joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103bf7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x103bfb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x103bfab
mov esi, eax
jmp 0x103c065
and eax, 0xffff
or eax, 0x80070000
jmp 0x103bfa4
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x103bfe0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103bfdc
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x103c056
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x103bff5
mov esi, 0x80004005
jmp 0x103c055
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x103c01b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103c053
and eax, 0xffff
or eax, 0x80070000
jmp 0x103c053
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x103c005
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x103c005
push esi
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x14]
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
pop edi
cmp dword [ebp + 0x10], 0
je 0x103c065
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jge 0x103c074
test ebx, ebx
je 0x103c074
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x104276f
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x10427ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1042832
lea ecx, [ebp - 0x10]
push ecx
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x10427cf
call edi
test eax, eax
jne 0x1042806
cmp dword [ebp - 0x10], ebx
je 0x10427d8
push 0x18
jmp 0x104281e
mov eax, dword [ebp + 8]
push ebx
push ebx
push ebx
push 8
push ebx
push dword [ebp - 0xc]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1042806
push ebx
push ebx
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
cmp eax, ebx
jne 0x104280a
call edi
jmp 0x1042832
push dword [esi + 4]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x1042821
push 8
pop edi
jmp 0x1042851
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp + 8], eax
call edi
cmp dword [ebp + 8], ebx
jne 0x1042836
mov edi, eax
jmp 0x1042851
push dword [esi + 4]
push dword [esi]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
mov eax, dword [esi]
cmp eax, ebx
je 0x1042860
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x1042870
push dword [ebp - 8]
call esi
cmp byte [ebp - 1], bl
je 0x104287a
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1042888
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x800
push 8
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10428b2
push 0xe
pop edi
jmp 0x1042945
push esi
mov esi, 0x400
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x104292d
cmp eax, esi
jae 0x104292d
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.0104276f
mov edi, eax
test edi, edi
jne 0x1042935
lea edi, [esi + 0x10]
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x10428f1
push 0x6e
jmp 0x104290a
and dword [ebp - 4], 0
push dword [ebp - 4]
mov ecx, dword [esi + 4]
mov eax, dword [edi]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x18]
test eax, eax
je 0x104290d
push 0x19
pop edi
jmp 0x1042935
push 0
add esi, 0xc
push esi
push 0x1016668
call sub.XmlLite.dll_CreateXmlReader
test eax, eax
jne 0x1042933
mov eax, dword [esi]
push dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x1042933
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
push 0
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x104c0b9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push 0
push dword [ebp + 0x10]
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x104c0f9
mov dword [ebp + 8], 0x8007000e
jmp 0x104c18b
push ebx
push esi
push edi
mov esi, 0x104
push esi
push eax
push dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jbe 0x104c117
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
ja 0x104c145
call ebx
test eax, eax
je 0x104c139
jle 0x104c13e
and eax, edi
or eax, esi
jmp 0x104c13e
mov eax, 0x80004005
mov dword [ebp + 8], eax
test eax, eax
jl 0x104c176
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jbe 0x104c160
and dword [ebp + 8], 0
jmp 0x104c176
call ebx
test eax, eax
je 0x104c16e
jle 0x104c173
and eax, edi
or eax, esi
jmp 0x104c173
mov eax, 0x80004005
mov dword [ebp + 8], eax
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 8]
leave
ret 0xc
Function at 0x104d6ae
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0xfffffffffffffff5
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x104d7f7
cmp ebx, edi
je 0x104d7f7
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0104d626
mov esi, eax
test esi, esi
jl 0x104d825
push ebx
call fcn.0104dbc4
test eax, eax
je 0x104d73a
push dword [ebp - 4]
push dword [ebp + 0xc]
push ebx
call fcn.0104d4ec
test eax, eax
je 0x104d716
xor esi, esi
jmp 0x104d825
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x104d72e
jle 0x104d733
and eax, 0xffff
or eax, 0x80070000
jmp 0x104d733
mov eax, 0x80004005
mov esi, eax
jmp 0x104d825
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push 2
pop ecx
inc eax
mul ecx
push edx
push eax
call fcn.0101b8f5
mov esi, eax
test esi, esi
jl 0x104d825
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x104d77a
mov esi, 0x8007000e
jmp 0x104d811
push edi
push dword [ebp + 0xc]
mov byte [edi], 0
call dword [sym.imp.USER32.dll_CharToOemW]
mov ebx, 0x80070000
test eax, eax
jne 0x104d7b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x104d7a5
jle 0x104d7aa
and eax, 0xffff
or eax, ebx
jmp 0x104d7aa
mov eax, 0x80004005
mov esi, eax
test eax, eax
jl 0x104d811
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push edi
call fcn.0104d55b
mov esi, eax
test esi, esi
jl 0x104d811
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x104d811
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x104d7f0
jle 0x104d80f
and eax, 0xffff
or eax, ebx
jmp 0x104d80f
mov eax, 0x80004005
jmp 0x104d80f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x104d733
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x104d825
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x104e702
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x3a
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x104e757
mov dword [ebp - 0x1c], 0x8007000e
jmp 0x104e83c
push esi
push 8
push ebx
push 0x1e
xor eax, eax
mov esi, 0x400
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x104e78a
push ebx
push 8
lea eax, [ebp - 0x14]
push eax
call fcn.0101bc13
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x104e82b
push dword [ebp - 0x18]
push esi
push ebx
call fcn.0101bc13
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x104e82b
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
lea eax, [ebp - 0x14]
push eax
push ebx
call esi
and dword [ebp - 0x18], 0
pop ecx
pop ecx
lea edi, [ebp - 0x2c]
test eax, eax
je 0x104e7dd
push edi
push eax
call fcn.0104e690
inc dword [ebp - 0x18]
add edi, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x104e82b
lea eax, [ebp - 0x14]
push eax
push 0
call esi
cmp dword [ebp - 0x18], 3
pop ecx
pop ecx
jb 0x104e7b5
mov eax, dword [ebp - 0x18]
dec eax
je 0x104e820
dec eax
je 0x104e80b
dec eax
je 0x104e7f2
mov dword [ebp - 0x1c], 0x80070057
jmp 0x104e82b
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x64], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x24]
jmp 0x104e81a
mov cx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x66], cx
mov cx, word [ebp - 0x28]
mov word [eax + 0x68], cx
jmp 0x104e82b
mov ax, word [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov word [ecx + 0x68], ax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101ca75
leave
ret 8
Function at 0x1050206
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 6
xor ebx, ebx
pop ecx
mov eax, 0x1000000
push 0x104
mov dword [0x1058010], eax
mov dword [0x1058538], eax
xor eax, eax
push ebx
mov edi, 0x1058540
push 0x1058558
mov byte [0x1058b88], bl
mov dword [0x10579e0], ebx
mov dword [0x10579e4], ebx
mov dword [0x1058014], ebx
mov dword [0x105853c], ebx
rep stosd dword es:[edi], eax
call sub.msvcrt.dll_memset
push 0x1017d8c
call fcn.01050196
add esp, 0x10
push 0x400
mov esi, 0x1058660
push esi
push 0x1017d7c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 1
jge 0x1050284
mov byte [0x1058660], bl
push esi
push 0x1017d68
call fcn.01050196
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x105832c], eax
cmp eax, ebx
jne 0x10502b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1017d40
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
xor eax, eax
jmp 0x1050332
push ebx
push esi
push eax
call dword [sym.imp.dbghelp.dll_SymInitialize]
cmp eax, ebx
jne 0x10502d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1017d1c
jmp 0x10502ac
push 0x10813
call dword [sym.imp.dbghelp.dll_SymSetOptions]
push eax
push 0x1017d0c
mov dword [0x1057bfc], eax
call fcn.01050196
pop ecx
pop ecx
push ebx
push ebx
push 0x10501dd
push dword [0x105832c]
call dword [sym.imp.dbghelp.dll_SymRegisterCallback64]
mov esi, eax
cmp esi, ebx
jne 0x1050317
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1017ce0
jmp 0x10502ac
call fcn.0104f7f0
cmp dword [0x105800c], ebx
jne 0x1050330
push 0x1017c98
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10503d9
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x810], 0x1000000
mov dword [ebp - 0x818], ebx
cmp byte [esi], bl
jne 0x1050420
push 0x1018118
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
jmp 0x1050564
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x804]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push ebx
push ebx
push esi
call sub.msvcrt.dll__splitpath_s
add esp, 0x24
cmp byte [ebp - 0x804], bl
jne 0x1050467
mov eax, dword [0x1058010]
mov dword [ebp - 0x80c], eax
mov eax, dword [0x1058014]
mov dword [ebp - 0x814], 1
jmp 0x10504ab
lea eax, [ebp - 0x804]
push 0x1018110
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
pop ecx
pop ecx
test eax, eax
jne 0x105049b
mov eax, dword [0x1058010]
mov dword [ebp - 0x80c], eax
mov eax, dword [0x1058014]
mov dword [ebp - 0x818], 1
jmp 0x10504ab
mov eax, dword [0x1058538]
mov dword [ebp - 0x80c], eax
mov eax, dword [0x105853c]
push ebx
mov dword [ebp - 0x808], eax
call fcn.0105033b
lea eax, [ebp - 0x404]
push eax
push edi
push 0x1058b88
call sub.msvcrt.dll_strcpy_s
add esp, 0xc
cmp dword [ebp - 0x818], ebx
jne 0x10504f8
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x810], eax
jmp 0x10504fa
mov edi, ebx
push dword [ebp - 0x814]
lea eax, [ebp - 0x404]
push ebx
push dword [ebp - 0x810]
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
push eax
push esi
push edi
push dword [0x105832c]
call dword [sym.imp.dbghelp.dll_SymLoadModuleEx]
mov ecx, eax
or ecx, edx
jne 0x105054c
push esi
mov byte [0x1058b88], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10180f8
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
jmp 0x1050563
mov dword [0x10579e0], eax
mov dword [0x10579e4], edx
cmp edi, 0xffffffff
je 0x1050563
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0101ca75
leave
ret 4
Function at 0x1051726
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1059998], edi
jne 0x1051842
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x105178d
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1059998], edi
pop esi
je 0x1051815
dec eax
jne 0x1051842
cmp dword [ebp - 0x11c], 5
jne 0x1051802
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x10517f6
dec eax
je 0x10517e3
dec eax
je 0x10517c9
mov dword [0x1059998], 0x14
jmp 0x1051842
cmp word [ebp - 0xc], 1
jb 0x10517da
mov dword [0x1059998], 0x10
or dword [0x1059998], 4
jmp 0x1051842
cmp word [ebp - 0xc], 2
jb 0x10517da
mov dword [0x1059998], 8
jmp 0x10517da
mov dword [0x1059998], 4
jmp 0x1051842
cmp dword [ebp - 0x11c], 4
ja 0x1051854
mov dword [0x1059998], 2
cmp dword [ebp - 0x11c], 4
jne 0x1051842
cmp dword [ebp - 0x118], edi
je 0x1051838
cmp dword [ebp - 0x118], 0xa
je 0x1051838
cmp dword [ebp - 0x118], 0x5a
jne 0x1051842
mov dword [0x1059998], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1059998]
xor ecx, ebp
pop edi
call fcn.0101ca75
leave
ret
mov dword [0x1059998], 0x20
jmp 0x1051842

Function at 0x1051865
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10518b9
push 3
lea eax, [ebp - 0x44]
push 0x1018c78
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0101ca75
leave
ret

Function at 0x10518ce
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x105999c]
jne 0x1051969
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1018ba8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1051968
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1018c60
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1051968
push 3
push dword [esi*8 + 0x10189f8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x105195a
inc esi
cmp esi, 0x1c
jb 0x1051939
jmp 0x1051968
mov ax, word [esi*8 + 0x10189fc]
mov word [0x105999c], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x105999c]
xor ecx, ebp
call fcn.0101ca75
leave
ret
Function at 0x108535d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp], 0xffffffff
je 0x1085361
lea esp, [esp - 0x30]
pushal
lea esp, [esp + 0x24]
call fcn.010854e3
lea edi, [esp - 4]
xchg dword [edi], ebx
dec ebx
movzx ecx, bx
loop 0x108537f
mov bx, cx
push dword [ebx + 0x3c]
pop ecx
sub ecx, 0x7ffffffe
jae 0x108537b
sbb ecx, 0x1191
jno 0x108537b
dec edx
not dl
dec edx
mov ecx, dword [ecx + ebx - 0x7fffee70]
xor ecx, 0x4550
jne 0x108537b
inc edx
sbb dh, dl
dec edi
push 0x416bea6e
call fcn.01085502
mov dword [esp + 0x44], esi
call fcn.0108528c
mov dword [esp + 0x34], eax
sub eax, 4
jb 0x1085538
mov eax, dword fs:[0x18]
or eax, eax
js 0x10853e9
test dh, 0x33
dec ecx
mov eax, dword [eax + 0x34]
jmp 0x10853f5
push 0x366ee1ec
call fcn.01085502
call esi
add al, 0
jmp 0x108551d
jne 0x1085528
and al, 0xff
dec cl
call fcn.01085320
push 0x4a106ae8
call fcn.01085502
push dword [esp + 0x34]
call esi
pop edi
pop esi
pop ebp
mov ebx, dword [esp + 4]
add esp, 8
pop edx
pop ecx
pop eax
ret 0x2c

Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10
Function at 0x30096d71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30096de0
mov eax, dword [ebp + 8]
test eax, 3
je 0x30096da2
cmp word [eax], 0
je 0x30096d9b
lea eax, [eax + 2]
test eax, 3
jne 0x30096d89
jmp 0x30096da2
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30096ddd
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30096da2
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30096ddd
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30096ddd
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30096da2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0xf5c0096
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x693208bc
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219