joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410e15
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x48600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, ecx
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00406fe0
push 0
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, dword [ebp - 0x28]
mov ebx, eax
mov dword [ebp - 0x258], ebx
test ebx, ebx
jne 0x40e36f
xor esi, esi
jmp 0x40e454
push 0x228
lea eax, [ebp - 0x250]
mov dword [ebp - 0x254], 0x22c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [eax]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x270]
call fcn.0040daa0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, eax
cmovae ecx, edi
cmp dword [eax + 0x14], 8
jb 0x40e3c6
mov esi, dword [eax]
mov edx, dword [eax + 0x10]
cmp edx, dword [ebp - 0x18]
jne 0x40e3e9
test edx, edx
je 0x40e3e5
sub esi, ecx
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x40e3e9
add ecx, 2
sub edx, 1
jne 0x40e3d4
mov bl, 1
jmp 0x40e3eb
xor bl, bl
mov ecx, dword [ebp - 0x25c]
cmp ecx, 8
jb 0x40e42b
mov edx, dword [ebp - 0x270]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e421
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e4ad
push ecx
push edx
call fcn.0040f0fe
add esp, 8
test bl, bl
jne 0x40e44e
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40e3a0
xor esi, esi
jmp 0x40e454
mov esi, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x40e487
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x40e47d
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e4ad
push ecx
push edi
call fcn.0040f0fe
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40e4bd
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e4b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e4b3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eba8
mov esp, ebp
pop ebp
ret
Function at 0x40e4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410e60
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x48600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x430]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push 0x20019
push 0
push eax
push 0x80000002
mov dword [ebp - 0x414], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040daa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x42c]
cmp dword [ebp - 0x418], 8
mov eax, dword [ebp - 0x41c]
cmovae ecx, dword [ebp - 0x42c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x42c]
cmovae ecx, dword [ebp - 0x42c]
push ecx
push eax
push ecx
mov ecx, edi
call fcn.00407100
mov ecx, dword [ebp - 0x418]
cmp ecx, 8
jb 0x40e610
mov edx, dword [ebp - 0x42c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e606
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e6a3
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
cmp ecx, 8
jb 0x40e663
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e659
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e6a3
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x40e6b3
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e6a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e6a9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eba8
mov esp, ebp
pop ebp
ret
Function at 0x40e6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410e60
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x48600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x430]
cmp dword [sym.imp.KERNEL32.dll_IsWow64Process], 0
lea eax, [ebp + 8]
mov dword [ebp - 0x414], 0x400
push ecx
je 0x40e735
push 0xf013f
jmp 0x40e73a
push 0xf003f
cmp dword [ebp + 0x1c], 8
push 0
cmovae eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040daa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x42c]
cmp dword [ebp - 0x418], 8
mov eax, dword [ebp - 0x41c]
cmovae ecx, dword [ebp - 0x42c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x42c]
cmovae ecx, dword [ebp - 0x42c]
push ecx
push eax
push ecx
mov ecx, edi
call fcn.00407100
mov ecx, dword [ebp - 0x418]
cmp ecx, 8
jb 0x40e810
mov edx, dword [ebp - 0x42c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e806
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e8a3
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
cmp ecx, 8
jb 0x40e863
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e859
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e8a3
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x40e8b3
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e8a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e8a9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eba8
mov esp, ebp
pop ebp
ret
Function at 0x40e8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410e9d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x48600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00402c00
call fcn.0040e2f0
add esp, 0x18
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40e92d
xor bl, bl
jmp 0x40e944
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40e97a
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e970
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e970
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040f0fe
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eba8
mov esp, ebp
pop ebp
ret

Function at 0x40f683
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f6c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f6c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f6c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40f6c2
cmp dword [ecx + 0x74], 0xe
jbe 0x40f6c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e96
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
and dword [0x1008314], 0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov cx, word [eax]
push 0x20
pop esi
push 2
pop edx
test cx, cx
je 0x1001eca
cmp cx, si
ja 0x1001eca
mov cx, word [eax + edx]
add eax, edx
jmp 0x1001eb8
mov cx, word [eax]
cmp cx, 0x22
jne 0x1001eee
mov cx, word [eax + edx]
add eax, edx
test cx, cx
je 0x1001ee4
cmp cx, 0x22
jne 0x1001ed3
cmp word [eax], 0x22
jne 0x1001efa
add eax, edx
jmp 0x1001efa
cmp cx, si
jbe 0x1001efa
add eax, edx
cmp word [eax], si
ja 0x1001ef3
mov cx, word [eax]
test cx, cx
je 0x1001f0b
cmp cx, si
ja 0x1001f0b
add eax, edx
jmp 0x1001efa
mov esi, 0x104
lea ecx, [ebp - 0x218]
push esi
mov ebx, 0x1001430
push ecx
push ebx
push eax
call fcn.01001e0a
test eax, eax
mov dword [ebp - 0xc], eax
je 0x1001f90
cmp word [ebp - 0x218], 0
je 0x1001f90
lea eax, [ebp - 0x218]
mov edi, 0x1008328
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x218]
push esi
push eax
push ebx
push dword [ebp - 0xc]
call fcn.01001e0a
xor ebx, ebx
cmp word [ebp - 0x218], bx
mov dword [ebp - 4], ebx
je 0x1001f79
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001f9f
mov eax, dword [ebp - 4]
mov dword [0x1008998], eax
jmp 0x1001f9f
mov edi, 0x1008328
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_73]
xor ebx, ebx
push esi
push 0x1008108
call dword [sym.imp.SHLWAPI.dll_Ordinal_97]
push 0x1001418
push edi
push 0x1008538
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
push ebx
push ebx
call fcn.010036f9
lea eax, [ebp - 8]
mov edi, 0x1008740
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push 0x10013fc
push 0x100135c
push 0x80000001
mov dword [ebp - 8], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1001ffa
push 0x10
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10030bf
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x10089b0
push edi
call fcn.0100319d
test eax, eax
jne 0x10030d9
push edi
call fcn.0100334e
xor eax, eax
mov esi, 0x80
push eax
push esi
push 3
push eax
push eax
push 0x80000000
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_Ordinal_52]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1003153
mov ebp, 0x1008780
push esi
push ebp
call dword [sym.imp.SHLWAPI.dll_Ordinal_338]
xor eax, eax
push eax
push esi
push 2
push eax
push eax
push 0x40000000
push ebp
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x100312e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003153
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x1003157
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
xor eax, eax
jmp 0x1003197
lea eax, [esp + 0x10]
push 0
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100317b
lea eax, [esp + 0x10]
push 0
push eax
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push ebx
call esi
push edi
call esi
push 1
pop eax
mov dword [0x1008314], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100334e
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov esi, dword [sym.imp.SHLWAPI.dll_Ordinal_107]
mov edi, 0x104
lea eax, [ebp - 0x214]
push edi
push eax
push 0x7a
push dword [0x1008100]
call esi
xor ebx, ebx
push 2
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_105]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push edi
push eax
push 0x6a
push dword [0x1008100]
call esi
lea eax, [ebp - 0x214]
push 0x17
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_66]
mov edi, eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003406
lea eax, [ebp - 0xc]
push ebx
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003461
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
push ebx
push esi
lea eax, [ebp - 0x20c]
push edi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_90]
lea eax, [ebp - 0x414]
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_457]
mov eax, dword [0x10089ac]
push 0x14
xor edx, edx
pop ecx
div ecx
inc dword [0x10089ac]
lea eax, [ebp - 0x61c]
push edx
push 0x10018a8
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
lea eax, [ebp - 0x414]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1003541
mov edi, dword [sym.imp.SHLWAPI.dll_Ordinal_107]
lea eax, [ebp - 0x61c]
push esi
push eax
push 0x75
push dword [0x1008100]
call edi
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x7e
push dword [0x1008100]
call edi
lea eax, [ebp - 0x61c]
push 0x10010
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_340]
jmp 0x10035de
cmp dword [ebp + 8], ebx
mov esi, 0x208
je 0x100355e
push esi
lea eax, [ebp - 0xc34]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x1003565
mov word [ebp - 0xc34], bx
lea eax, [ebp - 0x824]
push esi
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.0100340d
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x10]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call edi
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push eax
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 4]
call edi
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x14]
call esi
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.010037cf
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1003673
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x17
push dword [ebp + 8]
push dword [0x1008100]
call dword [sym.imp.SHLWAPI.dll_Ordinal_66]
mov edi, eax
test edi, edi
je 0x10036f4
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10036f4
push esi
push edi
push dword [0x1008100]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10036ea
push edi
push dword [0x1008100]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp + 0xc]
push 0
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003b13
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
push edi
push 0x1001a18
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_Ordinal_309]
push 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x1003bec
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
mov edi, 0x20000
push ebx
lea eax, [ebp - 0x28]
push edi
push eax
call esi
mov esi, 0x2000
test dword [ebp - 0x28], esi
jne 0x1003bec
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_107]
lea eax, [ebp - 0x230]
push 0x104
push eax
push 0x75
push dword [0x1008100]
call ebx
lea eax, [ebp - 0x438]
push 0x104
push eax
push 0x85
push dword [0x1008100]
call ebx
lea eax, [ebp - 0x230]
push 0x10021
push eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_340]
cmp eax, 1
je 0x1003bd2
and dword [ebp - 4], 0
jmp 0x1003bec
or dword [ebp - 0x28], esi
push 1
lea eax, [ebp - 0x28]
push edi
push eax
call dword [ebp - 8]
push 1
push 0x1003adb
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003c55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0xc], 0x80004005
je 0x1003db0
cmp word [esi], bx
je 0x1003db0
lea eax, [ebp - 0x214]
push eax
push 0x1008328
call fcn.01002566
test eax, eax
jl 0x1003e28
lea eax, [ebp - 0x214]
push 0x1001aac
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1003e28
push ebx
push 0x80
push 2
push ebx
push ebx
lea eax, [ebp - 0x214]
push 0x40000000
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1003e28
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push ebx
push eax
push 2
push 0x1001438
push dword [ebp - 4]
call edi
cmp eax, ebx
je 0x1003da5
lea eax, [ebp - 8]
push ebx
push eax
push 0x10014b8
call esi
shl eax, 1
push eax
push 0x10014b8
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003da5
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp + 8]
call esi
shl eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003da5
push ebx
lea eax, [ebp - 8]
mov ebx, 0x1001560
push eax
push ebx
call esi
shl eax, 1
push eax
push ebx
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003da3
mov esi, 0x1008538
push esi
call dword [sym.imp.SHELL32.dll_IsLFNDriveW]
test eax, eax
push 0x104
je 0x1003d71
push 0x1001a64
jmp 0x1003d76
push 0x1001a30
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x214]
push esi
push eax
push 0x1001684
push 0x1001664
call dword [sym.imp.SHLWAPI.dll_Ordinal_474]
test eax, eax
je 0x1003da3
and dword [ebp - 0xc], 0
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003e28
mov esi, 0x1008538
lea eax, [ebp - 0x214]
push esi
push 0x104
push eax
mov edi, 0x1001664
push 0x1001684
push edi
call dword [sym.imp.SHLWAPI.dll_Ordinal_473]
lea eax, [ebp - 0x214]
push 7
mov dword [ebp + 8], eax
lea eax, [ebp - 0x214]
push eax
push 0x1001a08
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1003dfd
lea eax, [ebp - 0x206]
mov dword [ebp + 8], eax
push dword [ebp + 8]
push 0x1008328
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_57]
push esi
push ebx
push 0x1001684
push edi
call dword [sym.imp.SHLWAPI.dll_Ordinal_474]
mov dword [ebp - 0xc], ebx
push ebx
push 2
call fcn.01003077
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10041d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 1
mov esi, ecx
push 0xf1
push 0x402
push dword [esi]
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_136]
push 0x9d
mov ecx, esi
call fcn.01004174
mov edi, 0x100801c
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 4]
push eax
push 0x100135c
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1004244
xor eax, eax
cmp dword [edi], 0x404
sete al
mov dword [ebp - 4], eax
xor eax, eax
push 0
cmp dword [ebp - 4], eax
setne al
push eax
push 0xf1
push dword [edi]
push dword [esi]
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_136]
push dword [ebp - 4]
mov ecx, dword [esi + 4]
push dword [edi - 4]
call fcn.010064ff
add edi, 0x44
cmp edi, 0x10080e8
jb 0x100420b
call fcn.01002702
test eax, eax
jne 0x10042af
call fcn.010027a6
test eax, eax
jne 0x10042af
call fcn.0100284d
test eax, eax
jne 0x10042af
call fcn.01002880
test eax, eax
jne 0x10042af
push eax
push 0x3f3
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esi]
mov ecx, dword [esi + 4]
call fcn.010066cf
call fcn.010041c5
pop edi
pop esi
pop ebx
leave
ret