joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100affd
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push 0x480
mov eax, 0x1021089
call fcn.01013585
push 7
pop eax
xor ebx, ebx
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x18
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x46c], eax
mov ecx, 0x208
lea eax, [ebp - 0x218]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100a49a
push ebx
push dword [ebp - 0x46c]
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100a60c
lea eax, [ebp - 0x218]
cmp word [ebp - 0x218], bx
je 0x100a60c
movzx ecx, word [ebp - 0x218]
cmp cx, 0x20
jbe 0x100a4e7
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x100a4d7
cmp word [eax], bx
je 0x100a60c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x470]
call sub.MFC42u.dll_CString::CString_1
push 0x100254c
lea ecx, [ebp - 0x47c]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString_1
push eax
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::operator_1
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], bl
call fcn.01012a9e
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100a5fd
test byte [ebp - 0x468], 2
jne 0x100a5e0
lea eax, [ebp - 0x43c]
push 0x1002534
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100a5e0
test byte [ebp - 0x468], 0x10
jne 0x100a5e0
push 0x2c
call sub.MFC42u.dll_operatornew
pop ecx
mov ecx, eax
mov dword [ebp - 0x48c], ecx
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x100a5a0
call fcn.010086de
mov esi, eax
jmp 0x100a5a2
xor esi, esi
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x100a5e0
push dword [ebp - 0x46c]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
call fcn.010096ae
test eax, eax
je 0x100a5d8
mov ecx, dword [ebp - 0x478]
push esi
call fcn.0100823b
test eax, eax
jge 0x100a5e0
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
lea eax, [ebp - 0x468]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100a551
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.01012a9e
inc dword [ebp - 0x474]
mov eax, dword [ebp - 0x474]
mov eax, dword [ebp + eax*4 - 0x488]
mov dword [ebp - 0x46c], eax
cmp eax, ebx
jne 0x100a48f
call fcn.01013617
ret
mov edi, edi
push esi
mov esi, ecx
call fcn.01009028
mov ecx, esi
pop esi
jmp 0x100a453

Function at 0x100b182
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
mov dword [esi + 0xa8], 1
call fcn.010076b7
push edi
mov ecx, esi
mov dword [esi + 0xa4], edi
call sub.MFC42u.dll_CWnd::EnableWindow
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x100b16c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
pop edi
pop esi
jne 0x100b1cc
mov eax, 0x80004005
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret
Function at 0x100c038
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
call fcn.0100bdef
mov esi, eax
test esi, esi
jge 0x100c066
push esi
push 0
call fcn.01010f77
xor eax, eax
test esi, esi
setge al
pop esi
pop ebp
ret 8

Function at 0x100c5c7
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
push 0x12f
push esi
call fcn.01010af4
mov ecx, esi
mov edi, eax
call fcn.0100c10c
test eax, eax
jl 0x100c606
mov ecx, esi
call fcn.0100c077
test eax, eax
jl 0x100c606
push 1
push 0x12e
push esi
call fcn.01010af4
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x100c642
push 0x131
push esi
call fcn.01010af4
test eax, eax
je 0x100c642
push 0x1001b84
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x12e
push esi
call fcn.01010af4
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x100c642
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret

Function at 0x100c654
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1a14
call fcn.010136f0
mov eax, dword [0x1025588]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a14], eax
mov dword [ebp - 0x1a10], ebx
cmp dword [eax + 0xb8], ebx
jne 0x100c799
push esi
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x100c78e
cmp eax, esi
jae 0x100c78e
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, 0x400
push esi
lea eax, [ebp - 0xa0c]
push eax
push 0x7d6
push ebx
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push eax
call ebx
test eax, eax
jle 0x100c78e
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0xa0c]
push eax
call fcn.0100c40f
mov dword [ebp - 0x1a10], eax
test eax, eax
jl 0x100c798
push esi
lea eax, [ebp - 0x120c]
push eax
push 0x7d7
push 0
call edi
push eax
call ebx
test eax, eax
jle 0x100c78e
lea eax, [ebp - 0x120c]
push eax
push esi
lea eax, [ebp - 0xa0c]
push eax
call fcn.0100c40f
mov dword [ebp - 0x1a10], eax
test eax, eax
jl 0x100c798
push esi
lea eax, [ebp - 0x1a0c]
push eax
push 0x7d1
push 0
call edi
push eax
call ebx
test eax, eax
jle 0x100c78e
push 0
lea eax, [ebp - 0x1a0c]
push eax
lea eax, [ebp - 0xa0c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x1a14]
mov dword [eax + 0xb8], 1
jmp 0x100c798
mov dword [ebp - 0x1a10], 0x80004005
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1a10]
pop edi
xor ecx, ebp
pop ebx
call fcn.010134fd
leave
ret 4
Function at 0x100ca94
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + esi]
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x100cac5
cmp eax, esi
jb 0x100caca
mov edi, 0x80004005
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100cb0e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, ebx
jne 0x100cb4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x100cb41
mov esi, eax
jmp 0x100cc59
and eax, 0xffff
or eax, 0x80070000
jmp 0x100cb3a
push edi
push 0x17
push 0x1002af4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
jne 0x100cb7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100cb76
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100cc58
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x100cb98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x100cbc7
jmp 0x100cbd1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100cbaf
mov esi, 0x80004005
jmp 0x100cc3a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x100cbd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100cbd1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100cc3a
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x100cbee
mov esi, 0x8007000e
jmp 0x100cc3a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
test eax, eax
je 0x100cbe7
push esi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
test esi, esi
jl 0x100cc3a
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [edi + 8]
push edx
push 0x1003508
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x100cc3a
push 0xd
pop eax
mov word [edi], ax
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x100cc4a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 4], ebx
je 0x100cc58
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
cmp esi, ebx
jge 0x100cc6b
cmp dword [ebp - 8], ebx
je 0x100cc6b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x100cc78
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x100f10a
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x1021575
call fcn.01013512
mov esi, ecx
xor edi, edi
cmp dword [ebp + 8], edi
je 0x100f127
mov eax, dword [esi]
call dword [eax + 0xd8]
push 0x1002f1c
lea ecx, [ebp + 8]
mov dword [esi + 0xb4], edi
call sub.MFC42u.dll_CString::CString_1
lea eax, [ebp + 8]
push eax
push 0x1002f10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.01011241
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.01012a9e
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x100f16a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
lea ecx, [esi + 0x90]
call fcn.010044ec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01012a9e
call fcn.010135fe
ret 4

Function at 0x1010dad
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1025588]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jl 0x1010e90
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
push esi
push eax
mov ebx, 0x10255c8
push 0x102566c
mov ecx, ebx
call fcn.01010c00
cmp eax, esi
jl 0x1010e8a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x102564c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, 0x100320c
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
mov ecx, eax
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.01010aa2
mov edi, eax
test edi, edi
je 0x1010e72
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0xffffffffffffffff
push 0x10031f4
push 0xffffffffffffffff
push edi
push 1
push 0x7f
call esi
cmp eax, 2
je 0x1010e9d
push 0xffffffffffffffff
push 0x10031e0
push 0xffffffffffffffff
push edi
push 1
push 0x7f
call esi
cmp eax, 2
je 0x1010eb7
lea eax, [ebp - 0x10]
push eax
push edi
mov ecx, ebx
call fcn.01010aa2
mov edi, eax
test edi, edi
jne 0x1010e36
xor esi, esi
inc esi
push esi
push 4
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRegisterClassObjects]
test eax, eax
jge 0x1010ed2
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleTerm]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x14]
add eax, 0xc4
and dword [eax], 0
jmp 0x1010edc
xor esi, esi
push esi
push esi
push esi
push 0x73
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
push esi
push 1
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUnregisterServerEx]
jmp 0x1010e83
xor esi, esi
push esi
push esi
push 1
push 0x73
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
push esi
push 1
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRegisterServer]
jmp 0x1010e83
mov eax, dword [ebp - 0x14]
add eax, 0xc4
mov dword [eax], esi
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010134fd
leave
ret
Function at 0x1011241
Capabilities:
Create directory
Query environment variable

Disassembly:
push 0x234
mov eax, 0x1021812
call fcn.01013585
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
and dword [ebp - 0x230], 0
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], eax
call sub.MFC42u.dll_CString::CString
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::CString
mov eax, dword [0x102575c]
cmp dword [eax - 8], 0
mov byte [ebp - 4], 3
mov edi, 0x102575c
jne 0x1011304
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x1003214
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
ja 0x1011379
test eax, eax
je 0x1011379
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.01012aaa
push edi
call fcn.010109c8
test eax, eax
jne 0x1011304
push eax
push dword [0x102575c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1011379
push dword [ebp - 0x224]
lea ecx, [ebp - 0x21c]
call fcn.01012aaa
push 0x5c
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::ReverseFind
test eax, eax
jl 0x101135b
inc eax
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::Mid
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 4
call fcn.01012b16
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 3
call fcn.01012a9e
jmp 0x101136d
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.01012b16
mov eax, dword [ebp - 0x220]
cmp dword [eax - 8], 0
jne 0x10113b0
lea ecx, [ebp - 0x22c]
call sub.MFC42u.dll_CString::CString
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call sub.MFC42u.dll_CString::CString_2
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 3
call fcn.01012a9e
jmp 0x1011442
push 0x1001b88
push edi
lea eax, [ebp - 0x23c]
push eax
call sub.MFC42u.dll_operator_1
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.dll_operator
push dword [ebp - 0x238]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x224]
push eax
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 7
call fcn.01012b16
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 6
call fcn.01012a9e
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 5
call fcn.01012a9e
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 3
call fcn.01012a9e
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call sub.MFC42u.dll_CString::CString_2
mov dword [ebp - 0x230], ebx
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.01012a9e
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], bl
call fcn.01012a9e
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.01012a9e
mov eax, esi
call fcn.01013617
ret 0xc
Function at 0x101151c
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
jne 0x101155e
push eax
push 0xf003f
push 0x1002348
push 0x80000002
lea ecx, [ebp - 0xc]
call fcn.01004964
test eax, eax
jne 0x101155e
push 0x1001b8c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0xc]
call fcn.01004403
leave
ret 4

Function at 0x1011882
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.010136f0
mov eax, dword [0x1025588]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor edi, edi
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x100c], eax
cmp eax, edi
je 0x1011a15
lea ecx, [ebp - 0x1008]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1011a09
push esi
lea eax, [ebp - 0x1034]
push eax
xor esi, esi
push 0x1003268
inc esi
push edi
mov dword [ebp - 0x1038], esi
mov dword [ebp - 0x102c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1011a00
push edi
push edi
push edi
lea eax, [ebp - 0x1038]
push eax
push edi
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1011a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1011a00
push edi
mov dword [ebp - 0x1024], edi
mov dword [ebp - 0x1014], edi
mov dword [ebp - 0x1010], edi
mov dword [ebp - 0x1028], 0x100325c
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1028]
call fcn.01011638
cmp eax, esi
jne 0x10119e1
push 0x40000
push 0x24
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
cmp eax, edi
je 0x10119e1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, 0x400
cmp eax, 0x4a7
push esi
lea eax, [ebp - 0x1004]
push eax
jne 0x101199c
push 0x7d2
jmp 0x10119a1
push 0x7d3
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x10119e0
push esi
lea eax, [ebp - 0x804]
push eax
push 0x7d1
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x10119e0
push edi
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
mov dword [ebp - 0x1028], 0x100325c
cmp dword [ebp - 0x1014], edi
je 0x1011a08
push dword [ebp - 0x1014]
call fcn.0101277b
jmp 0x1011a08
push edi
push 0x70
call fcn.01011073
pop esi
push dword [ebp - 0x100c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.010134fd
leave
ret
Function at 0x1012157
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1025588]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x658
mov esi, edx
mov edi, ecx
push 0
push esi
mov dword [ebp - 0x30], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x1012320
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
push ebx
rep stosd dword es:[edi], eax
call fcn.0101303f
pop ecx
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x1012320
push eax
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x30]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1012317
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x10033dc
push dword [ebp - 0x2c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1012251
cmp dword [ebp - 0x30], 4
jb 0x1012251
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push 0x10033c8
lea eax, [ebp - 0x28]
push 9
push eax
call fcn.0100e03e
add esp, 0x14
test eax, eax
jl 0x1012317
cmp ebx, 0x70
jbe 0x101224b
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x5a], 0
jne 0x101224b
add eax, 0x4c
push eax
push 0x1025538
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x101224b
mov eax, dword [ebp - 0x2c]
add eax, 0x60
push eax
push 9
lea eax, [ebp - 0x16]
push eax
call fcn.010054db
test eax, eax
jl 0x1012317
jmp 0x1012251
xor eax, eax
mov word [ebp - 0x16], ax
cmp word [ebp - 0x28], 0
jne 0x10122cc
push 0x10033b4
push 9
lea eax, [ebp - 0x28]
push eax
call fcn.010054db
test eax, eax
jl 0x1012317
push 0x20
mov edi, 0x100339c
push esi
mov eax, edi
lea ebx, [ebp - 0x2c]
call fcn.0101211f
test eax, eax
jne 0x10122dc
push 0x1003388
push 9
lea eax, [ebp - 0x28]
push eax
call fcn.010054db
test eax, eax
jl 0x1012317
push 0x20
push esi
mov eax, edi
call fcn.0101211f
test eax, eax
jne 0x10122dc
push 0x1003374
push 9
lea eax, [ebp - 0x28]
push eax
call fcn.010054db
test eax, eax
jl 0x1012317
push 0x20
push esi
mov eax, edi
call fcn.0101211f
test eax, eax
je 0x1012317
jmp 0x10122dc
push 0x20
push esi
mov eax, 0x100339c
lea ebx, [ebp - 0x2c]
call fcn.0101211f
mov edi, 0x104
push edi
lea eax, [esi + 0x40]
push eax
mov eax, 0x1003354
lea ebx, [ebp - 0x2c]
call fcn.0101211f
push edi
lea eax, [esi + 0x248]
push eax
mov eax, 0x100333c
call fcn.0101211f
push edi
add esi, 0x450
push esi
mov eax, 0x1003324
call fcn.0101211f
push dword [ebp - 0x2c]
call fcn.0101302e
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010134fd
leave
ret
Function at 0x1012830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1025760], 0
push esi
jne 0x101279e
call fcn.01012695
test eax, eax
je 0x10127e1
mov eax, dword [0x1025760]
cmp eax, 1
jne 0x10127bf
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10127e1
pop esi
ret
push eax
call dword [0x1025768]
test eax, eax
jne 0x1012829
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10127e5
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1025760]
call dword [0x1025768]
mov edi, eax
test edi, edi
je 0x101280a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1012826
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1025760]
call dword [0x1025764]
add edi, 0x10
cmp edi, esi
jb 0x1012812
mov eax, edi
pop edi
pop esi
ret
jmp 0x101278b
Function at 0x10134bb
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1022f30
call fcn.01013a14
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1025c18
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1013276
cmp eax, esi
jne 0x1013269
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1013279
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1013250
xor esi, esi
inc esi
mov eax, dword [0x1025c14]
cmp eax, esi
jne 0x101328c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10132bb
mov eax, dword [0x1025c14]
test eax, eax
jne 0x10132b5
mov dword [0x1025c14], esi
push 0x1001728
push 0x100171c
call fcn.010131b2
pop ecx
pop ecx
test eax, eax
je 0x10132bb
jmp 0x10133df
mov dword [0x10257a8], esi
mov eax, dword [0x1025c14]
cmp eax, esi
jne 0x10132df
push 0x1001718
push 0x1001704
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1025c14], 2
cmp dword [ebp - 0x20], ebx
jne 0x10132ec
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1025c24], ebx
je 0x101330d
push 0x1025c24
call fcn.01013989
pop ecx
test eax, eax
je 0x101330d
push ebx
push 2
push ebx
call dword [0x1025c24]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10133df
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1013377
cmp cx, bx
je 0x1013332
cmp dword [ebp - 0x1c], ebx
jne 0x1013377
movzx ecx, word [eax]
cmp cx, bx
je 0x1013347
cmp cx, 0x20
ja 0x1013347
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1013332
test byte [ebp - 0x40], 1
je 0x1013353
movzx ecx, word [ebp - 0x3c]
jmp 0x1013356
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10257a4], eax
cmp dword [0x1025798], ebx
jne 0x10133bc
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1013388
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x101331c
cmp dword [0x10257a8], ebx
jne 0x10133ca
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10257a4]
jmp 0x10133eb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01013a59
ret
call fcn.01013b61
jmp 0x1013213