joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb2a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xb2a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb2a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2a06a
add dl, dl
jne 0xb2a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2a0dc
xor eax, eax
add dl, dl
jne 0xb2a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2a17d
add dl, dl
jne 0xb2a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb2a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb2a075
mov eax, 1
add dl, dl
jne 0xb2a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2a0e1
sub eax, ebx
mov ebx, 1
jne 0xb2a128
mov ecx, 1
add dl, dl
jne 0xb2a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb2a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb2a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb2a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2a136
cmp eax, 0x7d00
jae 0xb2a16d
cmp eax, 0x500
jb 0xb2a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2a075
cmp eax, 0x7f
ja 0xb2a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb2a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb2a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x475299
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4752c7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4752e5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475203
jmp 0x4752e5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4752e5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475203
test edi, edi
mov eax, edi
jne 0x4752cf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c0a5c]
test ecx, ecx
je 0x475398
jmp 0x475298
ret 8

Function at 0x48a710
Capabilities:
Encode data using xor

Disassembly:
lahf
inc eax
inc eax
cmc
push 0xffffffffffffffd2
aad 0xb6
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
sbb al, 0x13
arpl word [eax], bp
cld
push edx
jnp 0x48a67d
lcall 0xecbb, 0xb5f8559b
xor ecx, dword [edx]
xchg edi, eax
or dl, byte [edi + 0x57]
add byte [ebx + 0x53be9185], cl
mov al, byte [0xd7a0de88]
or dword [ecx], esi
jae 0x48a6cf
invalid
lds edx, [edx + 0x447155ee]
sbb dl, byte [esp + ebx*4 + 0x71a839bf]
scasd eax, dword es:[edi]
clc
sub esp, dword [ecx]
jae 0x48a72d
inc eax
jb 0x48a680
mov esi, 0x618520f1
push es
pop ebx
aas
push ds
ficom dword fs:[ebx + 0x38]
push ss
insb byte es:[edi], dx
jl 0x48a6f8
mov edi, 0x62522997
mov eax, 0x1acfa5de
in eax, 0xb7
add dword [ecx + edx*8], edi
cld
and bh, byte [ecx - 0x53]
jne 0x48a6c9
iretd
js 0x48a70a
mov ebx, 0x52b38976
invalid
mov dword [ebx + 0x1dc68d52], esi
mov dl, 0xca
mov dword [ebx], eax
mov ch, 0x54
out dx, eax
mov dh, 0xf0
cdq
pushal
mov edx, 0xf29aadbd
loopne 0x48a6cf
iretd
out 0xcc, al
dec ebx
mov edi, 0xc0f77d69
aaa
loope 0x48a793
add al, 0x19
movsd dword es:[edi], dword [esi]
push es
mov esp, 0x6420d436
mov ebp, 0x3e65f630
shl byte [ebx - 0x71], cl
xchg esi, eax
xor cl, byte [ebx + edi*4 + 0x5c]
push cs
mov ch, 0xc5
push cs
outsb dx, byte [esi]
lcall 0x86e5, 0xa30c7bc3
cmpsd dword [esi], dword es:[edi]
bound ecx, qword [ebx - 0x44543c49]
jbe 0x48a744
int3
push esp
iretd
Function at 0x401270
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407b60
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x40a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x18], ecx
cmp ecx, ebx
je 0x401328
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x401328
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x14], ecx
mov edi, 0x9484d9fe
mov dword [ebp - 0x10], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x40131e
nop
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x4012f0
cmp edi, 0x5c15e543
je 0x40132c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x4012d5
mov eax, dword [eax]
jmp 0x4012b0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push 0
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
call ecx
mov ebx, dword [ebp - 0x20]
lea ecx, [ebx + 4]
mov dword [ebx], eax
push ecx
mov ecx, ebx
call fcn.00401380
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4061c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407ee5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x40a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 8
mov esi, dword [eax]
call fcn.00406e16
mov dword [ebp - 0x14], eax
mov dword [eax], esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x406c50
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x406246
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40623e
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
je 0x406255
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406d28
mov esp, ebp
pop ebp
ret 4

Function at 0x4070be
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.0041902c
xor eax, 0xcd87b420
Function at 0x4076a8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4076e7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4076e7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4076e7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4076e7
cmp dword [ecx + 0x74], 0xe
jbe 0x4076e7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001551
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1003208]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x418]
push eax
xor ebx, ebx
push 0x1001188
push 0x80000001
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ebx
xor esi, esi
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1001635
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x1001160
push dword [ebp - 0x418]
mov dword [ebp - 0x424], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001635
cmp dword [ebp - 0x420], ebx
je 0x1001635
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
push 0x3ee
push dword [ebp - 0x41c]
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x3ef
push dword [ebp - 0x41c]
call esi
push 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
pop edi
cmp dword [ebp - 0x418], ebx
je 0x1001649
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01001dda
leave
ret
Function at 0x1001717
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1003208]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x10012c4
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x818], ebx
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
push 0x1001260
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebp - 0x814], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
jne 0x1001778
call fcn.01001689
jmp 0x1001872
inc ecx
call fcn.01001689
test eax, eax
jne 0x1001872
call fcn.01001b19
test eax, eax
je 0x1001794
call fcn.01001a45
mov ecx, esi
call fcn.01001449
test eax, eax
je 0x1001872
mov ecx, esi
call fcn.01001551
test eax, eax
jne 0x1001872
push 0x105
lea eax, [ebp - 0x610]
push edi
push eax
call dword [sym.imp.msvcrt.dll_mbstowcs]
add esp, 0xc
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x610]
push eax
call sub.INETCFG.dll__LaunchSignupWizard_12
cmp dword [ebp - 0x818], 1
jne 0x1001872
mov esi, 0x100
push esi
lea edx, [ebp - 0x404]
mov ecx, 0x3ea
call fcn.0100165c
push esi
lea edx, [ebp - 0x204]
mov ecx, 0x3e8
call fcn.0100165c
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x124
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call edi
cmp eax, 6
jne 0x1001872
call fcn.01001bce
call fcn.01001cd3
test eax, eax
je 0x100184e
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001872
push esi
lea edx, [ebp - 0x810]
mov ecx, 0x3eb
call fcn.0100165c
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
call edi
cmp dword [ebp - 0x814], ebx
pop edi
pop esi
pop ebx
je 0x1001889
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001dda
leave
ret 0x10
Function at 0x100189c
Capabilities:
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1003208]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
xor ebx, ebx
push 0x18
push ebx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1001a2f
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call sub.SHELL32.dll_SHGetPathFromIDListW
test eax, eax
je 0x1001a2f
lea eax, [ebp - 0x21c]
push eax
call sub.SHELL32.dll_SHGetMalloc
test eax, eax
jl 0x1001929
mov eax, dword [ebp - 0x21c]
push dword [ebp - 0x220]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea eax, [ebp - 0x210]
push eax
call esi
cmp word [ebp + eax*2 - 0x212], 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1001959
push 0x1001314
lea eax, [ebp - 0x210]
push eax
call edi
push 0x10012c8
lea eax, [ebp - 0x210]
push eax
call edi
push ebx
push 0x80000080
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x214], eax
je 0x1001a2d
push ebx
lea eax, [ebp - 0x218]
push eax
mov edi, 0x10012e4
push edi
call esi
push eax
push edi
push dword [ebp - 0x214]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
je 0x1001a21
push ebx
lea eax, [ebp - 0x218]
push eax
mov ebx, 0x10012f4
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1001a21
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
call esi
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1001a21
push 0
lea eax, [ebp - 0x218]
push eax
mov ebx, 0x1001304
push ebx
call esi
push eax
push ebx
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x1001a21
mov dword [ebp - 0x228], 1
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
pop ebx
call fcn.01001dda
leave
ret
Function at 0x1001a45
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1003208]
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push 0x18
push eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1001b0a
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call sub.SHELL32.dll_SHGetPathFromIDListW
test eax, eax
je 0x1001b0a
lea eax, [ebp - 0x214]
push eax
call sub.SHELL32.dll_SHGetMalloc
test eax, eax
jl 0x1001ac1
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x212], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1001aee
push 0x1001314
lea eax, [ebp - 0x210]
push eax
call esi
push 0x10012c8
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
mov ecx, dword [ebp - 4]
call fcn.01001dda
leave
ret

Function at 0x1001b6d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1003208]
push edi
push 0x45
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop edi
jne 0x1001bbd
cmp dword [ebp - 0x114], 5
jb 0x1001bbd
xor eax, eax
inc eax
jmp 0x1001bbf
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.01001dda
leave
ret
Function at 0x1001bce
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x73c
mov eax, dword [0x1003208]
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
mov esi, 0x3f4
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001cc1
and word [ebp - 8], 0
push edi
push 0x209
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
and word [ebp - 0x214], 0
push 0x45
pop ecx
xor eax, eax
lea edi, [ebp - 0x738]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x738]
push eax
mov dword [ebp - 0x738], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1001c5d
push 0x45
pop ecx
lea edi, [ebp - 0x738]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0x728], 2
pop edi
jne 0x1001c76
lea ecx, [ebp - 0x624]
call fcn.0100189c
mov esi, eax
jmp 0x1001cc1
lea eax, [ebp - 0x73c]
push eax
push 0x1001318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x1001cc1
push 0x412
lea eax, [ebp - 0x624]
push eax
push 1
push esi
push str.inetwiz
push dword [ebp - 0x73c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x73c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01001dda
leave
ret

Function at 0x1001dda
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003208]
jne 0x1001deb
test ecx, 0xffff0000
jne 0x1001deb
ret
jmp fcn.01001df5
Function at 0x1001eda
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10013b0
call fcn.01002104
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1001f2e
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1001f2e
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1001f46
cmp ecx, 0x20b
je 0x1001f33
mov dword [ebp - 0x1c], ebx
jmp 0x1001f5d
cmp dword [eax + 0x1000084], 0xe
jbe 0x1001f2e
xor ecx, ecx
cmp dword [eax + 0x10000f8], ebx
jmp 0x1001f57
cmp dword [eax + 0x1000074], 0xe
jbe 0x1001f2e
xor ecx, ecx
cmp dword [eax + 0x10000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x1003544], edi
mov dword [0x1003548], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003540]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100353c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100354c], eax
call fcn.010020fa
cmp dword [0x100320c], ebx
jne 0x1001fba
push fcn.010020fa
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010020e3
push 0x100110c
push 0x1001108
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003538]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1003534]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1001104
push 0x10010fc
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x1002045
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1002025
cmp cl, 0x22
jne 0x1002016
cmp byte [eax], 0x22
jne 0x100202e
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1002039
cmp cl, 0x20
jbe 0x100202a
test byte [ebp - 0x54], 1
je 0x1002050
movzx ecx, word [ebp - 0x50]
jmp 0x1002053
cmp byte [eax], 0x20
jbe 0x100202e
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1002045
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.01001717
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1002071
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x10020ad
mov eax, esi
jmp 0x10020c1
call fcn.0100213f
ret
Function at 0x533901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x533941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x533913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x533947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x533984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x533959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x41489b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
push esi
push edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebp
push edx
push eax
push ecx
push ecx
push 0x406fe0
push dword fs:[0]
mov eax, dword [0x413000]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x41491d
mov edx, dword [esp + 0x34]
cmp edx, 0xfffffffe
je 0x4148ef
cmp esi, edx
jbe 0x41491d
lea esi, [esi + esi*2]
lea ebx, [ebx + esi*4 + 0x10]
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
cmp dword [ebx + 4], 0
jne 0x4148cd
push 0x101
mov eax, dword [ebx + 8]
call 0x416fd0
mov ecx, 1
mov eax, dword [ebx + 8]
call 0x416fef
jmp 0x4148cd
pop dword fs:[0]
add esp, 0x18
pop edi
pop esi
pop ebx
ret