joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004720
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and al, 0x31
add eax, 0xcf
ret 4

Function at 0x10004740
Capabilities:
Copy file
Delete file
Get file size

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov edi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10004782
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
mov ax, 0xcb
pop ebx
add esp, 8
ret 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [esp + 0x20]
mov ecx, edi
push ebp
mov ebx, eax
call fcn.10004880
push esi
mov dword [esp + 0x14], eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, edi
jl 0x100047cd
jg 0x100047b4
cmp ebx, dword [esp + 0x10]
jbe 0x100047cd
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
mov ax, 0xc9
pop ebx
add esp, 8
ret 8
mov esi, dword [esp + 0x1c]
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
push esi
jne 0x100047f4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
mov ax, 0xca
pop ebx
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 8
ret 8

Function at 0x10004810
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10004841
pop edi
pop esi
xor al, al
pop ebx
ret 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, edi
call fcn.10004880
xor ecx, ecx
cmp ecx, edx
jl 0x10004873
jg 0x1000486b
cmp ebx, eax
jbe 0x10004873
pop edi
pop esi
xor al, al
pop ebx
ret 8
pop edi
pop esi
mov al, 1
pop ebx
ret 8
Function at 0x10004880
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
test ebp, ebp
push edi
jne 0x1000489f
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, 0xffffffff
pop ebx
add esp, 0x18
ret 4
cmp word [ebp], 0x5c
jne 0x1000494c
cmp word [ebp + 2], 0x5c
jne 0x1000494c
lea eax, [ebp + 4]
xor esi, esi
test eax, eax
je 0x100048f3
mov edi, dword [sym.imp.USER32.dll_CharNextW]
mov cx, word [eax]
test cx, cx
je 0x100048ef
cmp cx, 0x5c
jne 0x100048d8
inc esi
cmp esi, 2
je 0x100048ef
push eax
call edi
test eax, eax
jne 0x100048c4
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, 0xffffffff
pop ebx
add esp, 0x18
ret 4
test eax, eax
jne 0x10004903
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, 0xffffffff
pop ebx
add esp, 0x18
ret 4
sub eax, ebp
sar eax, 1
add eax, 2
mov edi, eax
lea ebx, [edi + edi]
push ebx
call fcn.10004f1d
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000492e
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, 0xffffffff
pop ebx
add esp, 0x18
ret 4
lea eax, [edi - 2]
push eax
push ebp
push esi
call fcn.10005835
mov word [esi + edi*2 - 4], 0x5c
add esp, 0xc
mov word [ebx + esi - 2], 0
jmp 0x1000497e
push 8
call fcn.10004f1d
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000496c
pop edi
pop esi
or eax, 0xffffffff
pop ebp
or edx, 0xffffffff
pop ebx
add esp, 0x18
ret 4
push 3
push ebp
push esi
call fcn.10005835
add esp, 0xc
mov word [esi + 6], 0
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetDiskFreeSpaceExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
or edi, 0xffffffff
or ebx, 0xffffffff
test eax, eax
je 0x100049bf
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
push edx
push ecx
push esi
call eax
test eax, eax
je 0x10004a03
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
jmp 0x10004a03
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x10004a03
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push 0
push eax
push 0
push ecx
call fcn.10005880
mov ecx, dword [esp + 0x18]
push 0
push ecx
push edx
push eax
call fcn.10005880
mov edi, eax
mov ebx, edx
push esi
call fcn.10004f12
add esp, 4
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x10004a80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push edi
xor ebx, ebx
mov dword [esi], 0xa
push eax
mov dword [ebp], 0xa
mov dword [esp + 0x1c], ebx
xor edi, edi
call fcn.10004de0
test eax, eax
jne 0x10004abc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push str.Position_X
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004af9
mov edx, dword [esp + 0x10]
mov edi, 1
mov dword [esi], edx
mov eax, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push str.Position_Y
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004b37
mov ecx, dword [esp + 0x10]
mov ebx, 1
mov dword [ebp], ecx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10004b53
test edi, edi
je 0x10004b53
test ebx, ebx
mov eax, 1
jne 0x10004b57
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x10004b70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edi
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], eax
xor edi, edi
mov dword [esp + 0x1c], eax
call fcn.10004e50
test eax, eax
jne 0x10004b9d
pop edi
add esp, 0x18
ret 4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.Position_X
push ecx
mov dword [esp + 0x20], edx
call esi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.Position_Y
push ecx
mov dword [esp + 0x20], edx
call esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
pop esi
jne 0x10004c07
mov edi, 1
mov eax, edi
pop edi
add esp, 0x18
ret 4

Function at 0x10004c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call fcn.10004de0
test eax, eax
jne 0x10004c27
add esp, 0xc
ret 8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 4]
push esi
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
xor esi, esi
push edx
mov edx, dword [esp + 0xc]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004c63
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 8
Function at 0x10004ce0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call fcn.10004de0
test eax, eax
jne 0x10004cf7
add esp, 0x10
ret 8
mov eax, 4
lea ecx, [esp + 4]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
xor esi, esi
push edx
mov edx, dword [esp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004d3a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov esi, 1
mov dword [eax], ecx
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret 8

Function at 0x10004d50
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
call fcn.10004e50
test eax, eax
jne 0x10004d67
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push esi
lea edx, [esp + 8]
push 4
xor esi, esi
push edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
push 4
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10004d95
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x4016a9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
push 0x1000
push 0x719
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4016eb
push 0x4013ff
push str.Failed_to_allocate_memory_for_shellcode.
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.0040110d
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x401713
push 0x719
push section..data
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [ebp - 4]
push 0x8000
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
leave
ret
Function at 0x1001a093
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001a0a2
pop dword [ebp - 0x14]
mov eax, 0x1001a0a2
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4307b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xf3dfdfdd
sub ecx, 0xf3df8dac
mov edi, eax
mov esi, 0x8761afc8
sub esi, 0x775df1c8
add esi, dword [ebp - 0x14]
mov ebx, 0xaf09cc6e
mov edx, dword [esi]
xor dword [ebp - 0xc], 0xe26a054a
xor edx, ebx
add dword [ebp - 0xc], edx
mov dword [edi], edx
xor dword [ebp - 8], 0xd0bef085
add edi, 0x30984392
add edi, 0xcf67bc72
add esi, 0x1ffe8a5b
sub esi, 0x1ffe8a57
loop 0x1001a0f1
add eax, 0xebf7222b
sub eax, 0xebf5e694
mov ebx, eax
add eax, 0xcbbc3598
add eax, 0x3443ca6d
mov ecx, 0xb716ba94
sub ecx, 0xa716ba94
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a093
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a093
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4035e1
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406cb0
push ebx
push ebp
push esi
push edi
push dword [0x40da28]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40c444
push eax
push ebx
mov esi, 0x40be44
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40c580
call fcn.00403e4a
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40da28]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40c700
call fcn.00403e4a
add esp, 0xc
push dword [0x40da28]
push 0x50
push 0x40d8a0
push ebx
push str.build_info
push esi
call edi
push dword [0x40da28]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40da28]
mov dword [0x40c458], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40da28]
mov dword [0x40d898], eax
push 0xa
push 0x40d8f0
push ebx
push str.target_version
push esi
call edi
push dword [0x40da28]
push 0x50
push 0x40d840
push ebx
push str.name
push str.metadata
call edi
push dword [0x40da28]
push 0x104
push 0x40c5e0
push ebx
push str.install_script
push esi
call edi
push dword [0x40da28]
push 0xa
mov ebp, 0x40da40
push ebp
push ebx
push str.user_access_control
push esi
call edi
push str.force
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403720
call fcn.00403e4a
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
jmp 0x40374c
push str.auto
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403753
call fcn.00403e4a
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
call fcn.00403e4a
test eax, eax
je 0x403786
call fcn.00403e4a
jmp 0x4037c9
cmp byte [0x40da40], 0
je 0x403786
push str.none
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403786
push 0
push 0x40beb0
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40c580
call fcn.00403e4a
push eax
mov dword [0x40d900], eax
call fcn.00403e4a
pop ecx
pop ecx
push dword [0x40c564]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x40da28]
test eax, eax
je 0x4037b9
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x40da4c]
test eax, eax
je 0x4037c9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403e59
pop dword [ebp - 0x20]
mov eax, 0x403e59
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xddc0935
add dword [ebp - 0x30], 0x40763c16
mov dword [ebp - 0x2c], 0x3009d0ba
sub dword [ebp - 0x2c], 0xfdd68475
mov dword [ebp - 0x28], 0x74171f4e
add dword [ebp - 0x28], 0xd83524e0
mov dword [ebp - 0x24], 0xb5868c56
sub dword [ebp - 0x24], 0xb5868c56
lea eax, [ebp - 0x30]
push eax
mov eax, 0x396cf0fb
sub eax, 0x392c8097
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x9d56adb7
sub dword [ebp - 0x30], 0x28e44461
mov dword [ebp - 0x2c], 0x4ee044cc
sub dword [ebp - 0x2c], 0xd73e357
mov dword [ebp - 0x28], 0xad3f5b73
sub dword [ebp - 0x28], 0x49cfef07
mov dword [ebp - 0x24], 0x71565789
sub dword [ebp - 0x24], 0x71565789
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xa44cce16
add eax, 0x5bf3a292
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39849
push 0
call eax
mov ecx, 0x5315
mov edi, eax
mov esi, 0x63dc88a7
add esi, 0x9c647759
add esi, dword [ebp - 0x20]
mov ebx, 0xc93d2ef0
add dword [ebp - 4], ecx
mov edx, dword [esi]
sub dword [ebp - 0x10], 0xa95b5eda
xor edx, ebx
add dword [ebp - 0x10], ecx
mov dword [edi], edx
mov dword [ebp - 0x10], 0x91436bfb
add edi, 4
add esi, 0xdd88bee1
add esi, 0x22774123
loop 0x403f6a
add eax, 0x9087aa2e
sub eax, 0x90866b07
mov ebx, eax
add eax, 5
mov ecx, 0xe2811cdc
add ecx, 0x1dbee324
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1005a2e0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.10071fa0
mov eax, dword [0x100f51d4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1005a376
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1005a376
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.100124a0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.1009ca77
add esp, 0x1c
test eax, eax
jns 0x1005a34c
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.100124a0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.1009ca77
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.1005a1a0
test eax, eax
jle 0x1005a40a
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1005a41e
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
Function at 0x1001f5b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001f78
push 0
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x1001f7b
and eax, 0x10
ret 4

Function at 0x100230f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100231e
pop dword [ebp - 0x20]
mov eax, 0xcb9ebd2a
sub eax, 0xca9e9a0c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe7b1dcc5
add dword [ebp - 0x30], 0x66a06886
mov dword [ebp - 0x2c], 0x8a67e47b
sub dword [ebp - 0x2c], 0x58349836
mov dword [ebp - 0x28], 0x3f1e795e
sub dword [ebp - 0x28], 0xf2d23530
mov dword [ebp - 0x24], 0x54cce44b
add dword [ebp - 0x24], 0xab331bb5
lea eax, [ebp - 0x30]
push eax
mov eax, 0x1851db35
sub eax, 0x1751c9e1
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x71f1c8f3
sub dword [ebp - 0x30], 0xfd7f5f9d
mov dword [ebp - 0x2c], 0x85261563
sub dword [ebp - 0x2c], 0x43b9b3ee
mov dword [ebp - 0x28], 0x815d4f61
add dword [ebp - 0x28], 0xe2121d0b
mov dword [ebp - 0x24], 0x4c3f2219
sub dword [ebp - 0x24], 0x4c3f2219
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35a09
push 0
call eax
mov ecx, 0x4134
mov edi, eax
mov ebx, 0x4d51d33b
sub ebx, 0x4c43733b
add ebx, dword [ebp - 0x20]
mov esi, 0xb03b4c85
add esi, 0x92bd1305
xor dword [ebp - 0x10], eax
mov edx, dword [ebx]
mov dword [ebp - 0x18], 0xb643a4d
xor edx, esi
mov dword [edi], edx
add dword [ebp - 0x10], edx
add edi, 4
add ebx, 4
loop 0x1002435
add eax, 0xf7a3
mov ebx, eax
add eax, 0x3972eb1c
sub eax, 0x3972eb17
mov ecx, 0x4e5752a6
add ecx, 0xb2a8ad5a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x100264f
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
jne 0x1002660
call fcn.01002623
cmp eax, 2
jne 0x100269e
test byte [esp + 4], 4
jne 0x1002683
push 4
push 0x40
push 0
push 0x1001251
push 0x522
push 0
call fcn.0100230f
cmp eax, 6
jne 0x100269e
cmp word [0x100aa64], 0
jne 0x1002699
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x100269e
call fcn.0100230f
ret 4

Function at 0x1002b44
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
mov cl, byte [edi]
test cl, cl
je 0x1002ba9
push ebx
push esi
lea esi, [edi + 1]
mov al, byte [esi]
xor ebx, ebx
cmp al, 0x3a
jne 0x1002b67
cmp byte [edi + 2], 0x5c
jne 0x1002b67
lea esi, [edi + 3]
jmp 0x1002ba2
cmp cl, 0x5c
jne 0x1002ba2
cmp al, cl
jne 0x1002ba2
push 2
lea esi, [edi + 2]
pop ebx
jmp 0x1002ba2
cmp byte [esi], 0x5c
jne 0x1002b99
cmp byte [esi - 1], 0x3a
je 0x1002b99
test ebx, ebx
je 0x1002b8a
dec ebx
jmp 0x1002b99
and byte [esi], 0
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0
jne 0x1002b78
pop esi
pop ebx
pop edi
ret 4
Function at 0x1003d230
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e637
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1006e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 4
cmovae eax, dword [ebp + 8]
push 0x10044884
push eax
call fcn.10008698
add esp, 0xc
test eax, eax
setns bl
push 0x10044890
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x1003d2d9
lea edx, [eax + 0x72]
push eax
test bl, bl
je 0x1003d2c0
push 0x8c
lea ecx, [edx + 0x19]
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push 0x73
mov ecx, 0x71
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push str.CLRCreateInstance
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1003d318
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8d
push 0x8c
mov ecx, 0x8b
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d38c
mov ecx, dword [ebp - 0x14]
call fcn.1003cfa0
jmp 0x1003d38a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d325
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x10044cec
push 0x10044cfc
call esi
test eax, eax
jns 0x1003d34c
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8e
jmp 0x1003d2f5
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x1003d369
mov eax, dword [ecx]
jmp 0x1003d36b
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.10001a20
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.1003d100
add esp, 0x18
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d3a4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x1003d3b6
inc eax
push eax
push dword [ebp + 8]
call fcn.100011f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003dcf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003dd03
test al, 0x10
jne 0x1003dd03
mov al, 1
ret
xor al, al
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0