joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x44f440]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43723a
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x43733c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4372ea
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43733d
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4372df
cmp dword [ebp - 0x24], 1
jne 0x4372df
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x4401b0
push eax
call fcn.00413fc7
add esp, 0xc
cmp eax, 1
jne 0x4372df
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43733d
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x43733d
lea ecx, [ebp - 0x18]
push ecx
push 0x437182
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x43733d
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x437363
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00437103
cmp eax, ebx
pop ecx
pop ecx
jne 0x437365
inc edi
cmp edi, esi
jl 0x43734c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004137e4
leave
ret 4
Function at 0x437374
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x44e7b0
je 0x437430
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x437418
mov esi, dword [ebx + 4]
jmp 0x437412
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437402
cmp dword [ebp - 0xc], 4
jne 0x437402
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4373fa
or dword [eax + 0x9c], ecx
jmp 0x437402
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4373c6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4373a9
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x437c92
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x43cfcb
call fcn.00413794
sub esp, 0x11c
mov eax, dword [0x44f440]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x437d8b
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x437d5f
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402150
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00437c92
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004011f0
test bl, bl
jne 0x437d5f
or dword [ebp - 4], 0xffffffff
jmp 0x437cd0
cmp esi, 0x103
je 0x437d6f
cmp esi, 0x3f2
jne 0x437d7f
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004137e4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x438126
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x43d03e
call fcn.00413794
mov eax, 0x1014
call fcn.00413020
mov eax, dword [0x44f440]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x438221
push dword [ebp + 0xc]
call fcn.00438077
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x43816f
push dword [ebp + 0x14]
jmp 0x438252
push esi
call fcn.00425500
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x4381ec
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.00401780
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.00409580
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x43820f
lea eax, [ebp + 0xc]
push eax
call fcn.00401760
jmp 0x438217
push dword [ebp + 0x14]
call fcn.00402150
lea ecx, [ebx - 0x10]
call fcn.004011f0
jmp 0x43825a
cmp dword [ebp + 0x14], edi
jne 0x43822d
mov dword [ebp + 0x14], 0x43e75a
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402150
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004137e4
leave
ret 0x10
Function at 0x438d7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00437047
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x438dbb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x438dbb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x438dbf
xor eax, eax
jmp 0x438e3c
movzx eax, word [esi + 6]
push ebx
shl eax, 2
push edi
push eax
call fcn.004253f8
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x438ded
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x438ddc
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004389bf
push edi
mov ebx, eax
call fcn.00425423
test ebx, ebx
pop ecx
je 0x438e2f
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00438c01
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00438c88
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x439128
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43915d
cmp edi, dword [esi + 0xc]
jge 0x43915d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43915d
cmp edi, dword [eax + 8]
jge 0x43915d
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43915f
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x439263
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x439297
jmp fcn.0041ee01
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x439308
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x439401
cmp eax, dword [edi + 0xc]
jge 0x439401
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x439359
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4393ea
cmp dword [ebp + 0xc], ebx
je 0x4393ea
jmp 0x439383
push 0x10
call fcn.00438ff4
cmp eax, ebx
je 0x43936f
mov ecx, eax
call fcn.0043925a
mov esi, eax
jmp 0x439371
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43939a
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4393aa
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4393bc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041ee01
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00413bd0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4393fc
cmp ecx, dword [esi + 8]
jge 0x4393fc
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x439402
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4394c0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4394ee
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43950c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043942a
jmp 0x43950c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43950c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043942a
test edi, edi
mov eax, edi
jne 0x4394f6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4520ec]
test ecx, ecx
je 0x4395bf
jmp 0x4394bf
ret 8
Function at 0x5d2fe7
Capabilities:
Encode data using xor

Disassembly:
dec edi
sbb byte [edi + 0x6523159b], dh
int 0x84
les ebx, [edi]
aad 0xc3
insd dword es:[edi], dx
adc byte [esi + 0x2142852e], dh
test dword cs:[edx + 0x21], eax
test dword cs:[edx + 0x21], eax
xor dword [eax], ebx
stosb byte es:[edi], al
sbb dword [0x51c0dba], eax
mov edx, 0x23041c0d
xor dword [ebx + 0x62], 0x20
mov bh, 0x9b
add al, 0x6b
and word [edx - 0xe], ax
mov dl, 0xfc
pop esi
or ah, bl
xchg ebx, eax
and byte [edx], 0xd
mov dh, 0x9f
arpl word [0xd200a22], bx
mov dh, 0x82
ror byte [ecx], 0xbe
jl 0x5d303d
mov bh, 0x9b
add al, 0x71
add al, 0xb6
dec edi
or al, 0xbe
mov dh, 5
jno 0x5d303e
sbb al, 5
mov edx, 0x726db50d
xchg esi, eax
mov esp, 0xe09ec2d4
add al, byte [ebp + 0x56]
cmpsb byte [esi], byte es:[edi]
add eax, 0x2d409491
xchg esp, eax
inc eax
sub eax, 0x98359579
les ebx, [edi]
mov byte [0x6db51471], 0x92
jns 0x5d2fd7
xor eax, 0xc61fc498
add eax, 0x6db51471
xchg edx, eax
xchg ecx, eax
mov esp, 0x6054c2d4
add ah, byte [eax]
mov al, byte [0x9ec3fefc]
adc byte [0xd49bcda0], bl
xchg ecx, esp
mov dh, 5
and byte [ebp - 0x6f0c8b0b], cl
mov byte [0x600d2005], al
sbb al, 0xac
rcr dword [edi + edi*8 + 0x4bb60d22], cl
inc ebp
push esi
cmpsb byte [esi], byte es:[edi]
add eax, 0x6b409491
cmp al, 0xec
mov al, byte [0x20982005]
in eax, 0xf5
or eax, 0x3c083b6
clc
sahf
mov esi, 0x8505b608
loop 0x5d3040
sub eax, 0x37f8323
jno 0x5d30b2
adc al, 0xb5
dec edi
mov ch, 0x4f
test byte [0xd6acdbfe], 0x71
arpl word [ecx - 0x21667ab1], ax
or eax, 0x12ab05b6
adc ch, dl
and al, byte [ebx + 0xe710373]
mov dh, 0x6d
adc cl, byte [edi - 0x6f3d2b44]
pop ebx
aad 0x87
rcr dword [ebx + 0x10122005], 0xcf
cmp edx, dword [eax + 0xd2305b6]
adc byte [ebx], dh
cmp byte [eax - 0x5adcfa4a], cl
mov dh, 0x4f
or cl, byte [0x6522cf10]
sbb dword [ebx - 0x3b], ebp
pop ds
aad 0x9f
arpl word [0xd201c22], bx
mov dh, 0x1a
pushal
aaa
cmpsd dword [esi], dword es:[edi]
add eax, 0xeb5e0d20
and ecx, dword [0x186dc2b6]
mov dh, 0x2e
test dword [edx + 0x1b], eax
xor dword [eax + 0x16], esi
mov dh, 5
jns 0x5d309d
or eax, dword [esi]
and ecx, dword [0xa50f5efc]
adc eax, dword [ebx + 0x4b60d2d]
jno 0x5d3123
mov dh, 0x2f
sbb byte [edx - 0x6e0d3ae0], dh
test dword [0x4fb50d20], eax
add eax, 0x4fb50d20
lock adc dl, byte [eax]
shl dword [edx], 1
sub dword [edx - 0x49ed241e], 5
inc ebp
push esi
push 4
xchg ecx, eax
xchg esp, eax
inc eax
cdq
aas
adc dh, dl
xor ebp, 0xffffff99
adc byte [0xd49bcda0], bl
xchg dword [0xd32005b6], edx
pushfd
invalid
Function at 0x5d5984
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
xchg esp, eax
inc eax
cdq
aas
adc al, 0xf9
pop esi
sbb byte [eax - 0x58782aa5], dl
wait
add eax, 0x1f2e9820
lodsd eax, dword [esi]
salc
jno 0x5d5a0b
and byte [eax - 0x7ab07f32], dl
cdq
ror byte [0xcf9f05b6], 0xa7
cwde
retf
pushfd
add dword [esp + edi*4 - 0x5aca4c2c], ecx
test al, 0x23
or eax, 0x1d639fd6
and dh, byte [edi + 0x50b60d20]
aam 0xb3
xor eax, 0xd23a8a5
salc
lahf
arpl word [0xd20b722], bx
mov dh, 0x50
loopne 0x5d5a33
stc
inc ebp
sbb byte [esi - 0x5969e125], bl
cli
dec esi
sbb al, 0x98
push ss
xchg esp, eax
lahf
salc
jno 0x5d5a0f
fcmovnb st(0), st(1)
in eax, dx
wait
shr ebp, 0x9b
add eax, 0x5ff30d20
in al, 0x9e
mov byte [0xe29e0182], al
sbb al, byte [ebp - 0x38af582b]
adc eax, 0x9e185ff3
loop 0x5d5a22
test ch, dl
jg 0x5d5ac3
invalid
add eax, 0x63a1b720
and byte [edx], dl
adc cl, dl
cmp edi, dword [eax]
dec eax
add eax, 0xd55b9323
xchg ebx, eax
wait
add eax, 0x4efaaa20
sbb al, 0x9e
sub ch, ch
mov dword [0x87d49bcd], eax
adc eax, 0x712005b6
cdq
invalid
Function at 0x401d09
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d48
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d48
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d48
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d48
cmp dword [ecx + 0x74], 0xe
jbe 0x401d48
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10014cb7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10014ceb
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014ce9
push 0x17e9
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x10014d05
push 0x1057
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x1001b223
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001b23b
push 0x1273
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1001b248
push 0xa74
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret
Function at 0x10029304
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029344
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10029342
push 0x1057
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10029399
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xf
jmp 0x10029366
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x1a
jg 0x10029399
mov dword [ebp - 0xc], 0xd6f1860e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029390
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
jmp 0x1002935b
mov esp, ebp
pop ebp
ret
Function at 0x1002e384
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002e3bf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 0x34], eax
jmp 0x1002e3cc
push 0xa74
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1002ee8d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002eeb1
xor eax, eax
jmp 0x1002efee
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002eecf
xor eax, eax
jmp 0x1002efee
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1002edd5
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002eeee
xor eax, eax
jmp 0x1002efee
push 0x7491
push 1
push dword [ebp - 8]
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x43a2
push 0x629
call fcn.1002e3d0
add esp, 0x24
push dword [ebp + 8]
push 0
push 0x2ac9
push 0x53e4
push 0x2a0b
push 0xf9f
push 0x2746
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1002e3d0
add esp, 0x24
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002ef63
push dword [ebp - 0x14]
push 1
push dword [ebp - 4]
call fcn.100296d9
add esp, 0xc
push dword [ebp - 4]
call fcn.1002e012
pop ecx
test eax, eax
jne 0x1002ef74
xor eax, eax
jmp 0x1002efee
push dword [ebp - 4]
push 0x59b5
push 0x4632
push 0
call fcn.10028090
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002efd6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002efaa
xor eax, eax
jmp 0x1002efee
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002efc3
xor eax, eax
jmp 0x1002efee
push 1
lea eax, [ebp - 4]
push eax
push 0x614a
call fcn.1002ee2e
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002efe7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002efeb
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret