joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c8b0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1003e358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x1004f0a0]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
push 0
push 0x40000001
push 3
push 0
push 3
push 0xc0000000
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x1000c9d8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x1000c9d8
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, eax
push edx
and ecx, 0x7fffff
mov edx, dword [esp + 0x40]
shl ecx, 9
shr eax, 0x17
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
shl ecx, 9
push eax
push ecx
push edx
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000c96a
call ebx
cmp eax, 0x3e5
jne 0x1000c9d1
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000c99d
call ebx
cmp eax, 0x3e5
jne 0x1000c9d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
jbe 0x1000c9e4
call fcn.10026745
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10026745
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1000cf20
Capabilities:
Get disk information

Disassembly:
sub esp, 0xb4
mov eax, dword [0x1004e230]
mov dl, byte [esp + 0xb8]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
add al, dl
mov dword [esp + 8], ecx
push ebx
mov dword [esp + 0x10], ecx
mov byte [esp + 4], al
push esi
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x28]
push 0x14
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
push 0x80
lea edx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1000cf92
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
xor al, al
pop ebx
add esp, 0xb4
ret 4
mov esi, str.NTFS
lea eax, [esp + 0x28]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cfc3
test cl, cl
je 0x1000cfbf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cfc3
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cf9b
xor eax, eax
jmp 0x1000cfc8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000cfd9
pop esi
mov al, 7
pop ebx
add esp, 0xb4
ret 4
mov esi, str.FAT32
lea eax, [esp + 0x28]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000d00a
test cl, cl
je 0x1000d006
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000d00a
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cfe2
xor eax, eax
jmp 0x1000d00f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000d020
pop esi
mov al, 0xc
pop ebx
add esp, 0xb4
ret 4
mov esi, str.FAT16
lea eax, [esp + 0x28]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000d063
test cl, cl
je 0x1000d04d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000d063
add eax, 2
add esi, 2
test cl, cl
jne 0x1000d029
xor eax, eax
pop esi
test eax, eax
setne al
dec eax
pop ebx
and eax, 6
add esp, 0xb4
ret 4
sbb eax, eax
pop esi
sbb eax, 0xffffffff
pop ebx
test eax, eax
setne al
dec eax
and eax, 6
add esp, 0xb4
ret 4

Function at 0x1000d080
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1004e230]
xor ecx, ecx
mov dl, byte [esp + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov dword [esp + 0x14], ecx
push 0
mov dword [esp + 0x1c], ecx
mov cl, al
add cl, dl
lea eax, [esp + 4]
mov byte [esp + 0xc], cl
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000d0c8
add esp, 0x1c
ret 4
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, 9
call fcn.10014b90
shr eax, 0xb
add esp, 0x1c
ret 4
Function at 0x1000e770
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1003e551
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x1004f0a0]
mov dword [esp + 8], ecx
lea edx, [esp + 0x20]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x130], 0
call fcn.100268ce
lea eax, [esp + 8]
push str._bootstat.dat
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.100269da
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x130], 1
call fcn.1002687e
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 0
call fcn.10026745
mov edx, dword [esp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 3
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e88d
push esi
lea ecx, [esp + 0x14]
call fcn.1002bbc9
push 0
push 0xb
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 2
call fcn.1002bee7
lea eax, [esp + 7]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.1002be62
test eax, eax
je 0x1000e86c
push 0
push 0xb
lea ecx, [esp + 0x18]
mov byte [esp + 0xf], 1
call fcn.1002bee7
lea ecx, [esp + 7]
push 1
push ecx
lea ecx, [esp + 0x18]
call fcn.1002be9c
lea ecx, [esp + 0x10]
call fcn.1002bf60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 0
call fcn.1002bc88
lea ecx, [esp + 8]
mov dword [esp + 0x12c], 0xffffffff
call fcn.10026745
mov ecx, dword [esp + 0x124]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x12c
ret
Function at 0x10010760
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x1003e8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1004f0a0]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
push 0xf003f
push 0
push 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x100107b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x14]
push str.Failed_to_open_service_manager_d
push ecx
jmp 0x10010808
mov ecx, esi
call fcn.100108a0
push 0x100f003f
push str.VDisk_kernel_code
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10010836
call ebp
push eax
lea edx, [esp + 0x14]
push str.Failed_to_open_service__d
push edx
call fcn.1002289c
add esp, 0xc
push edi
call ebx
test eax, eax
jne 0x1001086e
call ebp
push eax
lea edx, [esp + 0x14]
push str.Failed_to_close_service_manager__d
push edx
call fcn.1002289c
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10026745
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10010854
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push str.Failed_to_delete_service__d
push eax
jmp 0x10010808
push esi
call ebx
test eax, eax
jne 0x100107f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x14]
push str.Failed_to_close_service_manager__d
push ecx
jmp 0x10010808
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10026745
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100108a0
Capabilities:
Access peb ldr_data
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x1003e918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x1004f0a0]
push ebp
push edi
mov ebp, ecx
mov dword [esp + 8], eax
push 0xf003f
push 0
push 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x1001091d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xc]
push str.Failed_to_open_service_manager_d
push ecx
call fcn.1002289c
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.10026745
pop edi
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebx
push esi
push 0x100f003f
push str.VDisk_kernel_code
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10010951
call ebx
push eax
lea edx, [esp + 0x14]
push str.Failed_to_open_service__d
push edx
call fcn.1002289c
add esp, 0xc
mov ecx, ebp
call fcn.100109f0
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1001097f
call ebx
push eax
lea ecx, [esp + 0x14]
push str.Failed_to_stop_service_manager_d
push ecx
call fcn.1002289c
add esp, 0xc
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x100109a5
push esi
call ebp
test eax, eax
jne 0x100109a5
call ebx
push eax
lea edx, [esp + 0x14]
push str.Failed_to_close_driver_service__d
push edx
call fcn.1002289c
add esp, 0xc
push edi
call ebp
test eax, eax
jne 0x100109c1
call ebx
push eax
lea eax, [esp + 0x14]
push str.Failed_to_close_service_manager__d
push eax
call fcn.1002289c
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.10026745
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x10011450
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x1003e9bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x1004f0a0]
mov dword [esp], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x220], 0
mov dword [esp + 0x14], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x10]
lea ecx, [esp]
push eax
call fcn.100268f5
mov ecx, dword [esp]
push str.SYSTEM
push ecx
call fcn.10014955
add esp, 8
test eax, eax
jne 0x100114e9
lea ecx, [esp]
mov dword [esp + 0x218], 0xffffffff
call fcn.10026745
mov eax, 1
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push 1
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x1001152b
lea ecx, [esp]
mov dword [esp + 0x218], 0xffffffff
call fcn.10026745
xor eax, eax
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret
mov eax, dword [esp + 4]
push esi
push eax
cmp dword [eax + 0xc], 2
sete cl
mov byte [esp + 0x10], cl
call sub.NETAPI32.dll_NetApiBufferFree
mov esi, dword [esp + 0xc]
lea ecx, [esp + 4]
and esi, 0xff
mov dword [esp + 0x21c], 0xffffffff
call fcn.10026745
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x10011b30
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10011b5b
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x2c]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10011b87
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 4
lea ecx, [esp + 0xc]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10011bb4
push eax
push str.UnInstall
push str.Driver_can_not_unloaded_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10011bb6
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x1c
ret 4

Function at 0x10011bd0
Capabilities:
Delete service

Disassembly:
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10011bf9
push str.OpenSCManager_Failed__n
call fcn.10014a9e
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0xf01ff
push str.MSPx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10011c29
push str.Could_not_unload_MSPx__n
call fcn.10014a9e
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x10012e50
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10012e77
push eax
push eax
push str.OpenProcessToken_failed_
call fcn.10033365
push esi
lea ecx, [esp + 0xc]
push edi
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
lea edx, [esp + 0x14]
push 0
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x10012ecf
push 0
push 0
push str.AdjustTokenPrivileges_enable_failed_
call fcn.10033365
push 1
push 1
push 0
push 0x1004ec88
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x10012ef2
push eax
push eax
push str.InitiateSystemShutdown_failed.
call fcn.10033365
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push edx
mov dword [esp + 0x30], 0
call esi
call edi
pop edi
pop esi
test eax, eax
je 0x10012f24
push 0
push 0
push str.AdjustTokenPrivileges_disable_failed.
call fcn.10033365
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x10013120
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1003ec1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 5
mov esi, str.SOFTWAREEzBACK_plus
lea edi, [esp + 0x1c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x7a
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x1004f0a0]
mov esi, 0x200
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0x20019
push 0
push edx
push 0x80000002
mov dword [esp + 0x238], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100131cc
push eax
lea eax, [esp + 0x10]
push str.Failed_to_open_registery_error_code_x_n
push eax
call fcn.1002289c
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 0xffffffff
call fcn.10026745
xor eax, eax
jmp 0x1001328e
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push 0
push str.Installer_Path
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10013238
push eax
lea edx, [esp + 0x10]
push str.Failed_to_open_RegQueryValueExA_error_code_x_n
push edx
call fcn.1002289c
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 0xffffffff
call fcn.10026745
xor eax, eax
jmp 0x1001328e
lea edi, [ebx + 0x70]
push 0x100510a4
mov ecx, edi
call fcn.100268ce
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jbe 0x1001326a
mov al, byte [esp + esi + 0x1c]
test al, al
je 0x10013261
push eax
mov ecx, edi
call fcn.10026b48
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x10013251
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 0xffffffff
call fcn.10026745
mov eax, 1
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x1001ad10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1004ffd0
cmp edx, dword [eax]
je 0x1001ad32
add eax, 8
inc ecx
cmp eax, 0x10050060
jl 0x1001ad23
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1004ffd0]
jne 0x1001ae60
mov eax, dword [0x10054a88]
cmp eax, 1
je 0x1001ae3a
test eax, eax
jne 0x1001ad63
cmp dword [0x10054a8c], 1
je 0x1001ae3a
cmp edx, 0xfc
je 0x1001ae60
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001ad9a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1001c090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1001b2a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1001addd
lea eax, [ebp - 0x1a4]
push eax
call fcn.1001b2a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100451a8
push edi
call fcn.10019b70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1001c090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1001c0a0
lea eax, [ebp - 0xa0]
push 0x10045188
push eax
call fcn.1001c0a0
push dword [esi + 0x1004ffd4]
lea eax, [ebp - 0xa0]
push eax
call fcn.1001c0a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1001d795
add esp, 0x2c
pop edi
jmp 0x1001ae60
lea eax, [ebp + 8]
lea esi, [esi + 0x1004ffd4]
push 0
push eax
push dword [esi]
call fcn.1001b2a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10027e6c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10027ea4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10026bec
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10026bc4
jmp 0x10027eb0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10029c6e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10029cb0
call fcn.1003bd26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10029cb0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10029ca7
xor eax, eax
jmp 0x10029cb8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10029cbe
pop edi
pop esi
pop ebx
ret 4
Function at 0x100310a7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1003f974
call fcn.10014d58
push ecx
push ecx
push esi
push 0x10
call fcn.10026e16
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x100310f4
mov ecx, esi
call fcn.1002d5e1
mov eax, dword [0x1004f0a0]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.100268ce
jmp 0x100310f6
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x1004a598
push eax
mov dword [ebp - 0x10], esi
call fcn.1001547a
pop esi

Function at 0x1003b4d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.1003bd26
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1003b510
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003b510
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x1003b514
xor eax, eax
jmp 0x1003b592
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.10026e16
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x1003b54c
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x1003b536
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.1003b697
push ebx
mov edi, eax
call fcn.10026e3f
test edi, edi
pop ecx
je 0x1003b58e
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.1003b3e9
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.1003b597
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x403508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403517
pop dword [ebp - 0x28]
mov eax, 0x403517
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xdced9273
sub dword [ebp - 0x38], 0x8e9b4d28
mov dword [ebp - 0x34], 0x9be9db8b
add dword [ebp - 0x34], 0x964970ba
mov dword [ebp - 0x30], 0x9b1a250e
add dword [ebp - 0x30], 0xb1321f20
mov dword [ebp - 0x2c], 0x4f51ddd5
sub dword [ebp - 0x2c], 0x4f51ddd5
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb9b7c2e3
add dword [ebp - 0x38], 0xbabaa673
mov dword [ebp - 0x34], 0x57abc847
sub dword [ebp - 0x34], 0x163f66d2
mov dword [ebp - 0x30], 0x2be25a52
add dword [ebp - 0x30], 0x378d121a
mov dword [ebp - 0x2c], 0x4c0a1e93
add dword [ebp - 0x2c], 0xb3f5e16d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa8fb65b6
add eax, 0x57456a92
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a81c
push 0
call eax
mov ecx, 0x6d959bfa
sub ecx, 0x6d95500f
mov ebx, eax
mov esi, 0xf195b801
sub esi, 0xf1540801
add esi, dword [ebp - 0x28]
mov edi, 0x48842534
add edi, 0xc0a42483
add dword [ebp - 0x20], 0x12bf1c4e
mov edx, dword [esi]
xor dword [ebp - 0x18], ecx
add edx, edi
mov dword [ebp - 0x18], 0x155b08a6
mov dword [ebx], edx
add ebx, 0xc88e7975
sub ebx, 0xc88e7971
add esi, 0x699ee5c3
sub esi, 0x699ee5bf
loop 0x40362f
add eax, 0xb9780b68
add eax, 0x46891717
mov ebx, eax
add eax, 0xc48d1894
sub eax, 0xc48d188f
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret