joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b5a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40b601
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40b5e4
cmp edi, 2
jb 0x40b5e4
cmp byte [esi], cl
jne 0x40b5e4
cmp byte [esi + 1], cl
jne 0x40b5e4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x440c20]
jmp 0x40b5b5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x440c20]
test edi, edi
jne 0x40b5b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40b630
cmp cl, 0x23
jne 0x40b617
cmp byte [esi], cl
jne 0x40b617
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x440c20]
test cl, cl
jne 0x40b608
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x40b740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40b754
mov dword [ebx], 0
mov edx, 0x440a04
call fcn.0040b640
mov esi, eax
test esi, esi
je 0x40b842
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40b838
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40b838
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x40b838
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40b838
mov eax, dword [0x449b68]
test eax, eax
je 0x40b7cc
inc dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x40b838
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40b81d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x449b68]
add esp, 4
test eax, eax
je 0x40b80a
dec dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40b82f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d5f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x44900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x440c20]
sub esi, 1
jne 0x40d623
mov eax, dword [0x449b68]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x40d652
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x40d661
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x40d67a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.0041d190
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d9b2
mov esp, ebp
pop ebp
ret 4
Function at 0x411bc0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x411bfd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x411be3
cmp byte [esi], bl
jne 0x411be3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x440c20]
test bl, bl
jne 0x411bd4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00411b60
Function at 0x41c280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x41c302
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41c2bc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041ddb0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0040bbd0
mov edx, dword [esi]
mov ecx, 0x449b64
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0040bbd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x425f8a
mov eax, dword [0x449b68]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x425f7d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x425fbb
mov eax, dword [0x449b68]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x425fae
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x425fec
mov eax, dword [0x449b68]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x425fdf
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x426039
mov eax, dword [0x449b68]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42602c
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42606a
mov eax, dword [0x449b68]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42605d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42609b
mov eax, dword [0x449b68]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42608e
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004287f0
Function at 0x43a060
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov ebx, edx
je 0x43a0d1
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x43a0a8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x43a08f
cmp byte [esi], cl
jne 0x43a08f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x440c20]
test cl, cl
jne 0x43a080
mov ecx, dword [0x449b68]
not eax
cmp dword [ecx + 0x1be0], eax
jne 0x43a0be
mov dword [ecx + 0x1be4], eax
cmp dword [ecx + 0x1c1c], eax
jne 0x43a133
mov byte [ecx + 0x1c20], 1
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x449b68]
xor edx, edx
mov eax, dword [edi + 0x1ba8]
mov ecx, dword [eax + 0xc4]
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.0040b5a0
mov esi, eax
add esp, 4
cmp dword [edi + 0x1be0], esi
jne 0x43a109
mov dword [edi + 0x1be4], esi
cmp dword [edi + 0x1c1c], esi
jne 0x43a118
mov byte [edi + 0x1c20], 1
cmp dword [edi + 0x1bc8], esi
jne 0x43a131
push ecx
push ebx
mov edx, 0xb
mov ecx, esi
call fcn.0041d190
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x43d378
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0043d354
pop esi
leave
ret 8

Function at 0x43e58f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43e5ce
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43e5ce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43e5ce
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43e5ce
cmp dword [ecx + 0x74], 0xe
jbe 0x43e5ce
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10006e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x10006e4c
cmp dword [esp + 0x14], 1
jne 0x10006e4c
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push esi
push edi
call ebx
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10009fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10012240]
test eax, eax
jne 0x1000a095
mov ecx, dword [ebp + 8]
cmp word [0x1000d3de], 0x110f
mov eax, 0xf0000
mov dword [0x10012240], ecx
mov dword [ebp - 4], eax
je 0x1000a089
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
xor edx, edx
mov eax, esi
mov dl, byte [edi + str.BwwsHGK__bM]
mov ecx, 0x16
mov ebx, edx
add esi, 0x25
cdq
idiv ecx
mov eax, dword [0x10012240]
mov ecx, edx
shl ebx, cl
xor eax, ebx
inc edi
cmp esi, 0x309
mov dword [0x10012240], eax
jl 0x1000a008
movsx eax, byte [0x1000d4b5]
movsx esi, byte [0x1000d4b2]
movsx ecx, byte [0x1000d4b4]
imul esi, eax
movsx edx, byte [0x1000d4b6]
lea ecx, [ecx + ecx*2]
pop edi
sub esi, ecx
mov ecx, edx
and ecx, 7
or edx, 3
shl esi, cl
movsx ecx, byte [0x1000d4b3]
xor esi, ecx
imul esi, edx
shl eax, 0x18
add esi, eax
mov eax, dword [0x10012240]
xor eax, esi
pop esi
mov dword [0x10012240], eax
mov eax, dword [ebp - 4]
pop ebx
xor dword [0x10012240], 0xf0000
jmp 0x1000a09d
xor eax, dword [ebp + 8]
mov dword [0x10012240], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x1000a0ae
mov dword [0x10012240], 0
mov esp, ebp
pop ebp
ret
Function at 0x402120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401ba0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401e10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40218b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x224]
jmp 0x40221c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4021f1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402120
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4021e8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x228]
jmp 0x40221c
mov dword [ebp - 4], 0x100
jmp 0x402192
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00401c80
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret 4

Function at 0x4063a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004054a3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
xchg esp, eax
cld
invalid
inc dword [eax]
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11

Function at 0x406450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
invalid
invalid
cmpsb byte [esi], byte es:[edi]
cld

Function at 0x407560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x407566
jmp 0x40756b
jmp fcn.00406e67
cmp dword [ebp - 0x37c], 0
jne 0x407615
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
invalid
invalid
je 0x407584
Function at 0x4081f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4082b6
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x4082d8
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082f0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret
Function at 0x409230
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409254
mov eax, 3
jmp 0x40936c
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409270
mov eax, 2
jmp 0x40936c
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x40934b
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x4092a9
mov eax, 0xd
jmp 0x40936c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004076c8
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x40e51c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40931c
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x409346
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x409346
mov eax, 0xe8
jmp 0x40936c
jmp 0x40927f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x409363
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40936a
mov eax, 0xd
jmp 0x40936c
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4096b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.CArmReport.0
push 0x104
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 4
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4096fb
jmp 0x409727
push str.AdobeARM_
push 0x104
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.004063f0
push str.ArmReport.ini
push 0x104
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.004063f0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x409950
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x100
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR90.dll_vswprintf_s]
add esp, 0x10
mov dword [ebp - 0x210], 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x454], 0
je 0x4099f3
mov eax, dword [ebp + 8]
add eax, 0x230
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4099f1
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x409a03
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR90.dll__putws]
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004076b8
mov esp, ebp
pop ebp
ret
Function at 0x10003370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x1000338a
xor esi, esi
jmp 0x100033b8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.100116c0
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x100033f5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100033e0
call esi
mov esi, eax
jmp 0x10003488
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10003488
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x10003419
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x1000343b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10003429
call esi
jmp 0x1000347d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000347f
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x10003471
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.100116c0
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.10011b60
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.100034ef
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10003ed0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1002c854
call fcn.100113a0
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.10003e92
mov edi, eax
cmp edi, esi
je 0x10003f17
cmp dword [ebp - 0x10], esi
je 0x10003f13
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10003f84
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10003f35
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.10003ed0
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x10003f95
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x10003f1f
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10003f6b
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x10003f82
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], esi
je 0x10003fa3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x10003f84