joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100206e
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005024]
push ebx
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push 8
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10020b2
xor al, al
jmp 0x1002160
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
mov byte [ebp - 0xd], bl
call edi
test eax, eax
jne 0x1002153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002153
push esi
push dword [ebp - 0x18]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
je 0x1002152
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x100214b
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100214b
cmp dword [esi], ebx
jbe 0x1002142
lea edi, [esi + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x100213e
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x1002125
jmp 0x1002142
mov byte [ebp - 0xd], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.010029f1
leave
ret 4

Function at 0x1002397
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1288
call fcn.01002cf0
mov eax, dword [0x1005024]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xab8]
push eax
call fcn.01002247
lea eax, [ebp - 0x2e8]
push eax
xor eax, eax
push eax
push eax
push 0x19
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100245e
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0xa
lea eax, [ebp - 0x18]
push eax
push 3
push dword [0x1005040]
call esi
push 0x64
lea eax, [ebp - 0xe0]
push eax
push 2
push dword [0x1005040]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2e8]
push eax
call esi
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x1288]
push 0x10013dc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x1288]
push eax
call fcn.01002172
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
pop esi
jmp 0x1002460
xor al, al
mov ecx, dword [ebp - 4]
call fcn.010029f1
leave
ret
Function at 0x100246f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1c50
call fcn.01002cf0
mov eax, dword [0x1005024]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0xcb0]
push eax
call fcn.01002247
and word [ebp - 0x210], 0
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x4e0]
push 0x1001470
push eax
call esi
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0x1c50]
push 0x1001400
push eax
call esi
add esp, 0x18
push 1
push 0
lea eax, [ebp - 0x1c50]
push eax
lea eax, [ebp - 0x4e0]
push eax
push 0x10013f0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.010029f1
leave
ret

Function at 0x1002719
Capabilities:
Create process on windows
Create process suspended
Get common file path
Self delete

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x1005024]
push ebx
push edi
push 0x11
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x530]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x530], 0x44
mov word [ebp - 0x500], bx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp byte [ebp + 8], bl
mov eax, 0x1001668
jne 0x100276f
mov eax, 0x1001648
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x4dc]
push 0x1001620
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x530]
push eax
push ebx
push ebx
push 0x200
push 1
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.010029f1
leave
ret 4
Function at 0x1002e78
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1005024]
push ebx
push esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x208], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
xor ebx, ebx
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x210], ebx
jne 0x1002ec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1003014
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x20c], eax
jne 0x1002edc
mov esi, 0x8007000e
jmp 0x1003014
push eax
push esi
push dword [ebp - 0x21c]
push dword [ebp - 0x208]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1002f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1003008
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x10017e8
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x1002f32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1002f74
mov esi, dword [ebp - 0x218]
push 1
push ebx
push ebx
push dword [esi + 8]
call fcn.01004140
mov ecx, dword [esi + 0xc]
xor ebx, ebx
push 1
add eax, ecx
push ebx
adc edx, ebx
push ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
push dword [esi + 0x10]
call fcn.01004140
mov ecx, dword [esi + 0x14]
xor esi, esi
add eax, ecx
adc edx, esi
mov esi, dword [ebp - 0x210]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x10017cc
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1003008
test dword [ebp - 0x208], 0xfffffffc
jbe 0x1003008
mov eax, dword [ebp - 0x214]
lea eax, [eax + ebx*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x204]
push 0x10017a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002ffa
push dword [ebp - 0x210]
mov ecx, edi
call fcn.01002e52
mov eax, dword [ebp - 0x208]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x1002fa2
push dword [ebp - 0x20c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.010029f1
leave
ret 4
Function at 0x1003029
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1005024]
push ebx
push esi
xor esi, esi
push esi
push esi
push 0x200
lea ecx, [ebp - 0x204]
push ecx
push 0xffffffffffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov ebx, 0x80004005
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x10017ec
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x80000002
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x40c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10030d5
lea eax, [ebp - 0x40c]
push eax
push edi
push esi
push esi
push esi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10030c9
xor ebx, ebx
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
pop ebx
call fcn.010029f1
leave
ret 4

Function at 0x100315d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 8]
xor edi, edi
call fcn.010030ea
test al, al
je 0x10031d8
push dword [ebp - 8]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, edi
pop ecx
je 0x10031d8
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10031d0
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031c9
push dword [ebp + 8]
lea ecx, [ebp - 4]
push esi
call fcn.01004076
mov edi, dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1003534
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x14]
push eax
push 0x1001ef0
push 1
xor ebx, ebx
push ebx
push 0x1001774
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jl 0x1003606
lea eax, [ebp - 0x10]
push eax
push 0x1001714
push 1
push ebx
push 0x1001794
call esi
test eax, eax
jl 0x10035f8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push 0x80
lea edx, [ebp - 8]
push edx
push 0x1001764
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10035ef
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x10035ef
jmp 0x10035d2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push 0x1001744
push 0x1001734
call fcn.010031e5
test al, al
je 0x10035c6
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.0100330e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 4]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100359f
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0xc], ebx
jne 0x1003612
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x1003612
xor eax, eax
inc eax
jmp 0x1003615
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 4
Function at 0x1003681
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1005024]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
push 0x1001888
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xfe
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x208]
push eax
mov esi, 0x1001884
push esi
push 0x1001878
mov edi, 0x1001874
push edi
call ebx
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10036f6
push 0x1001888
push 0xfe
lea eax, [ebp - 0x208]
push eax
push esi
push 0x100186c
push edi
call ebx
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1003819
push 0x1001864
lea ebx, [ebp - 0x208]
call fcn.01003620
mov esi, dword [ebp - 0x20c]
mov eax, ebx
push eax
mov ecx, esi
call fcn.01002e2c
push 0x104
lea eax, [ebp - 0x108]
push eax
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x10017e8
push ebx
call esi
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call esi
add edi, eax
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [edi + eax + 1]
cmp eax, 0x104
jb 0x100377a
mov eax, 0x8000ffff
jmp 0x100381c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
mov edi, dword [ebp - 0x20c]
lea eax, [ebp - 0x108]
push eax
call fcn.01002e78
test eax, eax
lea eax, [ebp - 0x108]
je 0x100380c
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1003819
push ebx
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
lea esi, [ebp - 0x210]
call fcn.010030ea
test al, al
je 0x1003819
lea eax, [ebp - 0x108]
push eax
call fcn.01002e78
test eax, eax
jne 0x1003819
lea eax, [ebp - 0x108]
push eax
call fcn.0100315d
mov dword [edi + 4], eax
xor eax, eax
jmp 0x100381c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010029f1
leave
ret 4
Function at 0x1003830
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x1001ef0
xor edi, edi
inc edi
push edi
push 0
push 0x1001774
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10038d3
mov eax, dword [ebp - 8]
test eax, eax
je 0x10038d3
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x1001754
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, edi
jne 0x1003883
mov eax, edi
jmp 0x10038d8
test esi, esi
jl 0x10038d3
mov eax, dword [ebp - 4]
test eax, eax
je 0x10038d3
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10038ba
cmp dword [ebp - 0xc], edi
jne 0x10038ba
push dword [ebp - 0x10]
mov edi, dword [ebp + 8]
call fcn.0100346e
mov eax, dword [ebp - 4]
test eax, eax
je 0x10038c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
sete al
jmp 0x10038d8
mov eax, 0x8000ffff
pop edi
pop esi
leave
ret 4

Function at 0x1003935
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1005024]
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
mov dword [ebp - 4], eax
je 0x1003954
xor al, al
jmp 0x10039f1
push esi
push edi
push 0xa
pop ecx
mov esi, 0x100189c
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x40]
push eax
push 0x20019
mov esi, 0x1001894
lea edi, [ebp - 0xc]
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov byte [ebp - 0x39], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10039e7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop edi
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x44], edi
call esi
test eax, eax
jne 0x10039de
cmp dword [ebp - 0x48], edi
jne 0x10039de
cmp dword [ebp - 0x44], edi
jne 0x10039de
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x40]
call esi
test eax, eax
jne 0x10039de
cmp dword [ebp - 0x4c], edi
sete byte [ebp - 0x39]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp byte [ebp - 0x39], bl
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.010029f1
leave
ret 4
Function at 0x1003a03
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1005024]
push ebx
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
push 0x80000000
mov dword [ebp - 0x114], 0x104
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1003a7e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003a72
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1003a72
mov bl, 1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
call fcn.010029f1
leave
ret 4
Function at 0x1003ced
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1005024]
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.01003935
mov ecx, esi
mov bl, al
call fcn.01003ac5
dec eax
je 0x1003ef0
dec eax
je 0x1003e85
dec eax
je 0x1003e4f
dec eax
je 0x1003e16
dec eax
je 0x1003d76
dec eax
je 0x1003d6a
dec eax
jne 0x1003e99
cmp dword [esi + 0xc], 0x10003
ja 0x1003d5a
jb 0x1003f09
cmp dword [esi + 8], 0x83
jbe 0x1003f09
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.010029f1
leave
ret 4
cmp dword [esi + 0xc], 0x30001
jmp 0x1003ef7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0x411
jne 0x1003e99
mov ecx, dword [esi + 8]
cmp ecx, 0x900
mov esi, dword [esi + 0xc]
jne 0x1003de5
cmp esi, 0x30002
jne 0x1003de5
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x1003e99
push 0x1001a3c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
lea esi, [ebp - 0x110]
call fcn.010030ea
test al, al
jne 0x1003e99
jmp 0x1003e2c
mov eax, 0x40002
cmp esi, eax
jb 0x1003e0a
ja 0x1003df4
test ecx, ecx
jb 0x1003e0a
cmp esi, eax
ja 0x1003e0a
jb 0x1003e02
cmp ecx, 0x270f
ja 0x1003e0a
mov al, byte [ebp + 8]
jmp 0x1003d5c
push esi
push ecx
call fcn.01003bae
jmp 0x1003d5c
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1003e33
push 0x1001a30
push eax
call fcn.0100204f
test al, al
je 0x1003e33
mov al, 1
jmp 0x1003d5c
cmp dword [esi + 0xc], 0x10002
ja 0x1003d5a
jb 0x1003f09
cmp dword [esi + 8], 0x68
jmp 0x1003f03
mov eax, dword [esi + 0x1c]
push 0x1001924
push eax
call fcn.0100204f
test al, al
jne 0x1003e2c
cmp dword [esi + 0xc], 0x10000
ja 0x1003d5a
push 1
pop eax
jb 0x1003d5c
cmp dword [esi + 8], eax
jbe 0x1003d5c
jmp 0x1003d5a
mov eax, dword [esi + 8]
mov esi, dword [esi + 0xc]
cmp esi, 0x30005
jb 0x1003ea0
ja 0x1003e99
test eax, eax
jb 0x1003ea0
xor al, al
jmp 0x1003d5c
xor cl, cl
cmp esi, 0x20000
jb 0x1003ee4
ja 0x1003eb0
test eax, eax
jb 0x1003ee4
test bl, bl
je 0x1003ee4
push 0x1001a10
call fcn.01003a92
test al, al
jne 0x1003ee2
push 0x10019f4
call fcn.01003a92
test al, al
jne 0x1003ee2
push 0x10019d4
call fcn.01003a92
test al, al
jne 0x1003ee2
xor cl, cl
jmp 0x1003ee4
mov cl, 1
xor eax, eax
test cl, cl
sete al
jmp 0x1003d5c
cmp dword [esi + 0xc], 0x50001
ja 0x1003d5a
jb 0x1003f09
cmp dword [esi + 8], 0
jae 0x1003d5a
xor eax, eax
inc eax
jmp 0x1003d5c

Function at 0x1003f5d
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1001a48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003fb3
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
jmp 0x1003fb5
xor al, al
leave
ret 8
Function at 0x1003fbe
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 2
xor ebx, ebx
push ebx
push 0x1001a48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004008
push 0x1001a78
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1003ff9
cmp eax, 2
jne 0x1003ffb
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x100400a
xor al, al
pop ebx
leave
ret

Function at 0x1004076
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
or edx, 0xffffffff
cmp ebx, 4
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
jbe 0x10040ea
push edi
lea edi, [ebx - 5]
shr edi, 2
inc edi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
sub ebx, 4
dec edi
jne 0x1004097
pop edi
test ebx, ebx
jbe 0x1004104
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001ab0]
inc esi
dec ebx
jne 0x10040ee
mov eax, dword [ebp - 4]
pop esi
mov dword [eax], edx
pop ebx
leave
ret 8