joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5011a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x12c], 0
cmp dword [0x5921ac], 0
jne 0x5013e5
call sub.MSVCR90.dll__getpid
push eax
push str.TerminalServerFlexlmMutex
push 0x580290
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR90.dll_sprintf
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x501264
xor eax, eax
jmp 0x5013f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x501280
push 0xffffffffffffffff
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x5921ac], 0
jne 0x5013cb
call fcn.005010c0
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x130]
sub edx, 4
mov dword [ebp - 0x130], edx
cmp dword [ebp - 0x130], 3
ja case.default.0x5012c6
mov eax, dword [ebp - 0x130]
jmp dword [eax*4 + 0x501400]
push 0x580298
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5921c0], eax
cmp dword [0x5921c0], 0
je 0x501384
push str.WTSEnumerateSessionsA
mov ecx, dword [0x5921c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5921b4], eax
cmp dword [0x5921b4], 0
je 0x501384
push 0x5802c0
mov edx, dword [0x5921c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5921b8], eax
cmp dword [0x5921b8], 0
je 0x501384
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x128]
push ecx
push 1
push 0
push 0
call dword [0x5921b4]
cmp dword [ebp - 0x128], 0
je 0x50135e
mov edx, dword [ebp - 0x128]
cmp dword [edx + 8], 0
jne 0x50136d
mov eax, dword [ebp - 0x128]
push eax
call dword [0x5921b8]
jmp 0x501384
mov ecx, dword [ebp - 0x128]
push ecx
call dword [0x5921b8]
mov dword [0x5921b0], 1
mov edx, dword [0x5921c0]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5921c0], 0
jmp case.default.0x5012c6
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je case.default.0x5012c6
mov dword [0x5921b0], 1
mov dword [0x5921ac], 1
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x5921b0], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x51adf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x581458
lea eax, [ebp - 0x28]
push eax
call sub.MSVCR90.dll_strcpy
add esp, 8
mov dword [ebp - 0x10], 0
jmp 0x51ae23
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 3
jge 0x51ae44
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x51ae3a
jmp 0x51ae44
mov al, byte [ebp - 0x28]
add al, 1
mov byte [ebp - 0x28], al
jmp 0x51ae1a
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret

Function at 0x51b6b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x597974
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00527960
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00527b70
add esp, 8
push 0x40
push 0x1000
mov edx, dword [ebp - 0xc]
add edx, 0xa
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x51b704
xor eax, eax
jmp 0x51b739
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.0048e500
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5268e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x12c], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x526a44
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x130], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
test eax, eax
jne 0x526a38
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x526a22
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x5828fc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x18]
add edx, 1
push edx
call sub.MSVCR90.dll_malloc
add esp, 4
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push str.ServiceName
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x12c], 0
je 0x526a13
mov ecx, dword [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR90.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0048e500
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0x104
jmp 0x526933
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x526a4b
mov eax, 0xffffff01
jmp 0x526a4d
xor eax, eax
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x526e40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
cmp dword [0x59234c], 0
jne 0x526f81
call sub.MSVCR90.dll__getpid
push eax
push str.IPHelperMutex
push 0x582924
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR90.dll_sprintf
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x526edc
xor eax, eax
jmp 0x526f87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x526ef8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x59234c], 0
jne 0x526f67
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x592350], eax
cmp dword [0x592350], 0
jne 0x526f26
mov dword [ebp - 0x114], 0xfffffffe
jmp 0x526f5d
push str.GetNetworkParams
mov ecx, dword [0x592350]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x592344], eax
cmp dword [0x592344], 0
je 0x526f5d
push str.GetAdaptersInfo
mov edx, dword [0x592350]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x592348], eax
mov dword [0x59234c], 1
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x539530
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0x60
push 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
xor eax, eax
pop ebp
ret
Function at 0x10001000
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
inc esi
cmp al, 0x22
jne 0x1000103f
push 0x22
push esi
call fcn.100010a0
mov edx, eax
add esp, 8
test edx, edx
je 0x10001056
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
ja 0x1000103a
mov esi, 0x10006490
jmp 0x10001056
lea esi, [edx + 2]
jmp 0x10001056
push 0x20
push esi
call fcn.100010a0
add esp, 8
mov esi, 0x10006494
test eax, eax
je 0x10001056
lea esi, [eax + 1]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push 0
push 0x3e8
push ecx
push esi
push edx
push eax
call sub.PBVM60.dll_Ordinal_137
pop edi
pop esi
ret 0x10

Function at 0x10001160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x10002178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x100064bc], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x100064b8], ecx
shl ecx, 8
add ecx, edx
mov dword [0x100064b4], ecx
shr eax, 0x10
mov dword [0x100064b0], eax
call fcn.10002040
test eax, eax
jne 0x100011ca
push 0x1c
call fcn.10001300
add esp, 4
mov dword [ebp - 4], 0
call fcn.10001e40
call fcn.10001e30
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10006890], eax
call fcn.10001a00
mov dword [0x10006498], eax
test eax, eax
je 0x100011fd
mov eax, dword [0x10006890]
test eax, eax
jne 0x10001207
push 0xffffffffffffffff
call fcn.10001360
add esp, 4
call fcn.10001750
call fcn.10001660
call fcn.10001330
mov esi, dword [0x10006890]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x100012e6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x1000124e
test al, al
je 0x1000124e
and eax, 0xff
push eax
call fcn.10001600
add esp, 4
test eax, eax
je 0x10001228
inc esi
mov dword [ebp - 0x64], esi
jmp 0x10001228
cmp byte [esi], 0x22
jne 0x10001257
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x10001267
cmp al, 0x20
ja 0x10001267
inc esi
mov dword [ebp - 0x64], esi
jmp 0x10001257
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x10001288
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x1000128d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.10001360
jmp 0x100012cb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x10001257
inc esi
mov dword [ebp - 0x64], esi
jmp 0x100012e6
Function at 0x1000f343
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f382
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f382
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f382
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f382
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f382
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10011fff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001209c
push ebx
push esi
call fcn.10011fc8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10011f5c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012049
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001209b
push edi
push eax
call fcn.10012fba
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012069
call fcn.10010aa4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001209a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10011f5c
add esp, 0x20
test eax, eax
jne 0x10012088
push edi
call fcn.10010aa4
jmp 0x10012090
push ebx
call fcn.10010aa4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012309
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10012225
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001233d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10012343
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012387
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10012225
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100123be
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100123c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10012225
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012400
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017a80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10017aad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10017aad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100015a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100015b4
pop dword [ebp - 0x28]
mov eax, 0x100015b4
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe552293f
sub dword [ebp - 0x38], 0x96ffe3f4
mov dword [ebp - 0x34], 0x6b33f96b
add dword [ebp - 0x34], 0xc6ff52da
mov dword [ebp - 0x30], 0x8f6da569
sub dword [ebp - 0x30], 0x4321613b
mov dword [ebp - 0x2c], 0xd8579f14
add dword [ebp - 0x2c], 0x27a860ec
lea eax, [ebp - 0x38]
push eax
mov eax, 0xe4b6ae98
add eax, 0x2b49816c
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x51f5fa4b
sub dword [ebp - 0x38], 0xdd8390f5
mov dword [ebp - 0x34], 0x67aa87a6
add dword [ebp - 0x34], 0xd9c1d9cf
mov dword [ebp - 0x30], 0xc4bf77c8
sub dword [ebp - 0x30], 0x61500b5c
mov dword [ebp - 0x2c], 0xeda70cbb
sub dword [ebp - 0x2c], 0xeda70cbb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3909b
push 0
call eax
mov ecx, 0xe1bbe2ab
add ecx, 0x1e446f8c
mov esi, eax
mov edi, 0x615f9d64
add edi, 0xaea0c69c
add edi, dword [ebp - 0x28]
mov ebx, 0xcbb9a46e
sub ebx, 0x7fc857ec
mov edx, dword [edi]
sub dword [ebp - 0x1c], 0x828eb76
xor edx, ebx
xor dword [ebp - 0x10], 0x20603f1d
mov dword [esi], edx
add dword [ebp - 0x20], 0x6c462d43
add esi, 4
add edi, 4
loop 0x100016cc
add eax, 0xff26e7b9
add eax, 0xda53f6
xor ebx, ebx
add ebx, eax
add eax, 0xcf305fd6
sub eax, 0xcf305fd1
mov ecx, 0x24d50582
add ecx, 0xeb2afa7e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401316
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x54e938]
jne 0x401320
repz ret
jmp fcn.004e7cd3

Function at 0x401a90
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x401aa0
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401a9d
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x401a9d
mov edx, 0x10b
cmp word [eax + 0x18], dx
sete al
ret

Function at 0x429390
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x42942f
mov ecx, ebx
cmp word [ebx], si
je 0x4293cf
lea esp, [esp]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4293b5
sub eax, esi
sar eax, 1
cmp word [ecx + eax*2 + 2], dx
lea ecx, [ecx + eax*2 + 2]
jne 0x4293b0
sub ecx, ebx
lea edi, [ecx + 2]
sar edi, 1
cmp edi, 0x3ffffffe
jb 0x4293e4
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
push 0x551c20
neg ecx
or ecx, eax
push ecx
call main
mov esi, eax
add esp, 8
test esi, esi
je 0x429428
lea eax, [edi + edi]
push eax
push ebx
push eax
push esi
call main
add esp, 0x10
test eax, eax
je 0x429428
push esi
call main
add esp, 4
xor esi, esi
push ebx
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x444050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x54e938]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x550250]
test eax, eax
jne 0x4441b7
push 0x114
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004e15a0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja case.default.0x444146
jmp dword [eax*4 + 0x4441c8]
mov eax, 1
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x444123
dec eax
je 0x44410b
dec eax
je 0x4440f3
mov eax, 0x67
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x66
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x65
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
cmp eax, 3
ja case.default.0x444146
jmp dword [eax*4 + 0x4441e4]
mov eax, 0x68
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x69
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6a
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6b
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6c
mov dword [0x550250], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret

Function at 0x44f1d0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
mov dword [ebp - 4], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x44f21a
mov ecx, dword [ebp - 4]
push ecx
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edx, [ebp - 4]
push edx
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push 0x80000001
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x44f24e
mov eax, dword [ebp - 4]
push str.Application
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
push ecx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4791f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503e5b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x54e938]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
call fcn.004044f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, eax
call fcn.00413740
test al, al
je 0x47936f
call fcn.004127a0
mov edi, eax
test edi, edi
je 0x47936f
test esi, esi
je 0x47936f
cmp word [esi], 0
je 0x47936f
push esi
lea ecx, [ebp - 0x234]
call main
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4792c3
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x4792c3
push esi
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4792c3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call main
mov ecx, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x274], ecx
push edi
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x278], 0x208
call main
push 0x30
lea edx, [ebp - 0x264]
push 0
push edx
mov dword [ebp - 0x268], 0
call fcn.004e15a0
add esp, 0xc
cmp dword [ebp - 0x220], 8
jb 0x479318
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x270], eax
jmp 0x479324
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x270], ecx
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x278]
push ecx
mov dword [ebp - 0x26c], edx
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x284]
push 0xf4
push ecx
call main
add esp, 0x18
lea ecx, [ebp - 0x234]
test eax, eax
je 0x47938e
call fcn.0040a2c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 0xc
call fcn.0040a2c0
mov eax, 1
jmp 0x479371

Function at 0x47dff0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x47e00a
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x47e01b
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], ebx
cmp dword [esi + 0x1c], ebx
je 0x47e048
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
jb 0x47e02e
mov eax, dword [edi]
jmp 0x47e030
mov eax, edi
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], ebx
jb 0x47e042
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
mov dword [esi], ebx
mov dword [esi + 0x28], ebx
pop esi
pop ebx
ret