joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f6e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [esi + 0x38]
shr eax, 1
test al, 1
jne 0x42f7f4
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00433a50
mov ebx, eax
mov eax, edx
mov dword [esp + 0xc], eax
test eax, eax
jne 0x42f736
cmp ebx, 1
jbe 0x42f7f4
push 0
push 0x1e
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00433a50
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
cmp ecx, edx
jb 0x42f777
ja 0x42f75b
cmp ebx, eax
jb 0x42f777
mov edx, ebx
mov eax, ecx
add edx, 0xffffffff
adc eax, 0xffffffff
cmp eax, dword [esp + 0x10]
jb 0x42f7f4
ja 0x42f777
cmp edx, dword [esp + 0x14]
jbe 0x42f7f4
mov eax, dword [esi + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esp + 0x18], ax
test ecx, ecx
jne 0x42f793
cmp ebx, 0x78
jb 0x42f7c0
push 0x462cdc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 8]
test eax, eax
je 0x42f7c0
push 0
push 0
push 0
push 0
push 0
push 0x40000004
push 0
push 4
push eax
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x42f7dd
push 0
push 0
push 0
push 0
push 0
push 0x40000003
push 0
push 4
push eax
call edi
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
push 0
add ecx, 0x20a
call fcn.00416520
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x42f811
push 0
push 0
push 0
push 0
push 0
push 0x400003e8
push 0
push 4
push eax
call edi
cmp dword [esi + 0x3c], 1
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x30], 0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
jne 0x42f884
cmp dword [esi + 0x108], 0
jne 0x42f876
cmp dword [esi + 0x120], 0
jne 0x42f876
cmp dword [esi + 0x138], 0
mov eax, 3
mov ecx, 6
cmovne eax, ecx
mov dword [esi + 0x34], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00433092
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov dword [esi + 0x34], 2
call fcn.0042f8a0
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00433092
mov esp, ebp
pop ebp
ret
Function at 0x42f8a0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0xa
jae 0x42f913
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea eax, [esi + 0x50]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x38]
shr eax, 1
test al, 1
je 0x42f8d2
mov eax, dword [esi + 0x140]
jmp 0x42f8d4
xor eax, eax
push eax
lea eax, [esi + 0x110]
push eax
lea eax, [esi + 0xf8]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c540
test al, al
je 0x42f90b
cmp dword [esi + 0x30], 0
jne 0x42f901
mov eax, dword [esi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, 1
mov dword [esi + 0x30], eax
jmp 0x42f92a
mov eax, dword [esi + 0x30]
mov dword [esi + 0x30], eax
jmp 0x42f92a
cmp dword [esi + 0x48], 0xa
jae 0x42f922
cmp dword [esi + 0x138], 0
jne 0x42f92a
lea ecx, [esi + 0x50]
call fcn.00416f30
cmp dword [esi + 0x108], 0
jne 0x42f945
cmp dword [esi + 0x120], 0
jne 0x42f945
cmp dword [esi + 0x138], 0
je 0x42f987
cmp dword [esi + 0x30], 0
je 0x42f95b
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x18]
jne 0x42f987
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x1c]
jne 0x42f987
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0044f190
test edx, edx
jne 0x42f987
cmp eax, 0x1d
jae 0x42f987
cmp dword [esi + 0x138], edx
je 0x42f9af
mov dword [esi + 0x34], 6
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [esi + 0x34], 3
test eax, eax
je 0x42f9af
push 0
push 0
push 0
push 0
push 0
push 0x400003fc
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fa90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x1e
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00433a50
mov ebx, edx
mov edi, eax
test ebx, ebx
jne 0x42facb
cmp edi, 1
jb 0x42fae2
push 0
push 0x1e
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00433a50
cmp edi, eax
jne 0x42faf0
cmp ebx, edx
jne 0x42faf0
mov eax, dword [esi + 0x38]
shr eax, 2
test al, 1
je 0x42fb96
push 0x1fe
lea eax, [esp + 0x16]
push 0
push eax
call fcn.00437ab0
mov eax, dword [esi + 0x10]
add esp, 0xc
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esp + 0x10], ax
test ebx, ebx
jne 0x42fb20
cmp edi, 0x78
jb 0x42fb51
push 0x462cdc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 8]
test eax, eax
je 0x42fb51
push 0
push 0
push 0
push 0
push 0
push 0x40000004
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [esi + 8]
test eax, eax
je 0x42fb72
push 0
push 0
push 0
push 0
push 0
push 0x40000003
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push 0
add ecx, 0x20a
call fcn.00416520
add esp, 4
test eax, eax
je 0x42fbb9
test ebx, ebx
jne 0x42fbb2
cmp edi, 0x78
jae 0x42fbb2
mov dword [esi + 0x34], 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00433092
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x34], 5
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00433092
mov esp, ebp
pop ebp
ret
Function at 0x42fd40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xf8]
push eax
push str.CanonPortO
call fcn.00430570
lea eax, [esi + 0x110]
push eax
push str.CanonPortN
call fcn.00430570
lea eax, [esi + 0x128]
push eax
push str.CanonPort
call fcn.00430570
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42fdd8
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Retreive
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fe23
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Mode
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fe6e
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.ExtFlag
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42fec0
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.BeforeDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ff12
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.RetreiveDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ff64
push 8
lea eax, [esp + 0x14]
push eax
push 0xb
push 0
push str.BeforeSendDate
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4303c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4531f9
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x46d4c0], 0
mov bl, byte [ebp + 8]
mov edi, dword [ebp + 0xc]
jne 0x430425
push 0x46d4c0
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x430425
push str.CanonIJPLMIJPLMAGR.EXE
push 0x46d4c0
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 8
lea ecx, [ebp - 0xf0]
call fcn.004027b0
mov eax, 0x462e30
mov dword [ebp - 4], 0
cmp bl, 1
lea ecx, [ebp - 0xe0]
mov edx, str.__D__W
cmovne edx, eax
call fcn.004098a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004026a0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x2c], 0
jb 0x430480
mov ecx, dword [eax]
jmp 0x430482
mov ecx, eax
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0041f660
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4304a7
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040d960
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test edx, edx
jne 0x4304ec
push 0x4625c4
lea ecx, [ebp - 0x38]
call fcn.0040f770
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
sub eax, esi
sar eax, 1
jne 0x4304e5
push str.invalid_vector_T__subscript
call fcn.004313d7
mov edx, esi
mov dword [ebp - 0x3c], edx
jmp 0x4304ef
mov esi, dword [ebp - 0x38]
push edi
mov ecx, 0x46d4c0
call fcn.00416650
add esp, 4
test eax, eax
setne bl
test esi, esi
je 0x430517
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0040d960
lea ecx, [ebp - 0x88]
call fcn.004026c0
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x88], vtable.std::ios_base.0
call fcn.00431449
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433092
mov esp, ebp
pop ebp
ret 8

Function at 0x430570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4305cf
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4305ab
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret 8
Function at 0x430800
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edx
mov dword [esp + 0x1c], ecx
nop dword [eax + eax]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0x80000002
movlpd qword [esp + 0x3c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430977
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push str.InstallDate
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call edi
test esi, esi
jne 0x430977
mov esi, dword [esp + 0x28]
mov eax, esi
mov edi, dword [esp + 0x2c]
or eax, edi
je 0x430977
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
test ebx, ebx
je 0x4308c0
mov dword [ebx], ecx
mov dword [ebx + 4], eax
cmp eax, edi
jb 0x430905
ja 0x4308ca
cmp ecx, esi
jbe 0x430905
sub ecx, esi
push 0xc9
push 0x2a69c000
sbb eax, edi
push eax
push ecx
call fcn.00433a50
mov ecx, eax
mov dword [esp + 0x20], eax
and ecx, edx
mov dword [esp + 0x24], edx
cmp ecx, 0xffffffff
je 0x430915
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, 1
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x430820
push 8
lea eax, [esp + 0x34]
push eax
push 0xb
push 0
push str.InstallDate
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call edi
jmp 0x430820
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareCanonIJPLM
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430a4e
lea eax, [ebp - 0x128]
mov dword [ebp - 0x120], 0x270f
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x128], 4
push eax
push ebx
push str.UnsupportMajor
push dword [ebp - 0x11c]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 0x12c]
push eax
cmove edi, dword [ebp - 0x120]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push str.UnsupportMinor
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x11c]
test eax, eax
cmove ebx, dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00437ab0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x430aae
cmp dword [ebp - 0x108], 2
jne 0x430aae
mov eax, dword [ebp - 0x114]
cmp eax, edi
ja 0x430aae
jne 0x430a9c
cmp dword [ebp - 0x110], ebx
jae 0x430aae
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00433092
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.00433092
mov esp, ebp
pop ebp
ret

Function at 0x430b70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x430bd7
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 1
xorps xmm0, xmm0
push str.D:_A_OICI_GWGRSDDTDC___BU__A_OICI_GWGRSDDTDC___AU__A_OICI_GA___BA__A_OICI_GA___SY_
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x430bbf
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], eax
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x430bd7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430bf0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
call fcn.004310b0
test eax, eax
jne 0x430cdb
push 0x20a
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00437ab0
push 0x20a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00437ab0
add esp, 0x18
mov dword [ebp - 0x440], esi
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movaps xmmword [ebp - 0x460], xmm0
movaps xmmword [ebp - 0x450], xmm0
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x430cdb
lea eax, [ebp - 0x218]
push eax
push str._skernel32.dll
lea eax, [ebp - 0x428]
push 0x105
push eax
call fcn.00431150
add esp, 0x10
xor eax, eax
mov ecx, str.KERNEL32.DLL
mov word [ebp - 0x220], ax
call fcn.00401160
mov edi, eax
test edi, edi
je 0x430cdb
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x430cd4
lea ecx, [ebp - 0x460]
push ecx
call eax
movzx esi, word [ebp - 0x460]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov ax, si
pop edi
xor ecx, ebp
pop esi
call fcn.00433092
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4310b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00437ab0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x43111e
cmp dword [ebp - 0x114], 5
jne 0x43111e
cmp dword [ebp - 0x110], 0
jne 0x43111e
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00433092
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00433092
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0xa883515
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x68cc72a8
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x100c205
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100c25e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100c250
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100c24c
cmp esi, eax
jae 0x100c250
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100c23e
cmp esi, eax
jb 0x100c254
xor eax, eax
jmp 0x100c25d
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x100cec3
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
call fcn.0100c8e5
test eax, eax
jl 0x100cf0a
cmp dword [edi], 0
je 0x100cf0a
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x10016a0
push 0x2022
mov esi, 0x10309f8
push esi
call fcn.0101b56c
mov ecx, dword [edi]
add esp, 0x10
push esi
push 1
call fcn.01019121
pop esi
pop edi
pop ebp
ret 8

Function at 0x100cf14
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0x1020a41
call fcn.0101aff0
mov edi, ecx
push 0x1044e10
lea ecx, [ebp - 0x14]
call fcn.0100c75d
push 1
xor esi, esi
push 0x1001798
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0100ca9a
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x100cf6e
cmp dword [edi], esi
je 0x100d01c
push 0x10014c8
push 0x2022
mov esi, 0x10309f8
push esi
call fcn.0101b56c
add esp, 0xc
jmp 0x100d012
push 0x80020003
push 1
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov ebx, 0x2022
mov esi, 0x10309f8
test eax, eax
jne 0x100cfef
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x10], eax
call fcn.0101d57a
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x100cfb1
and eax, 0xffff
or eax, 0x80070000
cmp dword [edi], 0
mov dword [ebp - 0x10], eax
je 0x100cfef
push eax
push 0x1001748
push ebx
push esi
call fcn.0101b56c
mov ecx, dword [edi]
add esp, 0x10
push esi
push 3
call fcn.01019121
cmp dword [edi], 0
je 0x100cfef
push dword [ebp - 0x14]
push ebx
push esi
call fcn.0101b56c
mov ecx, dword [edi]
add esp, 0xc
push esi
push 3
call fcn.01019121
push 0
push 0x1001798
mov ecx, edi
call fcn.0100ca9a
cmp dword [edi], 0
je 0x100d01c
push eax
push 0x10016e8
push ebx
push esi
call fcn.0101b56c
add esp, 0x10
mov ecx, dword [edi]
push esi
push 3
call fcn.01019121
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100c3dc
mov eax, dword [ebp - 0x10]
call fcn.0101b0dc
ret