 0xc]
add esi, esi
sub esi, 4
jb 0x45f601
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x45f606
add edx, 4
add ecx, 4
sub esi, 4
jae 0x45f5f0
cmp esi, 0xfffffffc
je 0x45f633
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x45f67d
cmp esi, 0xfffffffd
je 0x45f633
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x45f67d
cmp esi, 0xfffffffe
je 0x45f633
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x45f67d
cmp esi, 0xffffffff
je 0x45f633
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x45f67d
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5ccf04
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f67d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f67d
cmp dword [ebp - 8], 0x34
jb 0x45f67d
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [eax + 8]
or ecx, esi
mov byte [ebp - 1], 1
mov dword [edx], 0
mov dword [edx + 4], esi
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
call fcn.0047f570
push 0
push ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret