joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a137
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x46a167
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047ca70
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0045ada7
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x46a1b7
push ebx
call fcn.0047c609
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x46a201
mov eax, 0x97bdcd
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045c531
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x46a1e5
push ebx
call fcn.0047c609
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x46a1fb
push ebx
call fcn.0047c609
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x46a22f
push 6
call fcn.0047c60f
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x46a268
push 6
call fcn.0047c60f
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x90c
call fcn.0047ec40
add esp, 0x10
mov dword [ebp - 0x10], eax
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0045ee2b
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x46a2ab
push ebx
call fcn.0047c609
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46a2bf
push ebx
call fcn.0047c609
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x46a2e5
push 6
call fcn.0047c60f
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46a301
push eax
mov ebx, eax
call fcn.0045ace0
inc eax
push eax
call fcn.0047c603
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x46a316
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x46a327
push ebx
call fcn.0047c609
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x46d6a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x46d6cd
mov dword [0x97ca90], 0
push dword [0x97ca94]
call fcn.0045a338
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46d711
push dword [0x97ca94]
call fcn.0045a3ac
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46d711
mov eax, 0x97a543
jmp 0x46d889
mov dword [ebp - 0xc], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x46d74a
push 6
call fcn.0047c60f
add esp, 4
mov dword [0x97ca94], eax
mov dword [ebp - 0xc], esp
push 0x4bf
push 0xffffffff
push 0
push 0x97ca94
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x46d787
push 6
call fcn.0047c60f
add esp, 4
mov dword [0x97ca90], eax
push 0
mov ebx, 0x350
call fcn.0047fc30
add esp, 4
cmp dword [0x97ca90], 0
je 0x46d7c2
cmp dword [0x97ca90], 0x102
je 0x46d7c2
mov eax, 1
jmp 0x46d7c4
xor eax, eax
test eax, eax
jne 0x46d74f
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [0x97ca94]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x46d7f1
push 6
call fcn.0047c60f
add esp, 4
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x90c
call fcn.0047ec40
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x46d824
push ebx
call fcn.0047c609
add esp, 4
pop eax
mov dword [ebp - 8], eax
push dword [0x97ca94]
call fcn.0045a40a
mov dword [ebp - 0xc], esp
push dword [0x97ca94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x46d858
push 6
call fcn.0047c60f
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x46d874
push eax
mov ebx, eax
call fcn.0045ace0
inc eax
push eax
call fcn.0047c603
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x46d889
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x46d89a
push ebx
call fcn.0047c609
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x470a74
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x470aa3
push 6
call fcn.0047c60f
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x470ac5
push 6
call fcn.0047c60f
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fild dword [ebp + 8]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x24]
fsub qword [ebp - 0x2c]
fcomp qword [0x97c214]
fnstsw ax
test ah, 1
je 0x470b35
mov dword [ebp - 8], esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x470b1e
push 6
call fcn.0047c60f
add esp, 4
push 0
mov ebx, 0x350
call fcn.0047fc30
add esp, 4
jmp 0x470aa6
jmp 0x470b3a
mov esp, ebp
pop ebp
ret 4

Function at 0x47d470
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x47d48e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x47d483
pop esi
ret

Function at 0x47ed90
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.0047c8a0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x47ede7
push ebx
push edi
call fcn.0047c930
push esi
mov ebx, esi
call fcn.0047c8a0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x47edbe
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x48bf90
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x98df8c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x48bfa3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x48bfe4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x98e034]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x48c016
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48c01a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x48c00b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x48c038
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48c03c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x48c02d
xor ecx, ecx
mov eax, 0x98df9c
xor ebx, ebx
mov bl, byte [ecx + 0x98e044]
cmp byte [esp + ebx + 0x14], 0
je 0x48c067
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x98e05c]
cmp byte [esp + ebx + 0x14], 0
je 0x48c07e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x48c04e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x48bfd7
lea edx, [esp + 0x84]
push edx
call fcn.0048c0c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4a1a12
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a1a4a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049fac9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049faa1
jmp 0x4a1a56
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a3100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a3142
call fcn.004a8bbc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a3142
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a3139
xor eax, eax
jmp 0x4a314a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a3150
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a90ec
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a911a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a9138
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a9052
jmp 0x4a9138
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a9138
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a9052
test edi, edi
mov eax, edi
jne 0x4a9122
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10016f5
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
mov edi, 0x1000
mov eax, 0x10000
push edi
mov dword [ebp - 4], eax
push eax
jmp 0x1001753
push 0
push dword [ebp - 4]
push ebx
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 8], eax
test eax, eax
je 0x1001771
cmp eax, 0xc0000004
jne 0x100174d
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
add dword [ebp - 4], 0x2000
push 4
push edi
push dword [ebp - 4]
push 0
call esi
mov ebx, eax
test ebx, ebx
jne 0x100171c
push dword [ebp - 8]
push 0x100117c
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
xor eax, eax
jmp 0x1001773
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d2f
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1001d65
push eax
push 0x1001500
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
jmp 0x1001d87
push esi
mov esi, dword [sym.imp.msvcrt.dll_printf]
push 0x10014e0
call esi
pop ecx
call fcn.01001a23
push 0x10014bc
call esi
pop ecx
call fcn.01001c6f
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01002722
leave
ret
Function at 0x100217e
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x48]
push ecx
xor edi, edi
push eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x48], edi
call fcn.01001856
cmp eax, edi
jne 0x10021f0
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x4c], eax
cmp eax, edi
jne 0x1002201
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp - 0x5c]
push 0x10015bc
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002722
leave
ret 0x14
push esi
push 0x10015b8
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.01001eaa
add esp, 0x10
push esi
call fcn.01001921
push ebx
mov dword [ebp - 0x50], eax
call fcn.01001921
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x50], edi
je 0x10022be
cmp eax, edi
je 0x10022be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x4c]
call esi
cmp eax, edi
je 0x1002265
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], edi
jmp 0x100227a
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
call esi
cmp eax, edi
je 0x10022a2
lea ecx, [ebp - 0x54]
push ecx
push edi
push dword [ebp - 0x58]
push edi
call eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x58]
call esi
push dword [ebp - 0x48]
call esi
mov eax, dword [ebp - 0x54]
jmp 0x10021f0
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
push 0x1001578
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
push 0x1001550
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
jmp 0x10022b6
Function at 0x10022d1
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 5], bl
mov byte [ebp - 0x10], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1004228], eax
cmp eax, ebx
je 0x1002300
push eax
call fcn.01002d69
mov esi, dword [ebp + 8]
cmp esi, 2
jl 0x10023ef
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor edi, edi
dec esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], ebx
je 0x10023c4
mov eax, dword [ebp + 0xc]
push 4
pop edx
mov ecx, eax
add eax, edx
test ecx, ecx
je 0x10023c4
mov ecx, dword [eax]
cmp word [ecx], 0x2d
jne 0x10023c4
movzx ecx, word [ecx + 2]
cmp ecx, 0x70
jg 0x10023a2
je 0x1002399
sub ecx, 0x61
je 0x100238d
sub ecx, 3
je 0x1002381
dec ecx
je 0x1002375
dec ecx
jne 0x10023ef
dec esi
je 0x10023ef
add eax, edx
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
jmp 0x10023bd
dec esi
je 0x10023ef
add eax, edx
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x10023bd
dec esi
je 0x10023ef
add eax, edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
jmp 0x10023bd
dec esi
je 0x10023ef
add eax, edx
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
jmp 0x10023bd
dec esi
je 0x10023ef
add eax, edx
mov edi, dword [eax]
jmp 0x10023bd
sub ecx, 0x71
je 0x10023b9
dec ecx
je 0x10023b3
dec ecx
jne 0x10023ef
mov byte [ebp - 1], 1
jmp 0x10023bd
mov byte [ebp - 5], 1
jmp 0x10023bd
mov byte [ebp - 0x10], 1
dec esi
jne 0x1002332
xor eax, eax
cmp edi, ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
cmp ecx, eax
je 0x10023dc
cmp byte [ebp - 1], bl
je 0x10023ef
cmp dword [ebp + 8], ebx
je 0x1002403
cmp edi, ebx
je 0x1002403
cmp dword [ebp - 0xc], ebx
jne 0x1002403
cmp byte [ebp - 1], bl
jne 0x1002408
push 0x10015f8
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
cmp byte [ebp - 1], bl
je 0x100240f
call fcn.01001d2f
jmp 0x100245b
cmp byte [ebp - 5], bl
jne 0x1002422
cmp byte [ebp - 0x10], bl
jne 0x1002422
call fcn.01001e12
test eax, eax
jne 0x100245b
cmp dword [ebp + 8], ebx
jne 0x100242b
cmp edi, ebx
je 0x1002430
cmp byte [ebp - 5], bl
je 0x1002446
push dword [ebp - 0x10]
push dword [ebp - 5]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.01001f09
jmp 0x1002458
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
call fcn.0100217e
mov dword [ebp - 0x1c], eax
cmp dword [0x1004228], ebx
je 0x1002468
call fcn.01002d81
cmp dword [0x100422c], ebx
je 0x1002475
call sub.RASAPI32.dll_DwRasUninitialize
push dword [ebp - 0x1c]
jmp 0x10023fd
Function at 0x10094f9
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102b004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100954a
push edi
push 0x1007324
lea edi, [ebp - 0x20c]
call fcn.01009fa1
pop edi
test eax, eax
jl 0x100954a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0102047c
leave
ret

Function at 0x100a952
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x100a968
push 0x80004005
call dword [sym.imp.PhotoBase.dll_void___stdcall_ATL::BaseAtlThrow_long_int_]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x100a96f
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100af39
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x102b004]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
lea edx, [esp + 0x18]
push edx
xor edi, edi
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [esp + 0x2c], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100af9e
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x10]
call fcn.0100af11
mov esi, eax
cmp esi, edi
je 0x100afba
cmp dword [esp + 0xc], edi
je 0x100b02f
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100b02f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, 0x100
jmp 0x100afdd
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
call fcn.0100af39
mov dword [esp + 0x18], eax
cmp eax, edi
jne 0x100b048
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push edi
push dword [esp + 0x28]
mov dword [esp + 0x3c], ebx
call esi
test eax, eax
je 0x100afc7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xc], edi
je 0x100b014
push dword [esp + 0xc]
call ebx
mov dword [esp + 0xc], edi
push dword [esp + 0x24]
mov esi, dword [esp + 0x24]
call fcn.0100b09f
mov esi, eax
cmp dword [esp + 0xc], edi
je 0x100b02f
push dword [esp + 0xc]
call ebx
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0102047c
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], edi
je 0x100b058
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
jmp 0x100b031
Function at 0x100ba11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1023eca
call fcn.01022d17
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x100ba69
call fcn.0100a49f
mov esi, eax
jmp 0x100bb90
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x100ba82
call fcn.0100a49f
jmp 0x100bb82
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x100ba78
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x100bae8
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100bace
lea eax, [ebp - 0x418]
call fcn.0100aa01
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.0100a9a4
mov eax, esi
call fcn.01022d82
ret 0xc
push 2
push eax
mov byte [ebp - 4], 2
call fcn.0100aa8d
cmp eax, 0x400
jbe 0x100bb0a
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0100aa38
jmp 0x100bb16
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x100bb34
cmp dword [ebp - 0x418], esi
jne 0x100bb43
mov esi, 0x8007000e
jmp 0x100bb84
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x100ba78
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x430]
call fcn.0100b8b4
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100bad3
lea eax, [ebp - 0x418]
call fcn.0100aa01
jmp 0x100bad3

Function at 0x100c36c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [edi], esi
call dword [sym.imp.SHELL32.dll_ILGetSize]
mov ebx, eax
cmp ebx, esi
je 0x100c3de
lea eax, [ebp - 4]
push eax
push esi
push 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
call esi
test eax, eax
je 0x100c3d0
mov eax, dword [ebp - 4]
add eax, eax
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [edi], eax
test eax, eax
je 0x100c3d7
lea ecx, [ebp - 4]
push ecx
push eax
push 1
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x100c3c8
xor eax, eax
jmp 0x100c3e3
push dword [edi]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x80004005
jmp 0x100c3e3
mov eax, 0x8007000e
jmp 0x100c3e3
mov eax, 0x8000ffff
pop esi
pop ebx
leave
ret 4