joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41897a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push 0x431304
push dword [esp + 0x10]
push dword [0x43cba4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x418a70
push ebx
push esi
push dword [0x43cba4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4189cd
push esi
push dword [0x43cba4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4189cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4189d4
xor eax, eax
jmp 0x418a6f
push ebp
push edi
push ebx
xor ebp, ebp
push 2
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x418a69
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x418a62
push ebx
push esi
push eax
call fcn.0041dd90
add esp, 0xc
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x18]
push eax
push ebp
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x418a5b
push ebp
push dword [esp + 0x1c]
call fcn.0041890f
mov ecx, dword [esp + 0x18]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
je 0x418a5b
mov ecx, dword [esi + 8]
mov dword [esi + 8], ebp
test ecx, ecx
jne 0x418a53
push 0xffffff
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x418a53
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4

Function at 0x418fe1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041cc40
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.00418938
cmp byte [0x44e7f2], 0
jne 0x419076
push 6
push dword [0x43a14c]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040b69d
push eax
call fcn.004108e7
test eax, eax
jne 0x419076
push 0x43055c
call fcn.00418dcd
lea eax, [ebp - 0x1020]
push eax
call fcn.00421ea5
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x101e], cx
lea eax, [ebp - 0x20]
push eax
call fcn.0041dc30
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp
ret
Function at 0x4190d2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x43a164], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41911d
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x45791c], ax
xor eax, eax
mov word [0x45791e], ax
mov dword [0x43a164], 0x45791c
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ee34
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x43a154
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41931a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041cc40
cmp byte [0x442128], 0
je 0x4193c3
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041a777
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4193c3
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4193ba
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41939e
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040ef14
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x41946f
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0041cc40
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x41948a
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x419497
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x41955a
movzx eax, word [esi]
test ax, ax
je 0x41955a
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x4194e4
test edi, edi
je 0x4194ee
test ebx, ebx
jne 0x4194ee
test ecx, ecx
je 0x4194e0
mov byte [ecx], 1
mov ebx, ebp
jmp 0x419505
cmp eax, 0xd
je 0x419518
cmp eax, 0xa
je 0x41951b
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x419513
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x4194c6
jmp 0x41951b
mov byte [edx], 1
jmp 0x41951b
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x419554
mov word [edi], ax
test ebx, ebx
je 0x419554
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040ef14
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x41955c
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x419567
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x4195b6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x4195be
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b9af
Capabilities:
Hide graphical window

Disassembly:
and dword [0x4420f8], 0
push 1
push dword [esp + 8]
mov byte [0x4420f5], 1
mov byte [0x4420f6], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401273
cmp dword [0x442100], 0
jne 0x41b9ef
cmp byte [0x44211b], 0
je 0x41b9f8
cmp dword [0x442114], 0
jne 0x41ba0b
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41bb0b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041cc40
cmp byte [0x442128], 0
je 0x41bb95
cmp word [0x456918], 0
je 0x41bb95
push esi
lea eax, [ebp - 0x1008]
push eax
push 0x456918
call fcn.0041a777
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41bb94
push dword [ebp + 8]
call fcn.00421ea5
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41bb9b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041cc40
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040ed09
mov esi, eax
test esi, esi
je 0x41bbf3
movzx ecx, word [esi]
push ecx
jmp 0x41bbde
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040ee00
test al, al
jne 0x41bbd7
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x411f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x411f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411f38
mov eax, 1
add ebx, ebx
jne 0x411f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411f50
jne 0x411f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411f50
xor ecx, ecx
sub eax, 3
jb 0x411f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411ff2
mov ebp, eax
add ebx, ebx
jne 0x411f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411fbc
inc ecx
add ebx, ebx
jne 0x411fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411f9d
jne 0x411fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411fcd
jmp 0x411f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411fdc
add edi, ecx
jmp 0x411f3e
pop esi
mov edi, esi
mov ecx, 0x1e6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411ffa
cmp byte [edi], 4
jne 0x411ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x411fff
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x41206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x123a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x123e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x123e4]
or eax, eax
je 0x412068
mov dword [ebx], eax
add ebx, 4
jmp 0x412049
call dword [esi + 0x123ec]
mov ebp, dword [esi + 0x123e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4120a2
sub esp, 0xffffff80
jmp 0x401260
Function at 0x1001600
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a21c]
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp eax, 2
push edi
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
mov dword [ebp - 0x14], ebx
jne 0x1001705
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001705
lea eax, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x100167a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100167a
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10016ee
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x10016ee
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x1c]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10016ee
cmp dword [esi], ebx
mov dword [ebp - 8], ebx
jbe 0x10016e5
lea edi, [esi + 4]
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10016da
inc dword [ebp - 8]
add edi, 8
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
jb 0x10016bc
jmp 0x10016e5
push 1
pop eax
mov dword [0x100a21c], eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x1001702
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001b42
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b6e
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001bc5
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012e8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001baf
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001bc5
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001bcf
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003c23
xor eax, eax
jmp 0x1001bd2
push 1
pop eax
pop esi
leave
ret

Function at 0x1001c31
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a300], 0
je 0x1001c74
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c74
push 0x100a300
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1001e6b
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
xor ebx, ebx
cmp byte [0x100a300], bl
je 0x1001f63
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f63
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x344]
push eax
push ebx
mov esi, 0x100a300
push ebx
push esi
mov dword [ebp - 8], 0x238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f59
mov al, byte [0x10012c4]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001f14
lea eax, [ebp - 0x10c]
push 0x10012c4
push eax
call fcn.010059ea
lea eax, [ebp - 0x10c]
push 0x100ae84
push eax
lea eax, [ebp - 0x344]
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret

Function at 0x10020cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002129
lea eax, [ebp - 0x104]
push 0x1001324
push eax
call fcn.010059ea
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002129
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100212f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002178
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100216f
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x1002180
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10021cd
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10021c4
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1002222
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100223f
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002242
and eax, 0x10
ret 4

Function at 0x1002374
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
and byte [edi], 0
cmp byte [esi], 0x23
jne 0x1002440
movsx eax, byte [esi + 1]
inc esi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov esi, eax
je 0x1002440
cmp bl, 0x57
je 0x1002434
lea eax, [ebp - 0x108]
push 0x1001334
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.010059ea
lea eax, [ebp + 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x108]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100244a
lea eax, [ebp + 8]
push eax
push edi
push 0
push 0
push 0x10012c4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002429
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100244a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100244a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x1002457
push esi
push edi
call fcn.010059ea
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002461
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x7c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
jle 0x10025b9
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x80]
add eax, ebx
lea esi, [eax + ecx + 0x84]
mov eax, dword [eax + ecx + 0xbc]
lea eax, [eax + ebx + 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01002374
test eax, eax
je 0x10025cd
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x100258a
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x10025cd
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x10025cb
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100257d
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001368
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100257d
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x100257d
add esi, 0x10
push dword [esi - 0xc]
mov eax, dword [ebp - 0x10]
push dword [esi - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0100260a
push dword [esi]
mov dword [ebp + edi - 0x28], eax
mov eax, dword [ebp - 0x10]
push dword [esi - 4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0100260a
mov dword [ebp + edi - 0x30], eax
add edi, 4
add esi, 0x18
cmp edi, 8
jl 0x100252b
cmp dword [ebp - 0x28], 0
jl 0x1002571
cmp dword [ebp - 0x30], 0
jle 0x100257d
cmp dword [ebp - 0x24], 0
jl 0x10025c2
cmp dword [ebp - 0x2c], 0
jg 0x10025c2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
jmp 0x10025a2
mov eax, dword [ebp - 0xc]
add eax, esi
cmp dword [eax], edi
jne 0x10025cd
cmp dword [eax + 4], edi
jne 0x10025cd
cmp dword [eax + 0xc], edi
jne 0x10025cd
cmp dword [eax + 0x10], edi
jne 0x10025cd
inc dword [ebp - 8]
add dword [ebp + 8], 0x3c
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], 0x18
cmp eax, dword [ebx + 0x7c]
jl 0x1002487
mov dword [ebp - 0x14], 1
jmp 0x10025cd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
mov dword [eax], ecx
je 0x10025e3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1002754
Capabilities:
Encode data using xor

Disassembly:
jb 0x1002729
add al, 0xd3
mov ebp, ebx
mov ebp, 0x3fb1e71f
sub edx, 0xa0f9
lea esi, [0xde6987b1]
neg ch
call 0x1002754
jne 0x100274d
lea ebx, [0x27eba300]
imul edi, ebp
push ebp
not bh
pop edx
imul edi, edx
cmp esi, ebp
jno 0x1002760
xchg bh, dl
imul ebx, esi, 0x441a24d4
and ecx, eax
cmp dh, ch
mov ebp, 0xfabe91e6
lea ecx, [ebx]
mov edi, 0x3ac9bbcb
imul edx, esi, 0xc4465e3e
push ecx
imul edx, edi
pop ebx
sub eax, ebx
and ch, dl
pop ebx
je 0x100278b
neg ebp
mov ecx, ebx
mov al, 0x19
jb 0x1002793
imul esi, edx, 0x38dc2b5c
mov dh, ah
cmp edi, edi
movd mm5, ebx
inc ecx
adc ah, bl
dec edx
test edi, ebp
bswap ebp
lea edx, [ebp]
movsx ebx, ax
ja 0x10027b4
or ebx, 0xf5c54c49
mov ch, 0xf9
push edx
add bl, 0xa0
pop edi
cmp ebx, 0x3c9
jno 0x10027cd
test esi, edi
imul edx, edx, 0x765379a2
xchg eax, ebx
and edx, eax
mov al, 0x9f
sub esi, edi
mov ecx, 0xcb944307
bswap esi
ja 0x10027df
not cl
sbb ecx, edx
bswap ebp
inc ebp
add ch, 0xfa
cmp ch, ch
mov esi, 0xffff3ab0
neg ch
xor esi, 0xc30b
add esi, 0x645
movzx ebp, bp
or esi, 0xfff95f61
jmp 0x1002807
add esi, 0x6a0b9
imul ecx, edx, 0x114d938a
mov edx, esi
imul esi, edi
xor ebp, eax
cmp edi, 0xc8eb
jbe 0x100282e
lea ebp, [0x1bf3878b]
imul esi, eax, 0xad6893eb
test eax, ecx
mov edi, 0
imul ebp, ebx, 0x8e0c6870
mov ebp, edx
lea edi, [edx]
add ecx, ebp
lea eax, [edi]
dec esi
imul eax, eax, 0x89
sbb ch, 0xc9
xchg ebx, eax
bswap ebp
test ecx, ebx
test al, 0xad
movzx ecx, ah
mov edx, 0x566d
add edi, eax
xor edx, 0x46aa
xchg edi, edi
lea eax, [edx]
inc dh
sub eax, 0x41a
dec ebp
xchg esi, eax
test dl, ch
sub esi, 0x70c
cmp eax, 0x4edb58f
sub ebx, esi
xchg edx, ecx
add ebx, 0x5a0
movsx edx, ch
cmp edi, edi
add dl, 0xf
cmp ebx, 0x604
jae 0x100284f
movd edi, mm5
mov al, 4
inc ebp
mov eax, ebp
mov ebx, 0xadefa
bswap edx
xor ebx, 0x25eb
sub eax, 0xa365026b
add edi, ebx
test esi, 0x6e958bd8
add edi, 0xe27
movsx edx, bh
dec edx
mov dh, bh
cmp ebp, ebp
imul edx, ebx
mov bh, al
bswap ecx
adc dl, al
jmp edi