joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100204a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
push eax
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1002091
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1002088
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x10020e6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002103
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002106
and eax, 0x10
ret 4

Function at 0x1002238
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
and byte [edi], 0
cmp byte [esi], 0x23
jne 0x1002304
movsx eax, byte [esi + 1]
inc esi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov esi, eax
je 0x1002304
cmp bl, 0x57
je 0x10022f8
lea eax, [ebp - 0x108]
push 0x1001334
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.01005925
lea eax, [ebp + 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x108]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100230e
lea eax, [ebp + 8]
push eax
push edi
push 0
push 0
push 0x10012c4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10022ed
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100230e
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100230e
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x100231b
push esi
push edi
call fcn.01005925
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002325
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x7c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
jle 0x100247d
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x80]
add eax, ebx
lea esi, [eax + ecx + 0x84]
mov eax, dword [eax + ecx + 0xbc]
lea eax, [eax + ebx + 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01002238
test eax, eax
je 0x1002491
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x100244e
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x1002491
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x100248f
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1002441
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001368
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002441
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x1002441
add esi, 0x10
push dword [esi - 0xc]
mov eax, dword [ebp - 0x10]
push dword [esi - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.010024ce
push dword [esi]
mov dword [ebp + edi - 0x28], eax
mov eax, dword [ebp - 0x10]
push dword [esi - 4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.010024ce
mov dword [ebp + edi - 0x30], eax
add edi, 4
add esi, 0x18
cmp edi, 8
jl 0x10023ef
cmp dword [ebp - 0x28], 0
jl 0x1002435
cmp dword [ebp - 0x30], 0
jle 0x1002441
cmp dword [ebp - 0x24], 0
jl 0x1002486
cmp dword [ebp - 0x2c], 0
jg 0x1002486
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
jmp 0x1002466
mov eax, dword [ebp - 0xc]
add eax, esi
cmp dword [eax], edi
jne 0x1002491
cmp dword [eax + 4], edi
jne 0x1002491
cmp dword [eax + 0xc], edi
jne 0x1002491
cmp dword [eax + 0x10], edi
jne 0x1002491
inc dword [ebp - 8]
add dword [ebp + 8], 0x3c
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], 0x18
cmp eax, dword [ebx + 0x7c]
jl 0x100234b
mov dword [ebp - 0x14], 1
jmp 0x1002491
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
mov dword [eax], ecx
je 0x10024a7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10025e7
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1002610
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1002608
cmp al, 0x22
jne 0x10025fc
cmp byte [esi], 0x22
jne 0x100261a
inc esi
jmp 0x100261a
cmp al, 0x20
jle 0x100261a
inc esi
cmp byte [esi], 0x20
jg 0x1002614
mov al, byte [esi]
test al, al
je 0x1002627
cmp al, 0x20
jg 0x1002627
inc esi
jmp 0x100261a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1002641
movzx eax, word [ebp - 0x14]
jmp 0x1002644
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10026c3
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100f8dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100efe0
rep stosd dword es:[edi], eax
mov ecx, 0xca
mov edi, 0x100eca0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100f920
pop ecx
mov esi, 0x100eff4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013a4
mov dword [0x100f28c], edi
call fcn.01003c41
cmp eax, ebx
je 0x10028e2
cmp eax, 0x80
ja 0x10028e2
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100bd1c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100f8d4
push 0x1001398
call fcn.01003c41
test eax, eax
je 0x1002780
test byte [0x100f8d4], 0xc0
je 0x1002810
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001388
call fcn.01003c41
test eax, eax
jne 0x100279f
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ae7
mov dword [0x100f904], 0x80070714
jmp 0x10028f2
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100bd20], eax
je 0x1002810
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002810
test byte [0x100f8d4], 0x80
je 0x10027df
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003ae7
jmp 0x10027f5
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003ae7
cmp eax, 6
je 0x1002810
push dword [0x100bd20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100f904], 0x800700b7
jmp 0x10028f2
push dword [ebp + 0xc]
mov dword [0x100fa24], ebx
call fcn.010050b0
test eax, eax
jne 0x1002831
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x10028ec
cmp byte [0x100ecba], bl
je 0x1002848
push 0x100ecba
call fcn.01001e36
jmp 0x10028f2
push 0xa
push 0x100137c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1002869
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100b2f8], ebx
je 0x1002877
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100eca4], ebx
jne 0x10028de
push dword [ebp - 4]
call fcn.01002fd2
test eax, eax
je 0x10028f2
mov ax, word [0x100fe04]
cmp ax, di
je 0x100289c
cmp ax, 2
jne 0x10028de
test byte [0x100f8d5], 1
je 0x10028de
test byte [0x100ecb8], 1
jne 0x10028de
call fcn.010014d0
test eax, eax
jne 0x10028de
push 0x83e
push 0x547
push 0x10015da
push ebx
push 0x7d6
push dword [0x100f8dc]
call fcn.010057eb
cmp eax, 0x83d
jne 0x10028f2
mov eax, edi
jmp 0x10028f4
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ae7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10029e6
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x10047d0
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [0x100f080]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, esi
je 0x1004823
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100eca4], ebp
jne 0x1004813
cmp dword [0x100f8d0], ebp
jne 0x1004813
push pe_nt_image_headers32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x10047ee
cmp dword [0x100eca0], ebp
je 0x1004873
cmp dword [0x100eca4], ebp
jne 0x1004873
cmp dword [0x100f8d0], ebp
jne 0x1004873
lea eax, [esp + 0x10]
push 0x100f084
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100f8d4], 0x20
je 0x100485e
lea eax, [esp + 0x10]
push eax
call fcn.0100585c
push 0x1001318
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x10]
push eax
call fcn.01001e36
cmp word [0x100fe04], 1
je 0x100488a
cmp dword [0x100eca0], ebp
je 0x100488a
call fcn.01001b01
pop edi
mov dword [0x100eca0], ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x10037a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
je 0x1003841
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1003837
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100eca8], esi
mov ecx, dword [ebp + 8]
jne 0x100381c
mov al, byte [0x100f8cc]
test al, 1
je 0x100381c
test al, 2
jne 0x100381c
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x100381c
mov dword [0x100f8cc], ecx
push ecx
call fcn.0100557f
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push 1
pop eax
jmp 0x1003843
call fcn.010055be
mov dword [0x100f904], eax
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x10038e7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x1003a01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10039ee
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10039ee
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10039ee
cmp byte [0x100f920], bl
mov esi, 0x100f920
jne 0x100398b
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x100398b
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x100398b
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x10038c6
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10039dc
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100f920], bl
je 0x10039d6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1003a15
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1003a0b
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003ae7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1003c41
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0xa
xor edi, edi
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
ja 0x1003caa
cmp dword [ebp + 0xc], edi
je 0x1003caa
cmp ebx, edi
je 0x1003c8a
push 0xa
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
jne 0x1003c8e
xor eax, eax
jmp 0x1003cac
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
mov esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003d41
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 1
pop ebx
push edi
mov esi, ebx
call fcn.01005964
test eax, eax
jne 0x1003d5b
mov eax, ebx
jmp 0x1003dba
cmp dword [0x100f07c], 0
jne 0x1003da8
test byte [0x100ecb8], bl
jne 0x1003da8
push 6
push 0
push 0x1002d55
mov dword [0x100f2a4], edi
push dword [0x100bd18]
push 0x7d3
push dword [0x100f8dc]
call fcn.010057eb
sub eax, 6
je 0x1003da6
dec eax
je 0x1003dc0
sub eax, 0x832
jne 0x1003da8
mov dword [0x100f07c], ebx
mov esi, ebx
test esi, esi
je 0x1003db8
push pe_nt_image_headers32
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
xor esi, esi
jmp 0x1003da8

Function at 0x1003ee6
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi]
test cl, cl
je 0x1003f4a
mov al, byte [edi + 1]
lea esi, [edi + 1]
xor ebx, ebx
cmp al, 0x3a
jne 0x1003f0a
cmp byte [edi + 2], 0x5c
jne 0x1003f0a
lea esi, [edi + 3]
jmp 0x1003f19
cmp cl, 0x5c
jne 0x1003f19
cmp al, cl
jne 0x1003f19
push 2
lea esi, [edi + 2]
pop ebx
mov al, byte [esi]
test al, al
je 0x1003f4a
cmp al, 0x5c
jne 0x1003f3f
cmp byte [esi - 1], 0x3a
je 0x1003f3f
test ebx, ebx
je 0x1003f30
dec ebx
jmp 0x1003f3f
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x1003f19
pop edi
pop esi
pop ebx
ret 4

Function at 0x100489b
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
mov eax, edi
inc edi
push eax
lea eax, [esp + 0x14]
push 0x1001470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005925
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004903
cmp edi, 0x190
jl 0x10048b0
jmp 0x1004916
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004916
push 1
pop ebp
mov dword [0x100eca0], ebp
test ebp, ebp
jne 0x1004941
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004941
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
Function at 0x1004950
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x10049dd
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0100489b
test eax, eax
je 0x1004a3a
lea eax, [ebp - 0x128]
mov esi, 0x100f084
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100f8d4], 0x20
je 0x10049d0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x10049c5
dec eax
je 0x10049be
dec eax
je 0x10049b7
dec eax
jne 0x10049d0
push 0x1001494
jmp 0x10049ca
push 0x100148c
jmp 0x10049ca
push 0x1001484
jmp 0x10049ca
push 0x100147c
push esi
call fcn.01005925
push 0x10012c4
push esi
call fcn.01005925
jmp 0x10049ec
push dword [ebp + 8]
mov esi, 0x100f084
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01004d35
test eax, eax
jne 0x1004a0c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004a42
mov dword [0x100eca0], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01004e1b
test eax, eax
je 0x1004a25
push 1
mov dword [0x100f904], ebx
pop eax
jmp 0x1004a3c
cmp dword [0x100eca0], ebx
je 0x1004a3a
push esi
mov dword [0x100eca0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
call fcn.010055be
mov dword [0x100f904], eax
jmp 0x1004a3a
Function at 0x1004d35
Capabilities:
Get file attributes

Disassembly:
push ebx
push ebp
push esi
or ebp, 0xffffffff
push edi
mov edi, dword [esp + 0x14]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x13
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x1004d7f
push eax
push 0x10
push eax
push eax
push 0x4b5
push eax
call fcn.01003ae7
call fcn.010055be
mov dword [0x100f904], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edi, dword [esp + 0x14]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10014ac
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push 0x4000080
push 1
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebp
je 0x1004d6c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, ebp
je 0x1004d6c
test al, 0x10
je 0x1004d6c
push 1
mov dword [0x100f904], edi
pop eax
jmp 0x1004d78
Function at 0x1005530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100556d
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003ae7
call fcn.010055be
mov dword [0x100f904], eax
xor eax, eax
leave
ret
push 2
lea eax, [ebp - 0x104]
push 2
push eax
call fcn.01004e1b
leave
ret

Function at 0x10055dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push 0x1001370
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10056a6
jmp 0x1005620
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x100568c
mov eax, dword [esi]
lea edi, [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp + 8]
test eax, eax
je 0x100569b
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp - 4]
push 0x1001370
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x100561e
jmp 0x10056a6
mov dword [0x100f904], 0x80070714
mov dword [ebp - 8], edi
jmp 0x10056a6
and dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100578b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x100f084
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01005925
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10057de
test al, 0x10
jne 0x10057de
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10057e7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x1005964
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005977
xor eax, eax
jmp 0x100597f
not eax
shr eax, 4
and eax, 1
ret 4
Function at 0x1007020
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, edi
shr ecx, 2
mov edx, ecx
dec ecx
test edx, edx
jle 0x100706b
xor edx, edx
inc esi
xor ebx, ebx
inc esi
inc esi
mov dl, byte [esi - 3]
mov bl, byte [esi - 2]
inc esi
shl ebx, 8
or edx, ebx
xor ebx, ebx
mov bl, byte [esi - 2]
shl ebx, 0x10
or edx, ebx
xor ebx, ebx
mov bl, byte [esi - 1]
shl ebx, 0x18
or edx, ebx
xor eax, edx
mov edx, ecx
dec ecx
test edx, edx
jg 0x100703b
xor ecx, ecx
and edi, 3
cmp edi, 1
je 0x100708f
cmp edi, 2
je 0x1007085
cmp edi, 3
jne 0x1007095
mov cl, byte [esi]
inc esi
shl ecx, 0x10
xor edx, edx
mov dl, byte [esi]
inc esi
shl edx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esi]
or ecx, edx
xor eax, ecx
pop edi
pop esi
pop ebx
ret