joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x832b4c77
mov ecx, 0x2015635b
pop ebx
je 0x414acb
arpl word [edi + ecx*4 - 0x44], cx
mov ecx, 0x46de335b
movsb byte es:[edi], byte [esi]
mov dh, byte [esi]
insb byte es:[edi], dx
sti
je 0x414ac7
lodsd eax, dword [esi]
mov al, 0x74
jmp 0x414ac1
ficom word [edi - 0x5d]
bound ecx, qword [esi - 0x741ae8f2]
push edi
mov dword [0x170e8e62], eax
in eax, 0x8b
fild qword [esi]
je 0x414b16
pushfd
inc esi
into
jge 0x414b08
cmp al, 0x61
jne 0x414af7
push ss
dec esp
das
sbb byte [eax - 0x5921cda5], bh
out 0x8b, al
inc edx
inc esp
leave
fdivp st(6)
xchg esp, eax
jmp 0x414a89
invalid
mov ebx, esi
inc esi
movsb byte es:[edi], byte [esi]
mov ebx, esi
inc esi
movsb byte es:[edi], byte [esi]
je 0x414b33
mov ecx, 0x46de8b5b
inc esi
movsb byte es:[edi], byte [esi]
je 0x414b3b
mov ecx, 0x46de8b5b
movsb byte es:[edi], byte [esi]
mov ebx, esi
inc esi
movsb byte es:[edi], byte [esi]
mov ebx, esi
inc esi
movsb byte es:[edi], byte [esi]
mov ebx, esi
lds ecx, [eax - 0x71]
sbb dword [edx - 0x80], eax
jbe 0x414b37
movsb byte es:[edi], byte [esi]
and byte [0xae8bcc09], 7
int3
movsb byte es:[edi], byte [esi]
lds ebx, [ecx - 0x1bf68302]
rcr byte [edi], 0x44
invalid
Function at 0x1000d7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000d7cf
pop dword [ebp - 0x44]
mov eax, 0x78bdd3a1
add eax, 0x9743042e
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x96a0a6fd
add dword [ebp - 0x54], 0xb7b19e4e
mov dword [ebp - 0x50], 0x59aecae2
add dword [ebp - 0x50], 0xd8848163
mov dword [ebp - 0x4c], 0xe741162b
sub dword [ebp - 0x4c], 0x9af4d1fd
mov dword [ebp - 0x48], 0x310b2006
sub dword [ebp - 0x48], 0x310b2006
lea eax, [ebp - 0x54]
push eax
mov eax, 0xff559de9
add eax, 0x10b1024f
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd0f8be25
sub dword [ebp - 0x54], 0x5c8654cf
mov dword [ebp - 0x50], 0x872aebc3
add dword [ebp - 0x50], 0xba4175b2
mov dword [ebp - 0x4c], 0x55c38211
add dword [ebp - 0x4c], 0xdabea5b
mov dword [ebp - 0x48], 0x4c6b46a2
add dword [ebp - 0x48], 0xb394b95e
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc9e24242
add eax, 0x46245dfa
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x439a5
push 0
call eax
mov ecx, 0x412d
mov ebx, eax
mov esi, 0x52962f1
sub esi, 0xf51f2ef1
add esi, dword [ebp - 0x44]
mov edx, 0x6fe34ccd
add edx, 0xe4f2fd9e
add dword [ebp - 0x3c], 0xd7b7abe5
mov edi, dword [esi]
sub dword [ebp - 4], 0x2a295f2e
xor edi, edx
add dword [ebp - 0x38], 0x701a2bda
mov dword [ebx], edi
mov dword [ebp - 0x20], 0x4fc239ed
add ebx, 4
add esi, 0x9bd94f34
sub esi, 0x9bd94f30
loop 0x1000d8eb
add eax, 0xf787
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405301
pop dword [ebp - 0x44]
mov eax, 0x1906a4c7
add eax, 0xe739ae3a
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x2136cdb0
add dword [ebp - 0x54], 0x2d1b779b
mov dword [ebp - 0x50], 0x7cdbf91e
add dword [ebp - 0x50], 0xb5575327
mov dword [ebp - 0x4c], 0x52868838
add dword [ebp - 0x4c], 0xf9c5bbf6
mov dword [ebp - 0x48], 0x6524b3fd
sub dword [ebp - 0x48], 0x6524b3fd
lea eax, [ebp - 0x54]
push eax
mov eax, 0x579c4042
add eax, 0xa8a49012
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xf2478d0a
sub dword [ebp - 0x54], 0x7dd523b4
mov dword [ebp - 0x50], 0xcb16950f
add dword [ebp - 0x50], 0x7655cc66
mov dword [ebp - 0x4c], 0x15914511
add dword [ebp - 0x4c], 0x4dde275b
mov dword [ebp - 0x48], 0x14615ee4
add dword [ebp - 0x48], 0xeb9ea11c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x6ac3db3
add eax, 0xf9949299
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x376ea
push 0
call eax
mov ecx, 0x28aacd89
sub ecx, 0x28aa8df6
mov esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x44]
mov edx, 0x70b78f9b
add edx, 0x2d888e8f
xor dword [ebp - 0x34], 0xf29d8803
mov ebx, dword [edi]
sub dword [ebp - 0x10], 0x4c4a20ae
sub ebx, edx
sub dword [ebp - 0x34], 0xfe4a1793
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0x5deff1a4
add esi, 4
add edi, 0xb914bcb9
sub edi, 0xb914bcb5
loop 0x40541d
add eax, 0xb77adb55
add eax, 0x488615ca
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1001672c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 4], 0x2f73
cmp dword [esp + 4], 0x30bf
push esi
push edi
jle 0x1001679c
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.1000d4be
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016769
mov eax, dword [eax]
push eax
call fcn.1004ded6
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10013450
inc edi
cmp edi, 0x252e
jl 0x1001674d
inc esi
cmp esi, 0x56d
jl 0x1001674b
push 0x1f87
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [esp + 0xc], 0x2f63
jge 0x100167b1
push 0x10007c78
call fcn.1004ded6
pop ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10021035
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063b85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100210c0
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10021083
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x100210bb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10012f07
mov esi, eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10012f07
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100211b9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x2e00
mov dword [ebp - 0x40], 0x10008b34
cmp dword [ebp - 0x24], 0x31dc
jle 0x10021153
push 0
push 0x2129
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 0x14], 0
jmp 0x100210f7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x714c
jge 0x10021153
and dword [ebp - 0x18], 0
jmp 0x1002110d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a6c
jge 0x10021151
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000d4be
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10012af4
push eax
call fcn.1004ded6
pop ecx
lea ecx, [ebp - 0x68]
call fcn.10012aea
jmp 0x10021106
jmp 0x100210f0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2cb4
jge 0x1002116f
push dword [ebp - 0x40]
call fcn.1004ded6
pop ecx
jmp 0x1002118b
or dword [ebp - 4], 0xffffffff
jmp 0x10021195
push 0
push 0x2f37
push 0x2048
push 0x6970
push 0x76f6
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.10031998
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029070
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100290e1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100290bc
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100290ba
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x100290df
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100290df
push 0
push 0x81f
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x1002911d
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x7111
call fcn.10020e28
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x100294d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002950d
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10029503
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029501
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002950b
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x10029515
push 1
call fcn.100293b4
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10029945
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100299dc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100299d0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jbe 0x100299ce
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jbe 0x100299ce
push 0
mov eax, dword [ebp - 0x20]
push dword [eax]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call fcn.1002bcb8
add esp, 0x10
jmp 0x100299ae
jmp 0x100299da
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x100299ee
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
call fcn.10018798
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10029a8b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063d8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10029b43
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10029b1b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10029b3e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x10029b3e
push 0
push 0xd8c
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x10029c3a
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0x832
mov dword [ebp - 0x58], 0x100092e0
cmp dword [ebp - 0x20], 0x88c
jle 0x10029bda
push 0x6d2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and dword [ebp - 0x1c], 0
jmp 0x10029b7a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7f6b
jge 0x10029bda
and dword [ebp - 0x14], 0
jmp 0x10029b90
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x43e2
jge 0x10029bd8
and dword [ebp - 0x18], 0
jmp 0x10029ba6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x506b
jge 0x10029bd6
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, ecx
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
mov ecx, 0x1060cad8
call fcn.10012b14
jmp 0x10029b9f
jmp 0x10029b89
jmp 0x10029b73
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x482
jge 0x10029bfa
mov edx, dword [ebp - 0x58]
mov ecx, 0x1060cad8
call fcn.10015678
jmp 0x10029c16
or dword [ebp - 4], 0xffffffff
jmp 0x10029c20
push 0x1903
push 1
push 0x1256
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.10018998
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b1f7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b258
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b233
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002b231
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002b256
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002b256
push 0
push 0x2498
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x1002b283
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0x5c8b
push 0x751e
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
push 0x3d31
call fcn.1001a114
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1002b393
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063db6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b507
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x7de9
mov dword [ebp - 0x28], 0x10009490
cmp dword [ebp - 0x24], 0x8105
jle 0x1002b444
and dword [ebp - 0x18], 0
jmp 0x1002b3f7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x52ee
jge 0x1002b437
and dword [ebp - 0x1c], 0
jmp 0x1002b40d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10f7
jge 0x1002b435
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x1060cad8
call fcn.10012b14
jmp 0x1002b406
jmp 0x1002b3f0
push 0xd9
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7bc8
jge 0x1002b464
mov edx, dword [ebp - 0x28]
mov ecx, 0x1060cad8
call fcn.10015678
jmp 0x1002b480
or dword [ebp - 4], 0xffffffff
jmp 0x1002b48a
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002b4e1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1002b4c2
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x1002b4df
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.10012f07
mov dword [eax], 1
jmp 0x1002b4b7
jmp 0x1002b505
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002b52d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0
push dword [ebp - 0x50]
push 0x6144
push 0x2897
call fcn.10018998
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002df18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063e0a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x5ef7
mov dword [ebp - 0x28], 0x100097ec
cmp dword [ebp - 0x20], 0x6286
jle 0x1002dff4
and dword [ebp - 0x1c], 0
jmp 0x1002df62
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2640
jge 0x1002dfd9
and dword [ebp - 0x14], 0
jmp 0x1002df78
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3226
jge 0x1002dfd7
and dword [ebp - 0x18], 0
jmp 0x1002df8e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3bcd
jge 0x1002dfd5
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.1000d4be
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10012af4
push eax
call fcn.1004ded6
pop ecx
lea ecx, [ebp - 0x48]
call fcn.10012aea
jmp 0x1002df87
jmp 0x1002df71
jmp 0x1002df5b
push 0x2498
push 0
push 0x1d45
push 0x2341
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0xc]
push 0x7b26
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push 1
push 1
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.1002e061
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d72
jge 0x1002e02a
push dword [ebp - 0x28]
call fcn.1004ded6
pop ecx
jmp 0x1002e046
or dword [ebp - 4], 0xffffffff
jmp 0x1002e050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031fce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063ee3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100320f2
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003202a
push 0xd9
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100320f0
mov dword [ebp - 0x1c], 0x7fbc
mov dword [ebp - 0x28], 0x10009db8
cmp dword [ebp - 0x1c], 0x82fb
jle 0x1003208e
and dword [ebp - 0x14], 0
jmp 0x1003204e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x619
jge 0x1003208e
and dword [ebp - 0x18], 0
jmp 0x10032064
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7cb6
jge 0x1003208c
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1060cad8
call fcn.10012b14
jmp 0x1003205d
jmp 0x10032047
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7d52
jge 0x100320ae
mov edx, dword [ebp - 0x28]
mov ecx, 0x1060cad8
call fcn.10015678
jmp 0x100320ca
or dword [ebp - 4], 0xffffffff
jmp 0x100320d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10032118
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x52db
push 1
push 0x7dd
call fcn.100313cf
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003347d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100334b1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x3947
push 1
call fcn.1003354d
add esp, 0x10
jmp 0x10033549
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003352b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xfffffffc
jmp 0x10033501
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xd
jge 0x10033529
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
jmp 0x100334f6
jmp 0x10033549
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10033549
push 0x20
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret