joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cd70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x69c680]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46b4fb
je 0x46b54e
cmp ebx, 0x20
jbe 0x46b554
cmp ebx, 0x40
jbe 0x46b59a
jmp 0x46b63b
test ebx, ebx
je 0x46b544
add eax, 0x10
test ax, 0xff0
je 0x46b530
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x5ce8e0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x5ce9e0]
jmp 0x46b518
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46b518
pxor xmm1, xmmword [0x69c690]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x69c690]
pxor xmm2, xmmword [0x69c6a0]
pxor xmm3, xmmword [0x69c6b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x69c690]
pxor xmm2, xmmword [0x69c6a0]
pxor xmm3, xmmword [0x69c6b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46b69a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x69c2a4], 0
je 0x46cd8a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46b4c0
jmp fcn.00408960
Function at 0x46cd90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40379c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408960
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0046bac0
jmp 0x403760
cmp byte [0x69c2a4], 0
je 0x46cdab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x46b4c0
jmp 0x403760

Function at 0x46dc70
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46dc8a
mov ecx, 0x14
jmp 0x46dc93
shl ecx, 2
add ecx, 0xe10
mov dword [0x69c3d8], ecx
ret
Function at 0x487fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4880da
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x488020
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x488059
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00471440
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x488013
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x488063
inc eax
cmp eax, 4
jge 0x488079
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4880d3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.00471480
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x48809c
jmp 0x488062
call fcn.0046bac0
jmp fcn.00487fe0
Function at 0x496130
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49631a
sub esp, 0x48
mov eax, dword [0x6749e4]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.00492e40
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046d5fe
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046d5fe
call fcn.00492ac0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.0045faa0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x496207
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x496221
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x496298
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49626e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49626a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x496263
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x496270
mov ebx, 0x1d
jmp 0x49628e
mov ebp, eax
jmp 0x496270
mov ebp, eax
cmp ebp, 0xd
jae 0x49630d
lea eax, [ebp - 1]
lea edx, [0x66c9c0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x496303
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x496298
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4962ca
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4962d2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0046cf40
mov eax, ebp
mov ecx, 0xd
call fcn.0046cf40
nop
call fcn.0046bac0
jmp fcn.00496130
Function at 0x4e1070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x69c3d8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e1217
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.004e13f0
movzx eax, byte [esp + 0xc]
test al, al
je 0x4e10ff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4e10ff
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x4e10f2
movzx ebx, byte [edx]
test bl, bl
jne 0x4e10e4
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x4e10ff
cmp bl, 0xff
jne 0x4e10f2
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x4e10ff
cmp eax, 8
jg 0x4e1108
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x4e1133
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x4e10ff
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x4e1113
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x4e1108
call fcn.0046bac0
jmp fcn.004e1070
Function at 0x468f78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404d7c
mov eax, dword [ebp - 8]
call fcn.00404d7c
xor eax, eax
push ebp
push 0x46908e
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
call fcn.00404b8c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00404b8c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jle 0x468fd7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404f18
mov esi, dword [ebp - 0x14]
test esi, esi
jle 0x46900c
mov ebx, 1
mov eax, edi
call fcn.00404de4
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + ebx - 1]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x468fed
cmp byte [ebp - 9], 0
je 0x469044
mov ebx, dword [ebp - 0x14]
inc ebx
mov esi, dword [ebp - 0x10]
sub esi, ebx
jl 0x469073
inc esi
mov eax, edi
call fcn.00404de4
mov edx, ebx
sub edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x46901e
jmp 0x469073
mov ebx, dword [ebp - 0x14]
inc ebx
mov esi, dword [ebp - 0x10]
sub esi, ebx
jl 0x469073
inc esi
mov eax, edi
call fcn.00404de4
mov edx, ebx
sub edx, dword [ebp - 0x14]
mov ecx, dword [edi]
mov dl, byte [ecx + edx - 1]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x469050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469095
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048f0
ret

Function at 0x469858
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
mov ebx, edx
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x105]
push eax
push 0
push 0
push esi
push 0
call sub.shfolder.dll_SHGetFolderPathA
call fcn.004073e0
test eax, eax
je 0x4698a4
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404b3c
jmp 0x4698ab
mov eax, ebx
call fcn.004048cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6f1a380e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x422c0e8b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001751
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov edi, eax
test edi, edi
je fcn.0100179c
lea eax, [ebp - 0x1c]
push eax
push dword [0x100bd24]
push dword [0x100c164]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne fcn.0100179c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
jmp loc.01015445

Function at 0x10017a1
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [esp + 8]
jmp loc.010153a8

Function at 0x10017f4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, section..data
mov esi, eax
push edi
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.010017a1
test eax, eax
jne 0x1001821
jmp loc.01017c90
xor eax, eax
inc eax
cmp eax, ebx
mov dword [0x100b4ac], eax
mov dword [0x100b4b4], eax
je 0x1001878
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
mov al, byte [esi]
cmp al, bl
je 0x1001868
cmp al, 0x20
jne 0x100184c
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x1001841
cmp byte [esi], bl
je 0x1001868
mov eax, dword [0x100b4e8]
mov ecx, dword [eax]
push 0x100b4ec
push esi
push ebx
push eax
call dword [ecx]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x10018a1
mov eax, dword [ebp + 8]
mov dword [0x100b12c], ebx
mov dword [0x100bc98], eax
jmp 0x100189e
push dword [ebp + 8]
push dword [0x100c164]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push 0x106
push 0x111
push dword [0x100c164]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10018c0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
push esi
push dword [0x100c164]
mov esi, dword [eax*4 + 0x100c0b8]
call dword [sym.imp.USER32.dll_GetTopWindow]
cmp eax, esi
je fcn.010018ec
push 0
push 0
push 0x201
push esi
jmp loc.01017ef5

Function at 0x100199e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x100b4e8]
test eax, eax
je 0x10019c6
cmp dword [0x100b4a4], 0
jne 0x10019c6
push dword [eax + 8]
call sub.OLESVR32.dll_OleBlockServer
test eax, eax
jne 0x10019c6
mov dword [0x100b4a4], 1
push dword [esp + 0x10]
mov eax, dword [0x100b4ac]
push dword [esp + 0x10]
neg eax
jmp loc.010182b9

Function at 0x1001c09
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
inc esi
push edi
mov dword [0x100b4b8], esi
call fcn.0100197c
push esi
xor edi, edi
push edi
call fcn.01003a81
push esi
push esi
call fcn.01003a81
jmp 0x1001c4c
jmp loc.01017acb

Function at 0x1001c99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
cmp dword [ebp + 8], 0
jmp loc.01016543
Function at 0x1004826
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100be10]
push ebx
push esi
push edi
xor edi, edi
inc edi
xor esi, esi
push edi
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x1003bb3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ebx, 0x7f00
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x14], eax
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.USER32.dll_RegisterClassA]
push eax
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 4], str.SubTitleClass
call edi
test ax, ax
jne 0x100488f
xor eax, eax
jmp 0x10048db
mov ecx, dword [0x100be10]
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x24], 0x1003fd9
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 4
jmp loc.01018554
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004a0c
Capabilities:
Packed with generic packer

Disassembly:
push esi
push dword [edi + 0x1c]
mov esi, dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, word [edi + 0x3a]
cmp ecx, eax
jne 0x1004a5f
xor eax, eax
cmp dword [edi + 0x18], eax
je 0x1004a5f
cmp byte [esi], al
je 0x1004a5f
dec dword [edi + 0x18]
je 0x1004a43
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x1004a31
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x1004a38
cmp byte [esi], al
jne 0x1004a2c
cmp byte [esi], al
je 0x1004a5f
mov al, byte [esi]
inc esi
test al, al
jne 0x1004a47
inc esi
cmp byte [esi + 1], 0x2a
je 0x1004a5f
push esi
push dword [edi + 0x1c]
jmp 0x10162bb
pop esi
ret

Function at 0x1004cc3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
mov esi, str.Package
push esi
mov edi, 0x80000000
mov ebp, 0x80
push edi
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
jmp loc.010169a0

Function at 0x1004f6f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
push ebx
push edi
xor eax, eax
mov edi, 0x12c
push edi
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ebx, 0x80000000
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jmp loc.010151f9
Function at 0x100514e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push 0x104
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
test eax, eax
je 0x1005246
push 0x80
lea eax, [ebp - 0x90]
push eax
push 0x118
push dword [0x100be10]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x1005246
push ebx
lea eax, [ebp - 0x194]
push eax
call fcn.010049a0
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [ebp + 0x10]
add esp, 0xc
push 0x825
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DrawTextA]
cmp dword [ebp + 0x14], 0
je 0x1005245
push esi
push edi
jmp loc.0101872f
pop ebx
leave
ret 0x10

Function at 0x1005310
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], ebx
jmp loc.010187be

Function at 0x1005456
Capabilities:
Packed with generic packer

Disassembly:
sub eax, 0
je fcn.01005468
dec eax
je 0x1005462
xor eax, eax
inc eax
ret
jmp loc.01017fad

Function at 0x100546b
Capabilities:
Create process on windows
Create thread
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x140
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10054ff
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x10054ce
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
mov word [esi + 2], ax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
cmp dword [ebp - 8], ebx
pop esi
je 0x1005532
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp - 8]
push 0x1005116
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x10054f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005524
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
je 0x1005524
xor eax, eax
cmp dword [ebp - 4], 0x483
sete al
add eax, 0x21a
push eax
jmp 0x1016f25
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
sete al
pop ebx
leave
ret 8
cmp dword [0x100b4ac], ebx
je 0x1005524
push ebx
push 0xf060
push 0x112
push dword [0x100c164]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1005508