joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449a80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x449ab2
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
xor eax, eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x449c47
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x449c47
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x449c47
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x449c47
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x449c47
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x449c47
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x449c47
push ebx
push 0x45d170
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.0043d400
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x449bb4
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x449c47
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x449c47
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x449c05
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x449c0a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x449bf4
cmp esi, 0xfffffffc
je 0x449c37
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x449c47
cmp esi, 0xfffffffd
je 0x449c37
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x449c47
cmp esi, 0xfffffffe
je 0x449c37
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x449c47
cmp esi, 0xffffffff
je 0x449c37
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x449c47
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x1000e262
Capabilities:
Resume thread

Disassembly:
cmp byte [ecx], 0
je 0x1000e26f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x1000ea66
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x18], 0x191d
cmp dword [ebp - 0x18], 0x5e0
jge 0x1000ec0e
mov byte [ebp - 0x5c], 0x60
mov byte [ebp - 0x5b], 0x31
mov byte [ebp - 0x5a], 0x32
mov byte [ebp - 0x59], 0x33
mov byte [ebp - 0x58], 0x34
mov byte [ebp - 0x57], 0x35
mov byte [ebp - 0x56], 0x36
mov byte [ebp - 0x55], 0x37
mov byte [ebp - 0x54], 0x38
mov byte [ebp - 0x53], 0x39
mov byte [ebp - 0x52], 0x30
mov byte [ebp - 0x51], 0x71
mov byte [ebp - 0x50], 0x77
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x74
mov byte [ebp - 0x4c], 0x79
mov byte [ebp - 0x4b], 0x75
mov byte [ebp - 0x4a], 0x69
mov byte [ebp - 0x49], 0x6f
mov byte [ebp - 0x48], 0x70
mov byte [ebp - 0x47], 0x5b
mov byte [ebp - 0x46], 0x5d
mov byte [ebp - 0x45], 0x61
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], 0x64
mov byte [ebp - 0x42], 0x66
mov byte [ebp - 0x41], 0x67
mov byte [ebp - 0x40], 0x68
mov byte [ebp - 0x3f], 0x6a
mov byte [ebp - 0x3e], 0x6b
mov byte [ebp - 0x3d], 0x6c
mov byte [ebp - 0x3c], 0x3b
mov byte [ebp - 0x3b], 0x27
mov byte [ebp - 0x3a], 0x7a
mov byte [ebp - 0x39], 0x78
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x37], 0x76
mov byte [ebp - 0x36], 0x62
mov byte [ebp - 0x35], 0x6e
mov byte [ebp - 0x34], 0x6d
mov byte [ebp - 0x33], 0x2c
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2f
lea ecx, [ebp - 0x30]
call fcn.10011725
and dword [ebp - 4], 0
lea edx, [ebp - 0x30]
mov ecx, 0x106636b0
call fcn.1001665d
and dword [ebp - 0x10], 0
jmp 0x1000eb6b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.100117a6
cmp dword [ebp - 0x10], eax
jae 0x1000ebf3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.10011792
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x1000eba4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.10011792
mov dl, byte [eax]
mov ecx, 0x106635f8
call fcn.10016429
jmp 0x1000eb64
mov dword [ebp - 0x14], 1
jmp 0x1000ebb4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2c
jae 0x1000ebee
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.10011792
movsx eax, byte [eax]
push eax
call fcn.10058b87
pop ecx
mov ecx, dword [ebp - 0x14]
movsx ecx, byte [ebp + ecx - 0x5c]
cmp eax, ecx
jne 0x1000ebec
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp + eax - 0x5e]
mov ecx, 0x106635f8
call fcn.10016429
jmp 0x1000ebad
jmp 0x1000eb64
push fcn.100165df
mov ecx, 0x106635f8
call fcn.10011bfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10011788
push 0x1eb6
push 0x26c7
push 0x132d
push 0x1bfd
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10019c0f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100715f0
call fcn.10070a18
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x4a23
cmp dword [ebp - 0x14], 0x4db7
push edi
mov dword [ebp - 0x10], esp
jle 0x10019c65
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x106635f8
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10019e87
inc ebx
cmp ebx, 0x4b62
jl 0x10019c37
inc edi
cmp edi, 0x1ef2
jl 0x10019c35
inc esi
cmp esi, 0x7213
jl 0x10019c33
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x49ca
jge 0x10019c81
mov edx, 0x1000b41c
mov ecx, 0x106635f8
call fcn.1001679b
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a3db
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a42b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001a412
push 0xb29
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1001a429
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1001a45c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x3af7
push 0x3e71
push 0x66cb
push 0x5921
push 0x61f2
push dword [ebp - 0x14]
push 0x3c96
push 0
call fcn.1001ac8a
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x100294d5
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029509
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100294fd
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x10029507
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10029552
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.1001a25f
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1002a0bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002a133
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push 0x4a52
push 0x6ee3
push dword [ebp - 0x1c]
push 0x5d57
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0xac8
push 0x1e64
push 0x282e
push 0x52f6
push 1
push dword [ebp - 0x2c]
call fcn.1002a272
add esp, 0x38
jmp 0x1002a26d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002a262
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0x14cd
cmp dword [ebp - 0x40], 0x897
jge 0x1002a227
mov dword [ebp - 0x4c], 7
lea eax, [ebp - 4]
push eax
push 0x1000b6c4
call fcn.1005856b
pop ecx
pop ecx
and dword [ebp - 0x68], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
and dword [ebp - 0x14], 0
and dword [ebp - 8], 0
jmp 0x1002a1af
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1002a1d8
mov eax, dword [ebp - 8]
lea eax, [ebp + eax*4 - 0x68]
push eax
push 0x1000b1fc
call fcn.1005856b
pop ecx
pop ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp + eax*4 - 0x68]
mov dword [ebp - 0x14], ecx
jmp 0x1002a1a8
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 0x14]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x1002a1ee
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
jmp 0x1002a1fb
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 7
jg 0x1002a227
cmp dword [ebp - 4], 0
jg 0x1002a218
push dword [ebp - 0xc]
push 0x1000b6c4
call fcn.10058bc8
pop ecx
pop ecx
jmp 0x1002a227
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + eax*4 - 0x68]
mov dword [ebp - 4], ecx
jmp 0x1002a1f4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x1002a243
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 3
jge 0x1002a260
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.10011fc8
mov dword [eax], 0x1f9e6a01
jmp 0x1002a238
jmp 0x1002a26d
push 0x363
call dword [sym.imp.USER32.dll_GetKeyState]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002a37a
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002a471
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002a3bd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002a46f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1002a3f3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1002a409
mov eax, dword [ebp - 0x34]
cmp dword [eax], 0
jne 0x1002a409
and dword [ebp - 8], 0
jmp 0x1002a410
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
neg eax
je 0x1002a41f
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1002a42d
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1002a42d
and dword [ebp - 0xc], 0
jmp 0x1002a434
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
je 0x1002a447
mov dword [ebp - 0x10], 1
jmp 0x1002a44b
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x38]
mov dword [eax], 1
cmp dword [ebp - 0x10], 1
jg 0x1002a463
mov dword [ebp - 0x14], 1
jmp 0x1002a467
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x1002a479
push 0
call fcn.10029de3
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1002a88c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002a8b5
push 0x4379
push 0x6a4
push 0x6ab7
push 1
call fcn.1002a8f8
add esp, 0x10
jmp 0x1002a8f4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002a8dd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1002a8f4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002be61
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002bec9
mov eax, dword [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push 0x4705
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x1899
push 0x1885
push dword [ebp - 0x1c]
call fcn.1002befb
add esp, 0x2c
jmp 0x1002bef7
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002bee8
push 0
push 0x1b07
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x1002bef7
push 0x773
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret

Function at 0x100311d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003120c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 1
push 0xad1
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x3238
call fcn.10031281
add esp, 0x14
jmp 0x1003127d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10031275
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031256
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10031273
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10011fc8
mov dword [eax], 0x91a049fe
jmp 0x1003124b
jmp 0x1003127d
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret
Function at 0x10031500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031545
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0x5222
push dword [ebp - 8]
push 1
push 0x3a95
push dword [ebp - 0xc]
push 0x952
push 0x179a
push 0xa4
call fcn.10031577
add esp, 0x20
jmp 0x10031573
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003156b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10031569
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10031573
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov esp, ebp
pop ebp
ret

Function at 0x100317a6
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003183e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10031827
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031808
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10031825
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10011fc8
mov dword [eax], 0x6211ee15
jmp 0x100317fd
jmp 0x1003183c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x3245f1db
jmp 0x100318b1
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10031866
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x100318b1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10031894
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x100318b1
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10011fc8
mov dword [eax], 0xc29a3df6
jmp 0x10031889
mov esp, ebp
pop ebp
ret
Function at 0x10032803
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10032857
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032840
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003283e
push 0xb29
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10032855
push 0x22f8
push 0x2505
push 0x1569
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x1003286f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 0x52a7
call fcn.1001b50b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10033950
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10033985
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.100339be
add esp, 0x10
jmp 0x100339ba
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100339a6
push 0x773
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x100339ba
push 0
push 0x24d7
push 0xf90
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov esp, ebp
pop ebp
ret
Function at 0x100346dd
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034792
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 0x202f
cmp dword [ebp - 8], 0x76f
jge 0x1003475a
lea eax, [ebp - 4]
push eax
push 0x1000b200
call fcn.1005856b
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x1003475a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1000b21c
call fcn.1005856b
add esp, 0xc
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
dec eax
push eax
push 0x1000b234
call fcn.10058bc8
add esp, 0xc
jmp 0x1003471b
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10034788
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10034786
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10034790
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100347a4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x28]
call fcn.1002a877
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x100347a8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100347ca
push 0x7d78
push 1
push 0x4a94
call fcn.10034804
add esp, 0xc
jmp 0x10034800
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100347f0
push 0
push 0x24d7
push 0xf90
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
jmp 0x10034800
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esp, ebp
pop ebp
ret