joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b7a28
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6b7a30
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6b7c37
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.005c7630
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.0060d970
mov ebx, eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005c4ebc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x6b7c54
call fcn.0040b4c8
test bl, bl
jne 0x6b7ab7
xor eax, eax
push ebp
push 0x6b7aad
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0060decc
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.0060decc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b7ab7
push 0
mov eax, dword [ebp - 8]
call fcn.0040b278
mov ebx, eax
push ebx
mov eax, dword [0x6d78d0]
call fcn.0040b278
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x6b7ae8
mov eax, dword [0x6ceed8]
mov eax, dword [eax + 0x208]
call fcn.006b6f08
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6d3634]
push eax
push 0
mov ecx, 0x6b7c6c
mov edx, 0x6b7c70
xor eax, eax
call fcn.00414db8
mov dword [ebp - 0xc], eax
push 0x6b70cc
push 0xfffffffffffffffc
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x6d78fc], eax
xor eax, eax
push ebp
push 0x6b7bfb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.005c6fc8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x6b7c8c
call fcn.00424510
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
call fcn.005c6ea8
mov edx, dword [ebp - 0x34]
pop eax
call fcn.0040b470
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.006b6fb4
mov dword [ebp - 0x10], eax
call fcn.006b7090
test al, al
jne 0x6b7bdb
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6b7bb9
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b7c02
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x6b8ffc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6b92b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
mov edx, 0x6b92cc
call fcn.005b8268
push 5
mov eax, dword [0x6ceec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6b9279
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.006afe40
lea eax, [ebp - 0x10]
call fcn.005c74a8
mov eax, dword [ebp - 0x10]
call fcn.00424038
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005c6fc8
mov edx, dword [ebp - 0x14]
mov eax, 0x6d78d0
call fcn.0040a5a8
call fcn.006b729c
lea ecx, [ebp - 0x18]
mov edx, 0x6b92ec
mov eax, dword [0x6d78d0]
call fcn.005c4fa8
mov edx, dword [ebp - 0x18]
mov eax, 0x6d78d4
call fcn.0040a5a8
lea ecx, [ebp - 0x1c]
mov edx, 0x6b9304
mov eax, dword [0x6d78d0]
call fcn.005c4fa8
mov edx, dword [ebp - 0x1c]
mov eax, 0x6d78d8
call fcn.0040a5a8
push 2
push 0
push 1
mov ecx, dword [0x6d78d0]
mov dl, 1
mov eax, dword [0x5cb998]
call fcn.005cc2f4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6b9154
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005cc2b4
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005cc28c
cmp dword [ebp - 0xc], 0x67734d49
je 0x6b912f
mov cl, 1
xor edx, edx
mov eax, dword [0x6d78d8]
call fcn.005cd9f8
jmp 0x6b913e
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x6d78d0]
call fcn.005cd9f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b915b
mov eax, dword [ebp - 4]
call fcn.00408444
ret
Function at 0x6b9448
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b9585
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6b95a0
mov edx, ebx
call fcn.0040b4c8
mov eax, dword [ebp - 0x25c]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x6b955f
xor eax, eax
push ebp
push 0x6b9558
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6b95bc
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.004241b8
test eax, eax
jne 0x6b9529
test byte [ebp - 0x258], 0x10
jne 0x6b9529
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.0040b318
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b4c8
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6b9521
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00423a38
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6b94b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b955f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b958c
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040a228
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x6b95c8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6b96c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040a1c8
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005c5440
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6b96e0
call fcn.00424510
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x6b9666
test esi, 0x10
jne 0x6b9696
test esi, 1
je 0x6b9666
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x6b9690
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a5a8
jmp 0x6b96a3
inc edi
cmp edi, 0xa
je 0x6b96a3
inc ebx
cmp ebx, 0x3e8
jne 0x6b9607
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b96cd
lea eax, [ebp - 0x14]
call fcn.0040a1c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x1001b68
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b94
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001beb
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012e8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001bd5
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001beb
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001bf5
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003cc5
xor eax, eax
jmp 0x1001bf8
push 1
pop eax
pop esi
leave
ret

Function at 0x1001bfb
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
je 0x1001c07
push 2
pop eax
jmp 0x1001c0c
call fcn.01001b3e
cmp eax, 2
jne 0x1001c54
test byte [esp + 4], 4
je 0x1001c1d
push 6
pop eax
jmp 0x1001c34
push 4
push 0x40
push 0
push 0x10012c4
push 0x522
push 0
call fcn.01003cc5
cmp eax, 6
jne 0x1001c54
cmp word [0x100bc04], 0
jne 0x1001c4f
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1001c54
call fcn.01001b68
ret 4

Function at 0x1001c57
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a300], 0
je 0x1001c9a
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c9a
push 0x100a300
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1001e91
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
xor ebx, ebx
cmp byte [0x100a300], bl
je 0x1001f89
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f89
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x344]
push eax
push ebx
mov esi, 0x100a300
push ebx
push esi
mov dword [ebp - 8], 0x238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f7f
mov al, byte [0x10012c4]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001f3a
lea eax, [ebp - 0x10c]
push 0x10012c4
push eax
call fcn.01005a9b
lea eax, [ebp - 0x10c]
push 0x100ae84
push eax
lea eax, [ebp - 0x344]
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x1001f8c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10020b5
cmp byte [ebx], 0
je 0x10020b5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x104]
push 0x1001320
push eax
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10020b5
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x100205e
lea eax, [ebp - 0x218]
push 0x100131c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100208d
lea eax, [ebp - 0x218]
push 0x1001318
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100208d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x10012c4
push eax
call fcn.01005a9b
lea eax, [ebp - 0x104]
push eax
call fcn.01001f8c
jmp 0x100208d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001ff0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10020f2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100214f
lea eax, [ebp - 0x104]
push 0x1001324
push eax
call fcn.01005a9b
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x100214f
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1002155
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100219e
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1002195
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x10021a6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10021f3
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10021ea
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1002248
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002265
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002268
and eax, 0x10
ret 4

Function at 0x100239a
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
and byte [edi], 0
cmp byte [esi], 0x23
jne 0x1002466
movsx eax, byte [esi + 1]
inc esi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov esi, eax
je 0x1002466
cmp bl, 0x57
je 0x100245a
lea eax, [ebp - 0x108]
push 0x1001334
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.01005a9b
lea eax, [ebp + 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x108]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002470
lea eax, [ebp + 8]
push eax
push edi
push 0
push 0
push 0x10012c4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100244f
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002470
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1002470
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x100247d
push esi
push edi
call fcn.01005a9b
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002487
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x7c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
jle 0x10025df
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x80]
add eax, ebx
lea esi, [eax + ecx + 0x84]
mov eax, dword [eax + ecx + 0xbc]
lea eax, [eax + ebx + 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100239a
test eax, eax
je 0x10025f3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x10025b0
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x10025f3
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x10025f1
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10025a3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001368
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10025a3
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x10025a3
add esi, 0x10
push dword [esi - 0xc]
mov eax, dword [ebp - 0x10]
push dword [esi - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.01002630
push dword [esi]
mov dword [ebp + edi - 0x28], eax
mov eax, dword [ebp - 0x10]
push dword [esi - 4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.01002630
mov dword [ebp + edi - 0x30], eax
add edi, 4
add esi, 0x18
cmp edi, 8
jl 0x1002551
cmp dword [ebp - 0x28], 0
jl 0x1002597
cmp dword [ebp - 0x30], 0
jle 0x10025a3
cmp dword [ebp - 0x24], 0
jl 0x10025e8
cmp dword [ebp - 0x2c], 0
jg 0x10025e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
jmp 0x10025c8
mov eax, dword [ebp - 0xc]
add eax, esi
cmp dword [eax], edi
jne 0x10025f3
cmp dword [eax + 4], edi
jne 0x10025f3
cmp dword [eax + 0xc], edi
jne 0x10025f3
cmp dword [eax + 0x10], edi
jne 0x10025f3
inc dword [ebp - 8]
add dword [ebp + 8], 0x3c
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], 0x18
cmp eax, dword [ebx + 0x7c]
jl 0x10024ad
mov dword [ebp - 0x14], 1
jmp 0x10025f3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
mov dword [eax], ecx
je 0x1002609
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1002749
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1002772
mov al, byte [esi + 1]
inc esi
test al, al
je 0x100276a
cmp al, 0x22
jne 0x100275e
cmp byte [esi], 0x22
jne 0x100277c
inc esi
jmp 0x100277c
cmp al, 0x20
jle 0x100277c
inc esi
cmp byte [esi], 0x20
jg 0x1002776
mov al, byte [esi]
test al, al
je 0x1002789
cmp al, 0x20
jg 0x1002789
inc esi
jmp 0x100277c
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x10027a3
movzx eax, word [ebp - 0x14]
jmp 0x10027a6
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1002825
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b6dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100ade0
rep stosd dword es:[edi], eax
mov ecx, 0xcb
mov edi, 0x100aaa0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100b720
pop ecx
mov esi, 0x100adf4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013a4
mov dword [0x100b08c], edi
call fcn.01003e1f
cmp eax, ebx
je 0x1002a44
cmp eax, 0x80
ja 0x1002a44
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa7c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b6d4
push 0x1001398
call fcn.01003e1f
test eax, eax
je 0x10028e2
test byte [0x100b6d4], 0xc0
je 0x1002972
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001388
call fcn.01003e1f
test eax, eax
jne 0x1002901
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cc5
mov dword [0x100b704], 0x80070714
jmp 0x1002a54
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa80], eax
je 0x1002972
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002972
test byte [0x100b6d4], 0x80
je 0x1002941
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003cc5
jmp 0x1002957
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003cc5
cmp eax, 6
je 0x1002972
push dword [0x100aa80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100b704], 0x800700b7
jmp 0x1002a54
push dword [ebp + 0xc]
mov dword [0x100b824], ebx
call fcn.01005247
test eax, eax
jne 0x1002993
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1002a4e
cmp byte [0x100aaba], bl
je 0x10029aa
push 0x100aaba
call fcn.01001f8c
jmp 0x1002a54
push 0xa
push 0x100137c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10029cb
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2f8], ebx
je 0x10029d9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100aaa4], ebx
jne 0x1002a40
push dword [ebp - 4]
call fcn.01003149
test eax, eax
je 0x1002a54
mov ax, word [0x100bc04]
cmp ax, di
je 0x10029fe
cmp ax, 2
jne 0x1002a40
test byte [0x100b6d5], 1
je 0x1002a40
test byte [0x100aab8], 1
jne 0x1002a40
call fcn.01001600
test eax, eax
jne 0x1002a40
push 0x83e
push 0x547
push 0x100170a
push ebx
push 0x7d6
push dword [0x100b6dc]
call fcn.01005979
cmp eax, 0x83d
jne 0x1002a54
mov eax, edi
jmp 0x1002a56
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cc5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc