joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x580c2e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004e9c70
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x580c01
sub eax, ebx
jmp 0x580c03
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x580bf2
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x580c22
sub eax, ebx
jmp 0x580c24
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x580c13
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x580d02
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.00580930
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x580c79
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x580c8d
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x580bb6
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x580d02
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x580cd1
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x580cb4
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.004e9ba0
add esp, 0xc
add ebx, esi
pop esi
pop ebp
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x580d02
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x580ceb
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.004e9ba0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebp
pop ebx
ret
Function at 0x5c7670
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
jne 0x5c7681
xor eax, eax
jmp 0x5c77fb
push 0x48
mov eax, dword [ebp + 8]
push eax
call fcn.00594800
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c769f
xor eax, eax
jmp 0x5c77fb
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 5]
mov byte [ecx + 5], al
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005c7260
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c73c0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005c70d0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c7260
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005c70d0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c7260
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005c7670
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c70d0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005c70d0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], 0xffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 6]
mov byte [ecx + 6], al
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 7]
mov byte [ecx + 7], al
mov ecx, dword [ebp - 4]
mov byte [ecx + 8], 0
mov edx, dword [ebp - 4]
mov byte [edx + 9], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], 0xffffffff
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5de4d0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x5de4e8
xor eax, eax
xor edx, edx
jmp 0x5de521
mov dword [ebp - 8], 0
mov dword [ebp - 4], 4
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0x20000005
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x5de51d
mov eax, dword [ebp - 8]
xor edx, edx
jmp 0x5de521
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x5de630
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6500e8
push 0x4ea500
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x704dd8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x5de694
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
jmp 0x5de6cf
mov byte [ebp - 0x1a], 1
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x1a]
jmp 0x5de6cf
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5df0e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f0fc7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x704dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00402a30
movzx eax, al
test eax, eax
jne 0x5df131
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00401780
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.00401700
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00401760
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00401760
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00401760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5df1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f101a
mov eax, dword fs:[0]
push eax
sub esp, 0x638
mov eax, dword [0x704dd8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x644], ecx
mov eax, dword [ebp - 0x644]
mov dword [eax], 0
mov ecx, dword [ebp - 0x644]
add ecx, 8
call fcn.004028d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.004028d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x644]
add ecx, 0x40
call fcn.004028d0
mov byte [ebp - 4], 2
push 0x638a6b
mov ecx, dword [ebp - 0x644]
add ecx, 0x5c
call fcn.004016c0
mov byte [ebp - 4], 3
push 0
call fcn.005df0a0
add esp, 4
push eax
call fcn.004ecc92
add esp, 4
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x20a
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.004e9ba0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x5df320
cmp dword [ebp - 0x10], 0x104
ja 0x5df320
xor ecx, ecx
mov word [ebp - 0x1a], cx
xor edx, edx
mov word [ebp - 0x63c], dx
push 0x410
push 0
lea eax, [ebp - 0x63a]
push eax
call fcn.004e9ba0
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0x208
ja 0x5df2e4
cmp dword [ebp - 0x640], 0
jne 0x5df2fb
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402960
jmp 0x5df320
xor ecx, ecx
mov edx, dword [ebp - 0x640]
mov word [ebp + edx*2 - 0x63c], cx
lea eax, [ebp - 0x63c]
push eax
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402960
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402a30
movzx ecx, al
test ecx, ecx
jne 0x5df370
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.004021f0
sub eax, 1
push eax
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402a00
movzx edx, word [eax]
cmp edx, 0x5c
je 0x5df370
push 0x638b3c
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402980
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402a30
movzx eax, al
test eax, eax
je 0x5df398
push 0x638b40
mov ecx, dword [ebp - 0x644]
add ecx, 0x24
call fcn.00402960
mov ecx, dword [ebp - 0x644]
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e8c89
mov esp, ebp
pop ebp
ret
Function at 0x5e1180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5e11bb
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5e11c2
xor eax, eax
jmp 0x5e129d
push str.menu1.png
mov edx, dword [ebp + 8]
push edx
call fcn.004f189f
add esp, 8
test eax, eax
jne 0x5e11de
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5e1215
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x5e129d
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5e123b
cmp dword [ebp - 4], 0
jne 0x5e1253
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x5e129d
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e9c70
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.005e0e50
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x356b4848
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x8e61f83
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100082b2
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x1001588f
call fcn.100136c7
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x100083a3
cmp byte [esi + 0x49], bl
je 0x100083a3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x100082e7
xor al, al
jmp 0x100083a5
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.10007fd9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10008345
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x1000834a
dec eax
je 0x1000834e
dec eax
dec eax
je 0x1000839f
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002786
mov al, bl
jmp 0x100083a5
mov edx, dword [ebp - 0x2c]
jmp 0x10008310
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1000835a
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x10008381
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1000836d
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10008333
cmp byte [esi + 0x49], 0
je 0x1000839f
test edi, edi
jne 0x10008302
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10007de1
jmp 0x10008302
mov bl, 1
jmp 0x10008335
mov al, 1
call fcn.1001374a
ret

Function at 0x1000bc24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
push esi
push edi
call ebx
xor ecx, ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x1c], ecx
jg 0x1000bc56
jl 0x1000bc46
cmp dword [ebp + 0x18], ecx
jae 0x1000bc56
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x14
jmp 0x1000bc6e
push 0x14
mov dword [ebp - 8], ecx
pop eax
cmp dword [ebp + 0x1c], ecx
jg 0x1000bc6b
jl 0x1000bc68
cmp dword [ebp + 0x18], eax
jae 0x1000bc6b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000bcd3
xor edi, edi
cmp byte [ebp + 0x20], 0
mov esi, 0xf80001
je 0x1000bc93
mov esi, 0x4ff0001
push esi
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
je 0x1000bcc1
lea eax, [ebp - 0x28]
push eax
inc edi
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.user32.dll_DispatchMessageA]
cmp edi, 0x64
jl 0x1000bc93
cmp dword [ebp - 8], 0
jne 0x1000bc6e
call ebx
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x1000bc6e
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1000c752
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x1000c75f
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x1000ca62
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x10022df0]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.msvcr100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000cafb
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x1000cb3e
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x100195d2
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x1000cb25
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000cb3e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.msvcr100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013502
add ebp, 0x78c
leave
ret

Function at 0x1000cd3a
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x1000cd5b
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000cd5b
inc esi
mov eax, esi
pop esi
ret
Function at 0x1000d7ac
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10022df0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x10015f92
call fcn.10013691
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x1000d806
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100108bc
pop ecx
pop ecx
push ebx
push edi
call fcn.10013990
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000e5f7
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x1000d823
call fcn.1000e489
jmp 0x1000d825
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x1000d871
call fcn.1000e7cb
jmp 0x1000d871
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10013502
add ebp, 0x20c
leave
ret

Function at 0x1000d89b
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10022df0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x10015fc2
call fcn.10013691
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x1000d8f5
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100108bc
pop ecx
pop ecx
push ebx
push edi
call fcn.10013990
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000e5f7
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x1000d912
call fcn.1000e489
jmp 0x1000d914
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x1000d960
call fcn.1000e7cb
jmp 0x1000d960
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10013502
add ebp, 0x20c
leave
ret