joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504367
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov ebp, esp
neg eax
cmc
adc eax, 0x365e31b2
push 0xffffffffffffffff
test ax, 0x1972
sbb ah, 0xcb
push 0x439f4c
push 0x5081b8
cbw
mov eax, dword fs:[0]
cmc
push eax
cmp cx, bx
mov dword fs:[0], esp
clc
sub esp, 0x58
jmp 0x1ce723d
jne 0x1ce74ee
push 0x10
jmp 0x1ce74e1
call fcn.00509a0d
test eax, eax
jmp 0x4020d7
call fcn.00509851
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1ce55c4], eax
jmp 0x41cf84
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.005093c1
mov dword [ebp - 0x64], eax
test si, 0x7e53
test byte [ebp - 0x30], 1
jmp 0x1ce69f3
push dword [ebp - 0x64]
jmp 0x1ce6543
call fcn.00509249
pop ecx
not cx
movzx cx, ah
xchg ch, ch
pop ecx
jmp 0x41cff1
push ecx
jmp 0x402619
mov dword [0x1ce0444], ecx
shr eax, 0x10
jmp 0x43a0f7
call fcn.0050971f
mov dword [0x1ce03d4], eax
jmp 0x1ce7092
ret
push 0xa
pop eax
jmp 0x1ce72d2
mov dword [0x1ce0440], eax
jmp 0x1ce7df9
jmp 0x1ce6b21
jne 0x40223c
push 0x1c
jmp 0x1ce6f9b
call dword [sym.imp.KERNEL32.dll_GetVersion]
sub edx, edx
movsx cx, ch
stc
mov dl, ah
or ch, 0x33
rcl ecx, cl
mov dword [0x1ce044c], edx
mov ecx, eax
test dx, ax
and ecx, 0xff
mov dword [0x1ce0448], ecx
test ax, bx
cmp esp, 0x365e3bd5
shl ecx, 8
cmc
clc
add ecx, edx
cmp ecx, edi
jmp 0x41cf63
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
jmp 0x1ce75b2
call fcn.00509cf0
pop ecx
stc
test eax, eax
jmp 0x504389
je 0x439f58
movzx eax, word [ebp - 0x2c]
jmp 0x1ce72d2
push ebp
jmp 0x402075
call fcn.00504494
pop ecx
jmp 0x40223c
call fcn.005094d2
call fcn.00509419
call fcn.0050768a
mov dword [ebp - 0x30], esi
mov eax, ebp
sete ah
lea eax, [ebp - 0x5c]
jmp 0x4024a0
push esi
push edi
mov dword [ebp - 0x18], esp
jmp 0x1ce60ff
push ebx
jmp 0x1ce7207
push eax
jmp 0x4025e5
call fcn.005076b7
mov eax, dword [ebp - 0x14]
movsx ecx, bx
movzx ecx, bp
mov ecx, dword [eax]
jmp 0x1ce768f
call fcn.00504494
pop ecx
stc
cmp ecx, 0x7b125714
xor esi, esi
jmp 0x1ce8049
mov dword [ebp - 0x68], ecx
push eax
jmp 0x4028ff
call fcn.005135da
mov dword [ebp - 0x60], eax
jmp 0x1ce7908
mov ecx, dword [ecx]
jmp 0x1ce7563
push eax
jmp 0x1ce7481
push 1
jmp 0x1ce68cf
mov dword [ebp - 4], esi
jmp 0x402442

Function at 0x518baf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x518be7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00516b9c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00516b74
jmp 0x518bf3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x51a2a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51a2e6
call fcn.005201bd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51a2e6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51a2dd
xor eax, eax
jmp 0x51a2ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051a2f4
pop edi
pop esi
pop ebx
ret 4

Function at 0x5206ed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x52071b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x520739
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00520653
jmp 0x520739
mov eax, dword [esi + 0x14]
test eax, eax
je 0x520739
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00520653
test edi, edi
mov eax, edi
jne 0x520723
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1ba9d67
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5000e008], 0x8088405
inc edx
mov dword [ebx + 0x5000e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x1bac7ab
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x5000f73c]
xor ebx, ebx
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
mov dword [0x5000f73c], eax
and eax, 0xff
add dword [0x5000f740], eax
imul eax, dword [0x5000f740], 0x8088405
inc eax
mov dword [0x5000f740], eax
mov eax, dword [0x5000f744]
movzx ebx, al
xor bl, byte [0x5000f743]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
mov dword [0x5000f744], eax
ret

Function at 0x1bac81b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov byte [ebp - 1], 0
mov dword [0x5000f73c], 0x12345678
mov dword [0x5000f740], 0x23456789
mov dword [0x5000f744], 0x34567890
movzx ecx, byte [0x5000f748]
test ecx, ecx
je 0x1bac8a8
xor esi, esi
mov dl, byte [esi + 0x5000f749]
call fcn.01bac7ab
inc esi
cmp esi, ecx
jb 0x1bac84f
xor esi, esi
call fcn.01bac803
xor byte [esi + 0x5000f724], al
mov dl, byte [esi + 0x5000f724]
call fcn.01bac7ab
inc esi
cmp esi, 0xc
jb 0x1bac861
mov al, byte [0x5000f72f]
test word [0x5000f90e], 8
jne 0x1bac89c
cmp al, byte [0x5000f919]
jne 0x1bac8a8
mov byte [ebp - 1], 1
jmp 0x1bac8a8
cmp al, byte [0x5000f913]
jne 0x1bac8a8
mov byte [ebp - 1], 1
popal
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x1bac93b
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [0x5000f82c]
cmp dword [0x5000f828], edi
jae 0x1bac950
mov edi, dword [0x5000f828]
test edi, edi
je 0x1bac97b
sub dword [0x5000f82c], edi
lea esi, [0x5003aa00]
add esi, dword [0x5000f824]
add edi, esi
call fcn.01bac803
xor byte [esi], al
mov dl, byte [esi]
call fcn.01bac7ab
inc esi
cmp esi, edi
jb 0x1bac968
popal
ret

Function at 0x1bac97f
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esi, [0x5003aa00]
mov edi, esi
add edi, dword [0x5000f828]
call fcn.01bac803
mov dl, byte [esi]
xor byte [esi], al
call fcn.01bac7ab
inc esi
cmp esi, edi
jb 0x1bac98e
popal
ret

Function at 0x1bad18b
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
cmp byte [0x5000f840], 0
jne 0x1bad1f1
cmp dword [0x5000fdb0], 0
jle 0x1bad1f1
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.01bab983
test eax, eax
jge 0x1bad1f1
mov dword [0x5000f834], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.01baa8fb
ret
mov eax, dword [0x5000fdb0]
test eax, eax
je 0x1bad22d
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0x1bad20d
mov dword [0x5000fdc4], eax
cmp dword [0x5000fda8], 0x10000
jb 0x1bad25e
mov esi, 0x5002a800
mov edi, esi
add esi, dword [0x5000fda8]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov dword [0x5000fdb0], 0
ret
Function at 0x1bb0007
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x5000fda8], 0x8000
jle 0x1bb006c
pushal
mov edx, dword [0x5000fda8]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + 0x50042b04], edx
dec ebx
jns 0x1bb0036
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0x1bb0059
popal
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov eax, dword [0x5000f91e]
sub eax, dword [0x5000fda0]
mov dword [0x5000fdb0], eax
cmp dword [0x5000fdb0], 0x8000
jle 0x1bb009c
mov dword [0x5000fdb0], 0x8000
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.01bab9af
cmp eax, dword [0x5000fdb0]
je 0x1bb00e9
mov dword [0x5000f834], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.01baa8fb
ret
mov eax, dword [0x5000fdbc]
add eax, dword [0x5000fdb0]
mov dword [0x5000fda8], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
pushal
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0x1bb011d
mov dword [0x5000fdc4], eax
popal
ret
Function at 0x10027001
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x100a47a4
push ecx
xor esi, esi
lea ecx, [ebp - 0x18]
push 0x10004328
stosd dword es:[edi], eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100271aa
push 4
pop edi
test eax, eax
je 0x1003c0e8
push ecx
push 0x10004380
push ebx
lea ecx, [ebp - 0x18]
call fcn.100271aa
test eax, eax
je 0x1003c11e
lea ecx, [ebp - 0x18]
call fcn.100271eb
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x1001ce0c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10027041
mov eax, dword [ebp - 4]
mov dword [0x100a47a4], eax
jmp 0x10027041
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1001ce24
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003c152
mov eax, dword [ebp - 4]
or dword [0x100a47b0], 1
mov dword [0x100a47a8], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x1001ce3c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10027058
mov ecx, dword [ebp - 4]
or dword [0x100a47b0], 2
mov dword [0x100a47ac], ecx
jmp 0x10027058
Function at 0x100277f0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp word [ebx], 8
jne 0x100278b5
mov eax, dword [ebx + 8]
test eax, eax
je 0x100278b5
push eax
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov esi, eax
lea eax, [esi + 0x13]
and eax, 0xfffffff0
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x1003c284
push edi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
add eax, 0xfffffff0
add edi, eax
xor eax, eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 4]
push dword [ebx + 8]
lea eax, [edi + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi], esi
push 0
push edi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push edi
call dword [sym.imp.DPAPI.dll_CryptProtectMemory]
test eax, eax
je 0x1003c21c
mov eax, dword [ebx + 8]
test esi, esi
je 0x1002788b
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x10027880
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 8
mov dword [ebx + 8], edi
mov word [ebx], ax
xor esi, esi
test byte [0x100a4750], 2
jne 0x1003c267
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x100278ae
test byte [0x100a4750], 2
je 0x1003c24e
cmp dword [0x100aa408], 0
je 0x1003c24e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x100aa408]
push eax
mov eax, dword [0x100aa100]
push 0x34c00
push eax
call fcn.10056748
add esp, 0x10
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, 0x80004005
test byte [0x100a4750], 2
je 0x100278ac
mov ecx, dword [0x100aa100]
mov edx, 0x37809
push esi
push 0x10004b48
call fcn.1005682f
mov esi, eax
jmp 0x100278ac
test byte [0x100a4750], 2
mov esi, 0x8007000e
je 0x100278ac
push 0xdb
mov edx, 0x10004ae8
mov ecx, esi
call fcn.10051341
add esp, 4
jmp 0x1003c25a
Function at 0x100278b9
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 8
pop eax
cmp word [edi], ax
jne 0x10027958
mov esi, dword [edi + 8]
test esi, esi
je 0x10027958
push ebx
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push esi
call dword [sym.imp.DPAPI.dll_CryptUnprotectMemory]
test eax, eax
je 0x1003c2f1
mov eax, dword [esi]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003c2ac
push dword [ebp - 4]
lea ecx, [esi + 4]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [edi + 8]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
test eax, eax
je 0x1002792f
mov byte [esi], bl
inc esi
sub eax, 1
jne 0x10027927
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 8
pop eax
mov word [edi], ax
mov eax, dword [ebp - 8]
mov dword [edi + 8], eax
test byte [0x100a4750], 2
jne 0x1003c32c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x10027951
push dword [edi + 8]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
test eax, eax
je 0x1003c2c1
mov byte [esi], bl
inc esi
sub eax, 1
jne 0x1003c2b9
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test byte [0x100a4750], 2
mov ebx, 0x8007000e
je 0x1002794f
push 0xa7
mov edx, 0x10004a28
mov ecx, ebx
call fcn.10051341
pop ecx
jmp 0x10027942
test byte [0x100a4750], 2
je 0x1003c322
cmp dword [0x100aa40c], ebx
je 0x1003c322
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0x100aa40c]
push 0x2b000
push dword [0x100aa100]
call fcn.10056748
add esp, 0x10
mov ebx, 0x80004005
jmp 0x10027942
mov ecx, dword [0x100aa100]
mov edx, 0x2c009
push ebx
push 0x10004a88
call fcn.1005682f
mov ebx, eax
jmp 0x1002794f
Function at 0x1002d96a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push edi
push ecx
xor edi, edi
lea ecx, [ebp - 0x30]
push str.CLSID2206CDB0_19C1_11D1_89E0_00C04FD7A829
push SysReAllocString
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.100378c3
test eax, eax
jne 0x1002da56
push ebx
push 4
pop ebx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x10004788
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b5a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x100047c4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b67
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x10004768
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b74
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x10004738
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop ebx
test eax, eax
je 0x10041b81
test byte [0x100a4750], 2
jne 0x10041b90
mov byte [0x100a4760], 1
lea ecx, [ebp - 0x30]
call fcn.100271eb
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [0x100a47c8], eax
jmp 0x1002d9c6
mov eax, dword [ebp - 4]
mov dword [0x100a2d78], eax
jmp 0x1002d9ef
mov eax, dword [ebp - 4]
mov dword [0x100a30c0], eax
jmp 0x1002da18
cmp dword [ebp - 4], edi
setne byte [0x100a30bc]
jmp 0x1002da42
cmp dword [0x100aa47c], edi
je 0x1002da4f
movzx eax, byte [0x100a30bc]
push eax
push dword [0x100a30c0]
push dword [0x100a2d78]
push dword [0x100a47c8]
push dword [0x100aa47c]
push 0x33c00
push dword [0x100aa12c]
call fcn.10056748
add esp, 0x1c
jmp 0x1002da4f
Function at 0x100354a9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x118], 0
cmp dword [0x100a47c4], 0
jne 0x100354f7
lea eax, [ebp - 0x118]
push eax
push ecx
lea ecx, [ebp - 0x114]
call fcn.100355f9
pop ecx
pop ecx
test eax, eax
jne 0x10048578
push 1
call fcn.10035550
call fcn.10035507
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret
cmp dword [0x100a4750], 0
lea eax, [ebp - 0x114]
mov dword [0x100a2a74], eax
mov byte [ebp - 7], 0
jne 0x1004859c
mov eax, 0xfff
push eax
push eax
call fcn.10056190
mov ecx, 0x100a2bc4
call fcn.10055df2
cmp dword [0x100a2008], 0x10056220
jne 0x100485dd
cmp dword [ebp - 0x118], 0
je 0x100485dd
push 0x10007538
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x100a2a74]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10007540
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x100a2a74], 0x100092ad
jmp 0x100354f7
Function at 0x100366f1
Capabilities:
Get system information on windows

Disassembly:
push 0x100a3574
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x100a47b0]
test cl, 1
jne 0x10048f1b
test cl, 2
jne 0x10048f2a
ret
mov eax, dword [0x100a47a8]
mov dword [0x100a2d80], eax
jmp 0x1003670b
mov eax, dword [0x100a47ac]
mov dword [0x100a2d7c], eax
ret

Function at 0x10037fb0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10037fee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10037fe6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10037ff0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10037fd6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100380c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100380d6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100380f1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1004a90d
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039f0e
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100a2bb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], 0x100029e0
mov dword [esi + 4], 0x100029d0
mov dword [esi + 8], 0x100029b8
mov dword [esi + 0xc], 0x1000299c
mov dword [esi + 0x10], 0x10002988
mov dword [esi + 0x14], 0x10002974
mov dword [esi + 0x2c], 0x10002964
mov dword [esi + 0x30], 1
call fcn.1006beda
lock dec dword [0x100a350c]
mov ecx, esi
call fcn.1004ab47
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10050d19
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
xor ebx, ebx
mov dword [ebp - 0x228], 0x10e
lea eax, [ebp - 0x114]
mov byte [ebp - 0x114], bl
push eax
push ebx
push 2
push edx
push ebx
push ecx
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x10050d69
xor eax, eax
jmp 0x10050d98
lea ecx, [ebp - 0x224]
call fcn.1004bcdf
test eax, eax
je 0x10050d95
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
neg eax
pop ecx
sbb eax, eax
inc eax
pop ecx
mov dword [esi], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret
Function at 0x10055ab7
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
call fcn.100388e0
mov eax, esp
lea ecx, [ebp - 0x28]
push 0x1c
push ecx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10055b5f
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x48]
lea eax, [edi + 0x2000]
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 8]
sub esi, ebx
cmp esi, eax
jb 0x10055b5f
push 0x1c
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10055b5f
add edi, dword [ebp - 0x1c]
mov eax, 0x1000
test dword [ebp - 0x18], eax
je 0x10055b0e
test dword [ebp - 0x14], 0x100
mov edi, dword [ebp - 0x28]
je 0x10055b3d
xor eax, eax
inc eax
jmp 0x10055b61
cmp esi, edi
jb 0x10055b5f
push 4
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea eax, [ebp - 0xc]
push eax
push 0x104
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10055b61
xor eax, eax
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret

Function at 0x10055d21
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10055d3c
sub ecx, edx
cmp ecx, 3
jae 0x10055d51
xor eax, eax
jmp 0x10055de3
mov al, byte [esi]
push ebx
xor ebx, ebx
push edi
cmp al, 0x2e
je 0x10055d88
cmp al, 0x5c
je 0x10055dc2
cmp al, 0x2f
je 0x10055dc2
cmp byte [esi + 1], 0x3a
je 0x10055dc2
lea eax, [ebp - 0x118]
mov edi, 0x10e
push eax
lea eax, [ebp - 0x114]
push eax
push edi
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
jmp 0x10055da3
lea eax, [ebp - 0x118]
mov edi, 0x10e
push eax
lea eax, [ebp - 0x114]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x10055ddf
cmp eax, edi
jae 0x10055ddf
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
mov byte [ebp - 7], bl
push eax
push edi
push esi
call dword [sym.imp.msvcrt.dll_strncpy_s]
add esp, 0x10
mov bl, byte [esi + 3]
push esi
mov byte [esi + 3], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
mov byte [esi + 3], bl
cmp eax, 3
sete cl
mov eax, ecx
jmp 0x10055de1
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10037870
mov esp, ebp
pop ebp
ret