joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42984b
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
jbe 0x429888
xor eax, eax
mov dword [ebp - 4], eax
push esi
mov esi, dword [edi + 8]
add esi, eax
lea ecx, [esi + 0x20]
call fcn.00423756
mov ecx, esi
call fcn.00428715
mov eax, dword [ebp - 4]
inc ebx
add eax, 0x88
mov dword [ebp - 4], eax
cmp ebx, dword [edi + 4]
jb 0x429862
pop esi
push dword [edi + 8]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [edi + 8], 0
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4298ae
push 1
call fcn.0042984b
and dword [edi + 0xc], 0
mov ecx, edi
call fcn.0041ba88
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x42a7f0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45b0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], 0x18
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 0x2001f
lea eax, [ebp - 8]
mov dword [ebp - 0x18], 0x40
push eax
mov edi, ecx
mov dword [ebp - 0x1c], 0x401994
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42a85b
mov dword [ebp - 0x2c], 0x5d
mov dword [ebp - 0x28], 0x407850
jmp 0x42a883
push 0x10
push edi
push 3
push ebx
push 0x4019a4
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42a8b4
mov dword [ebp - 0x2c], 0x66
mov dword [ebp - 0x28], 0x407938
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x4077e0
mov dword [ebp - 0x30], 0x407814
call fcn.0045365a
mov eax, dword [ebp - 8]
test eax, eax
je 0x42a8b0
cmp eax, 0xffffffff
je 0x42a8b0
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42a8cc
mov eax, dword [ebp - 8]
test eax, eax
je 0x42a8ca
cmp eax, 0xffffffff
je 0x42a8ca
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a80a
leave
ret
Function at 0x42b070
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, 0x7ffe0030
mov ecx, esi
push edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42b084
sub ecx, edx
mov dword [ebp - 4], esi
sar ecx, 1
lea esi, [ebp - 0xc]
lea eax, [ecx + ecx]
mov dword [ebp - 0xc], eax
add eax, 2
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 4

Function at 0x44a87f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x45b0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x5c], ecx
push esi
push edi
lea edi, [ebp - 0x18]
mov dword [ebp - 0x48], 0x18
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
mov bl, dl
mov dword [ebp - 0x20], edx
mov byte [ecx], dl
stosd dword es:[edi], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x401e80]
mov dword [ebp - 0x30], eax
mov eax, dword [0x401e84]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x401e88]
mov dword [ebp - 0x28], eax
mov eax, dword [0x401e8c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
mov edi, 0xc0000034
cmp esi, edi
je 0x44a934
test esi, esi
jns 0x44a915
mov dword [ebp - 0x50], 0x2e
jmp 0x44a943
lea eax, [ebp - 0x20]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, edi
jne 0x44a938
xor esi, esi
jmp 0x44a961
test esi, esi
jns 0x44a97c
mov dword [ebp - 0x50], 0x3c
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0x412788
mov dword [ebp - 0x54], 0x4127bc
mov dword [ebp - 0x4c], 0x407f28
call fcn.0045365a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44a978
cmp eax, 0xffffffff
je 0x44a978
and dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x44a9ad
cmp dword [ebp - 0x14], 4
je 0x44a988
cmp dword [ebp - 0x10], 4
jne 0x44a98f
cmp dword [ebp - 0xc], 0
setne bl
mov eax, dword [ebp - 0x5c]
mov byte [eax], bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44a9ab
cmp eax, 0xffffffff
je 0x44a9ab
and dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a80a
leave
ret
Function at 0x44d565
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 8], ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov eax, dword [ebx + 0x10]
cmp dword [ebx + 0x14], eax
jb 0x44d5af
mov dword [edi + 4], eax
mov dword [edi], 3
xor eax, eax
jmp 0x44d679
mov esi, dword [ebx + 0x18]
mov ecx, esi
call dword [0x45d240]
mov ecx, dword [ebp - 4]
jmp 0x44d664
cmp ecx, 0x61
jb 0x44d5cc
cmp ecx, 0x7a
jbe 0x44d64a
lea eax, [ecx - 0x41]
cmp eax, 0x19
jbe 0x44d64a
lea eax, [ecx - 0x30]
cmp eax, 9
jbe 0x44d64a
cmp ecx, 0x2f
ja 0x44d612
cmp ecx, 0x28
jae 0x44d650
cmp ecx, 0xa
je 0x44d650
cmp ecx, 0xd
je 0x44d650
cmp ecx, 0x1f
jbe 0x44d630
cmp ecx, 0x21
jbe 0x44d650
cmp ecx, 0x22
jbe 0x44d630
cmp ecx, 0x25
jbe 0x44d650
cmp ecx, 0x27
jne 0x44d630
cmp dword [ebx + 0x24], 0xa
sete al
jmp 0x44d64c
cmp ecx, 0x3a
jb 0x44d630
cmp ecx, 0x3b
jbe 0x44d650
cmp ecx, 0x3d
je 0x44d650
cmp ecx, 0x3e
jbe 0x44d630
cmp ecx, 0x40
jbe 0x44d650
cmp ecx, 0x5f
je 0x44d650
mov eax, dword [ebp - 4]
mov dword [edi], 0xc
sub eax, dword [ebx + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x10], eax
jmp 0x44d5a8
mov al, 1
test al, al
je 0x44d630
mov esi, dword [ebx + 0x18]
mov ecx, esi
inc dword [ebp - 8]
mov dword [ebp - 4], edx
call dword [0x45d240]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call esi
mov ecx, eax
mov dword [ebp - 0x10], edx
cmp ecx, 0xffffffff
jne 0x44d5c2
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453d2b
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x45b0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx]
xor eax, eax
push esi
mov esi, dword [ecx + 8]
add ebx, esi
push edi
mov edi, edx
mov dword [ebp - 0x20c], eax
lea edx, [ebp - 0x208]
mov dword [ebp - 0x214], edi
xor ecx, ecx
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 0x220], ecx
mov eax, edx
mov dword [ebp - 0x218], eax
cmp esi, ebx
jae 0x453f01
lea eax, [ebp - 8]
mov dword [ebp - 0x224], esi
sub eax, edx
and eax, 0xfffffffe
cmp eax, 8
jl 0x453e99
mov al, byte [esi]
inc esi
mov byte [ebp - 0x20d], cl
mov byte [ebp - 0x20e], cl
mov byte [ebp - 0x20f], al
cmp esi, ebx
je 0x453dc1
mov al, byte [esi]
mov byte [ebp - 0x20d], al
mov eax, ecx
push 2
pop ecx
jmp 0x453dc7
push 0x3d
xor ecx, ecx
pop eax
inc ecx
mov esi, dword [ebp - 0x224]
add esi, ecx
mov word [edx + 4], ax
cmp esi, ebx
je 0x453de4
mov al, byte [esi]
inc esi
mov byte [ebp - 0x20e], al
xor eax, eax
jmp 0x453de7
push 0x3d
pop eax
movzx ecx, byte [ebp - 0x20f]
movzx edi, byte [ebp - 0x20d]
mov word [edx + 6], ax
mov eax, ecx
shr eax, 2
and ecx, 3
shl ecx, 4
movzx eax, byte [eax + 0x414d00]
mov word [edx], ax
mov eax, edi
shr eax, 4
or eax, ecx
movzx ecx, byte [ebp - 0x20e]
movzx eax, byte [eax + 0x414d00]
mov word [edx + 2], ax
xor eax, eax
cmp word [edx + 4], ax
jne 0x453e49
and edi, 0xf
mov eax, ecx
shr eax, 6
shl edi, 2
or edi, eax
movzx eax, byte [edi + 0x414d00]
mov word [edx + 4], ax
xor eax, eax
cmp word [edx + 6], ax
jne 0x453e5d
and ecx, 0x3f
movzx eax, byte [ecx + 0x414d00]
mov word [edx + 6], ax
mov edi, dword [ebp - 0x214]
lea eax, [ebp - 8]
add edx, 8
cmp edx, eax
jne 0x453e8e
push edi
push ecx
lea edx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x200
call fcn.00455dca
test eax, eax
js 0x453f07
lea edx, [ebp - 0x208]
cmp esi, ebx
jae 0x453e99
xor ecx, ecx
jmp 0x453d82
lea eax, [ebp - 0x208]
cmp edx, eax
je 0x453f01
sub edx, eax
mov dword [ebp - 0x220], edx
cmp edx, dword [ebp - 0x21c]
jbe 0x453ef0
mov esi, 0xc000042b
mov dword [ebp - 0x234], 0x414514
push esi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x230], 0x414828
mov dword [ebp - 0x22c], 0x4f5
mov dword [ebp - 0x228], 0x414840
call fcn.0045365a
mov eax, esi
jmp 0x453f07
push edi
push ecx
lea edx, [ebp - 0x220]
call fcn.00455dca
test eax, eax
js 0x453f07
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a80a
leave
ret
Function at 0x459f2d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x45b0d0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x45b548]
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
test eax, eax
jne 0x459f99
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
call fcn.0045a3c3
xor edi, edi
cmp dword [esp + 0x28], edi
je 0x459f8b
push 0x10
push edi
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_wcstoul]
and eax, 0xfffe
add esp, 0xc
or eax, 1
mov dword [0x45b548], eax
lea ecx, [esp + 0x28]
call fcn.0041bb93
mov eax, dword [0x45b548]
or dword [ebx + 8], eax
lea eax, [esp + 0x34]
push esi
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
test al, al
je 0x45a092
lea eax, [esp + 0x28]
mov dword [esp + 0x28], edi
push eax
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov esi, edi
call fcn.0045a4a8
cmp word [esp + 0x28], 0
je 0x459fef
push 0x10
push edi
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_wcstoul]
add esp, 0xc
mov esi, eax
jmp 0x45a07f
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
push eax
push 0x101
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x20], 0x4026b8
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jne 0x45a067
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], edi
push eax
push 0x14
lea eax, [esp + 0x48]
push eax
push 2
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x45a067
cmp dword [esp + 0x44], 4
jne 0x45a067
cmp dword [esp + 0x48], 4
jne 0x45a067
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x45a07f
cmp eax, 0xffffffff
je 0x45a07f
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebx + 8], esi
cmp dword [esp + 0x2c], 0
je 0x45a092
lea ecx, [esp + 0x28]
call fcn.004524f4
cmp dword [esp + 0x38], 0
je 0x45a0a2
lea ecx, [esp + 0x34]
call fcn.004524f4
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045a80a
mov esp, ebp
pop ebp
ret
Function at 0x7a82f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x288000]
push edi
or ebp, 0xffffffff
jmp 0x7a8312
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7a8319
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a8308
mov eax, 1
add ebx, ebx
jne 0x7a832b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7a833c
jne 0x7a835b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a835b
dec eax
add ebx, ebx
jne 0x7a8348
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7a8320
add ebx, ebx
jne 0x7a8357
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7a83ad
xor ecx, ecx
sub eax, 3
jb 0x7a8373
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7a83e2
sar eax, 1
mov ebp, eax
jmp 0x7a837e
add ebx, ebx
jne 0x7a837e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a834c
inc ecx
add ebx, ebx
jne 0x7a838c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a834c
add ebx, ebx
jne 0x7a8399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7a838e
jne 0x7a83aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7a838e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7a83cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7a83be
jmp 0x7a830e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7a83cc
add edi, ecx
jmp 0x7a830e
pop esi
lea edi, [esi + 0x3a4000]
mov eax, dword [edi]
or eax, eax
je 0x7a8434
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a9ccc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a9e34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7a83e9
mov ecx, edi
jns 0x7a8418
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a9e38]
or eax, eax
je 0x7a842e
mov dword [ebx], eax
add ebx, 4
jmp 0x7a8406
call dword [esi + 0x3a9e48]
mov ebp, dword [esi + 0x3a9e3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7a8468
sub esp, 0xffffff80
jmp 0x5b0cfa
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call fcn.010047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x10063e0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1006409
inc esi
mov al, byte [esi]
test al, al
je 0x1006402
cmp al, 0x22
jne 0x10063f7
cmp byte [esi], 0x22
jne 0x100641a
jmp 0x1006419
cmp al, 0x20
jle 0x100641a
inc esi
cmp byte [esi], 0x20
jg 0x100640d
jmp 0x100641a
cmp al, 0x20
jg 0x1006420
inc esi
mov al, byte [esi]
test al, al
jne 0x1006415
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x100643a
movzx eax, word [ebp - 0x14]
jmp 0x100643d
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0100637a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x10068b3
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x100b2d0]
and dword [ebp - 0xa8], 0
cmp dword [0x100b2dc], 0xfffffffe
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0xc
jne 0x10069d6
and dword [0x100b2dc], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10069d6
cmp dword [ebp - 0x94], 1
jne 0x10069d6
cmp dword [ebp - 0xa0], 4
jne 0x10069d6
cmp dword [ebp - 0x9c], 0xa
jae 0x10069d6
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10069d6
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x10014b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10069d6
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x1001271
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x10069d6
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100678f
test eax, eax
je 0x10069d6
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x10069cc
cmp dword [ebp - 0xa8], 0xd
jne 0x10069d6
mov dword [0x100b2dc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100b2dc]
call fcn.010064de
leave
ret

Function at 0x10069ea
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1006a22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1006a26
xor eax, eax
jmp 0x1006a3c
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4
Function at 0x2a4a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x2cb010]
push edi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x2240292
nop
push eax
call 0x7740e026
nop
mov ebx, eax
push 0x2d49f0
mov dword [ebp - 4], ebx
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
mov byte [ebx + edi], 0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x2a4b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x74e743d3
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x2d49f0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x2a4b06
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
push 0x2d49f0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x2240297
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2a6ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x2a6f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x74e69910
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x2a6fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x2a6fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x2a6f91
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call 0x74e69910
nop
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x2a6fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x2a6fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0x2a6fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.004d90f4]
push eax
call dword [fcn.004d9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x2a6f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.002a7590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x793d00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x4d90e0]
test esi, esi
jne 0x793d18
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x793d11
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x793d11
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x793d7a
jmp 0x793d60
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x4d8bf0]
add eax, esi
call fcn.007917e0
test eax, eax
je 0x793d83
inc edi
cmp edi, dword [ebp - 4]
jb 0x793d60
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret