joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10031040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov esi, ebx
and esi, 0xfffffffe
mov dword [ebp - 0x10], esi
jne 0x1000a763
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000afae
mov esp, ebp
pop ebp
ret
not bl
mov dword [ebp - 0xc], 0
and bl, 1
je 0x1000a790
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 8]
call dword [0x10032558]
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x1000a7a2
push esi
push dword [ebp + 8]
push 1
push edx
call fcn.10017e0e
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
test bl, bl
je 0x1000a7de
mov dword [ebp - 8], 0
push 1
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [0x10032560]
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000afae
mov esp, ebp
pop ebp
ret
push 1
push 0
push esi
call fcn.1001147a
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
call fcn.1000afae
mov esp, ebp
pop ebp
ret
Function at 0x1000adae
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1000add5
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1000add8
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1000ad8a
pop esi
leave
ret 8

Function at 0x1001097c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100260e0
mov eax, dword [0x10031040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1001aee9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100109be
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10010b1a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10026030
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100320a0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1001b572
mov ecx, dword [esi*4 + 0x100320a0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10010b13
cmp eax, dword [ecx + edi + 0x24]
jne 0x10010b13
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010b13
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001b572
add esp, 0x14
test edx, edx
jl 0x10010b13
jg 0x10010a89
test eax, eax
jb 0x10010b13
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10010b13
jl 0x10010aa3
cmp dword [ebp - 0x1008], eax
ja 0x10010b13
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10010ac1
test ebx, ebx
je 0x10010afa
cmp ecx, edi
jae 0x10010afa
mov al, byte [ecx]
cmp al, 0xd
jne 0x10010adb
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10010ae7
cmp byte [ecx + 1], 0xa
jne 0x10010ae7
inc ecx
jmp 0x10010ae7
movzx eax, al
movsx eax, byte [eax + 0x10031280]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10010ac1
cmp edx, ebx
jne 0x10010ac1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10010b18
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000afae
leave
ret
Function at 0x10018367
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100183a6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100183a6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100183a6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100183a6
cmp dword [ecx + 0x74], 0xe
jbe 0x100183a6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001b5ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100320a0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001b62e
cmp byte [ebx], 0xa
jne 0x1001b62e
or byte [edi + eax + 0x28], 4
jmp 0x1001b633
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1001b732
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1001b715
inc eax
cmp dl, 0xd
je 0x1001b65f
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1001b685
cmp eax, ecx
jae 0x1001b693
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1001b647
jmp 0x1001b732
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001b710
cmp dword [ebp - 0x10], 0
je 0x1001b710
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100320a0]
test byte [eax + edi + 0x28], 0x48
je 0x1001b6ea
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001b6d5
mov byte [esi], dl
jmp 0x1001b6e6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100320a0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001b732
cmp byte [ebp - 1], 0xa
jne 0x1001b6f9
cmp esi, ebx
jne 0x1001b6f9
mov byte [esi], 0xa
jmp 0x1001b731
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001b590
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001b732
mov byte [esi], 0xd
jmp 0x1001b731
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100320a0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001b72f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001b732
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001b73b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100320a0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001b781
cmp word [ebx], dx
jne 0x1001b781
or byte [eax + edi + 0x28], 4
jmp 0x1001b786
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1001b8e9
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1001b8c9
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1001b7c7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001b7fd
cmp eax, edx
jae 0x1001b80b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1001b7a2
jmp 0x1001b8e9
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001b8c4
cmp dword [ebp - 0x18], 0
je 0x1001b8c4
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100320a0]
test byte [eax + edi + 0x28], 0x48
je 0x1001b89a
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001b85e
mov word [esi], cx
jmp 0x1001b895
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100320a0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100320a0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100320a0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1001b8e9
pop eax
cmp word [ebp - 4], ax
jne 0x1001b8aa
cmp esi, ebx
jne 0x1001b8aa
mov word [esi], ax
jmp 0x1001b8e6
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001b590
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1001b8e9
push 0xd
pop eax
jmp 0x1001b8a5
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100320a0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1001b8e3
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1001b8e9
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001f332
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001f3cf
push ebx
push esi
call fcn.1001f2fb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001f28f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001f37c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001f3ce
push edi
push eax
call fcn.10019d9b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001f39c
call fcn.10019d61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001f3cd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001f28f
add esp, 0x20
test eax, eax
jne 0x1001f3bb
push edi
call fcn.10019d61
jmp 0x1001f3c3
push ebx
call fcn.10019d61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001f63c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ab28
push 0x1002ab20
push str.FlsAlloc
push 0x1f
call fcn.1001f558
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001f670
push dword [ebp + 8]
mov ecx, esi
call dword [0x100271d8]
call esi
jmp 0x1001f676
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001f6ba
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ab38
push 0x1002ab30
push str.FlsGetValue
push 0x21
call fcn.1001f558
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001f6f1
push dword [ebp + 8]
mov ecx, esi
call dword [0x100271d8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001f6f9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002ab40
push 0x1002ab38
push str.FlsSetValue
push 0x22
call fcn.1001f558
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001f733
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100271d8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023d0a
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10023c86
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10023e79
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10023e79
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10023e2e
jg 0x10023d66
test eax, eax
je 0x10023e24
push 1
push 0x1000
call fcn.1001d914
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10023d89
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10023e1b
push 0x8000
push ebx
call fcn.10023bb7
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10023db2
jg 0x10023dad
cmp ecx, 0x1000
jb 0x10023db2
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001cf49
add esp, 0x10
cmp eax, 0xffffffff
je 0x10023df7
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10023dad
jl 0x10023dde
test ecx, ecx
jne 0x10023d9f
push dword [ebp - 0xc]
push ebx
call fcn.10023bb7
push esi
call fcn.10019d61
add esp, 0xc
xor ebx, ebx
jmp 0x10023e87
cmp byte [edi + 0x24], 0
je 0x10023e0e
cmp dword [edi + 0x20], 5
jne 0x10023e0e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10023e19
mov ebx, dword [edi + 0x18]
jmp 0x10023e1b
xor ebx, ebx
push esi
call fcn.10019d61
pop ecx
jmp 0x10023e87
test ecx, ecx
jg 0x10023df0
jl 0x10023e2e
test eax, eax
jae 0x10023df0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001b590
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10023e4e
cmp byte [edi + 0x1c], 0
je 0x10023df0
jmp 0x10023e7f
push ebx
call fcn.10021e26
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10023df0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10023e87
cmp byte [edi + 0x1c], 0
je 0x10023e84
mov ebx, dword [edi + 0x18]
jmp 0x10023e87
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001b590
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10025e90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10025ebd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10025ebd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10003360
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100150a0]
test eax, eax
je 0x10003418
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x100033a0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000338c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000344d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x100150a0], eax
test eax, eax
jne 0x1000337d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000338e

Function at 0x2a7bc74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2a7bc7e
pushal
call 0x2a7bc84
pop ebp
sub ebp, 0x10
sub ebp, 0x267bc74
jmp 0x2a7bc9a
mov eax, 0x267bc74
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e9
mov edx, 0x336ddc4b
xor byte [eax], dl
inc eax
dec ecx
jne 0x2a7bcb1
jmp 0x2a7bcc4
rol byte [esi + 0x4b77c2c0], 0x4b
dec ebx
retf 0xb38a
Function at 0x10017d8d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017de8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10017dc9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10017de6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10019b7f
mov dword [eax], 0xca631852
jmp 0x10017dbe
jmp 0x10017df8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esp, ebp
pop ebp
ret
Function at 0x1002ff0f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002ff56
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002ff72
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002ff72
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret

Function at 0x100309a8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100309e9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100309e7
push 0x995
push 0
push 0x1e1c
push 0x708
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10030a2a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x100327e9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003280d
xor eax, eax
jmp 0x10032947
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.100322ce
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10032835
xor eax, eax
jmp 0x10032947
lea eax, [ebp - 0xc]
push eax
push 1
push 0x5dff
push 0x709f
lea eax, [ebp - 8]
push eax
push 0x69ca
push 0x75e7
call fcn.10032331
add esp, 0x1c
cmp dword [ebp - 0xc], 0
jne 0x10032868
xor eax, eax
jmp 0x10032947
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push 1
push 0x73f2
lea eax, [ebp - 0x24]
push eax
call fcn.1003217c
add esp, 0x1c
push dword [ebp - 4]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1002a94c
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push 0x76f7
lea eax, [ebp - 4]
push eax
push 0x1f85
push 1
call fcn.100326f5
add esp, 0x14
push dword [ebp - 4]
call fcn.10031ef0
pop ecx
test eax, eax
jne 0x100328d5
xor eax, eax
jmp 0x10032947
push 1
push 0x23b9
lea eax, [ebp - 4]
push eax
push 0x65d9
call fcn.10032773
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003292f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1003290c
xor eax, eax
jmp 0x10032947
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10032925
xor eax, eax
jmp 0x10032947
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032940
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10032944
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10049e01
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10049e4b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
shl eax, 1
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax + 0x24], ecx
jmp 0x10049e5f
push 0x865
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x1004f93c
Capabilities:
Check os version
Get disk information
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push 1
mov esi, ecx
push 0x546a
push esi
call fcn.1004a921
xor ebx, ebx
mov dword [ebp - 8], 0xfffa
mov byte [ebp - 1], bl
add esp, 0xc
cmp byte [ebp - 1], bl
je 0x1004f976
push ebx
push 0x1bc0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004f98c
push ebx
push ebx
push 0x34f
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push esi
call fcn.100327e9
mov dword [ebp - 8], 0xffffffff
mov esi, eax
mov dword [ebp - 8], 0xbf39
pop ecx
mov dword [ebp - 8], ebx
jmp 0x1004f9d0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004f9be
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004f9cd
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jg 0x1004f9a8
mov eax, esi
mov dword [ebp - 8], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10061470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.100614c0
movzx eax, al
test eax, eax
je 0x100614a1
push 0x100017ac
push 0x12679fc0
call fcn.10052550
add esp, 8
push 0
call fcn.10070645
mov ecx, dword [ebp - 4]
call fcn.10061780
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.100615b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret