joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5af8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x5cc54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x5cc54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x5cb378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5af8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0xeed424
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeed42e
pushal
call 0xeed434
pop ebp
sub ebp, 0x10
sub ebp, 0xaed424
jmp 0xeed44a
aam 0xae
add cl, ch
add al, 0
add byte [eax], al
leave
ret
mov eax, 0xaed424
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b0
mov edx, 0x1aa232bf
xor byte [eax], dl
inc eax
dec ecx
jne 0xeed461
jmp 0xeed474
xor al, 0x72
xor al, 0x36
cmp dword [edi + 0x7e3ebfbf], 0x47
mov edi, 0x72bcbfbf
pop es
mov ecx, 0x5bfbfbf
xchg edi, eax
mov edi, 0x5d48bfbf
pop ebp
mov esp, 0xb33e3477
mov edi, 0x7abcbfbf
out dx, eax
out dx, eax
xlatb
xchg edi, eax
loope 0xeed43e
mov edi, 0x32ca44d7
mov edi, 0xd79b93be
push eax
pop ecx
enter 0xffffffffffffba57, 0xffffffffffffffbf
mov edi, 0xbf9156bf
mov edi, 0x5334eabf
xor al, 0x3a
mov bh, 0xbf
mov edi, 0xb32a34bf
mov edi, 0x3234bfbf
scasd eax, dword es:[edi]
mov edi, 0x567ebfbf
mov ebp, 0x7d3cbd8e
mov ebx, 0x4b3ab0f6
inc eax
inc eax
inc eax
xor al, 0x93
wait
xor bl, bl
wait
mov ebx, 0x34bfb37d
xor ebx, dword [ebx - 0x40404045]
xlatb
xchg edi, eax
loope 0xeed48f
mov edi, 0x32ca44d7
mov edi, 0x329b93be
fistp dword [ebx - 0x644cc9bd]
push edi
mov edx, 0x56bfbfbf
hlt
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40596d
pop dword [ebp - 0x30]
mov eax, 0xf81de89
sub eax, 0xf41851c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd97b9a16
add dword [ebp - 0x40], 0x74d6ab35
mov dword [ebp - 0x3c], 0x3926a8dd
add dword [ebp - 0x3c], 0xf90ca368
mov dword [ebp - 0x38], 0x1b843b7b
sub dword [ebp - 0x38], 0xcf37f74d
mov dword [ebp - 0x34], 0xbde51142
sub dword [ebp - 0x34], 0xbde51142
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2c33032d
sub eax, 0x2bf292cd
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xcdb747b9
sub dword [ebp - 0x40], 0x5944de63
mov dword [ebp - 0x3c], 0x2b68d7c9
sub dword [ebp - 0x3c], 0xe9fc7654
mov dword [ebp - 0x38], 0x7993461b
add dword [ebp - 0x38], 0xe9dc2651
mov dword [ebp - 0x34], 0xd1199ff8
sub dword [ebp - 0x34], 0xd1199ff8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x160ddd23
sub eax, 0x15cd6c23
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a667
push 0
call eax
mov ecx, 0x56bc
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x30]
mov esi, 0xdfb25fe3
sub dword [ebp - 8], 0xa7844449
mov edx, dword [ebx]
xor dword [ebp - 0x28], 0x4e2bb529
xor edx, esi
add dword [ebp - 0x20], esi
mov dword [edi], edx
add edi, 0x82b31ab6
sub edi, 0x82b31ab2
add ebx, 0xfe89dcfd
sub ebx, 0xfe89dcf9
loop 0x405a7f
add eax, 0x14dc3
xor ebx, ebx
add ebx, eax
add eax, 0xac318996
add eax, 0x53ce766f
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401cb3
pop dword [ebp - 0x30]
mov eax, 0x397c1dda
sub eax, 0x393c0127
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x36af9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x3dd9
xor ebx, ebx
add ebx, eax
mov esi, 0x4be47cd0
sub esi, 0x4ba3410c
add esi, dword [ebp - 0x30]
mov edi, 0x64fae29d
add edi, 0xc993e93d
xor dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 0x2c], 0x3e80ad9b
add edx, edi
add dword [ebp - 0xc], edi
mov dword [ebx], edx
sub dword [ebp - 4], 0x288021af
add ebx, 0xe694b69b
sub ebx, 0xe694b697
add esi, 4
loop 0x401d09
add eax, 0x58b376b8
add eax, 0xa74d737f
xor ebx, ebx
add ebx, eax
add eax, 0x333ec71a
sub eax, 0x333ec715
mov ecx, 0x1181b55f
sub ecx, 0x1141b55f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00401ca4
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00401ca4
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00401ca4
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00401ca4
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00401ca4
mov dword [0x41203c], eax
call fcn.00401ca4
test eax, eax
jge 0x402550
push 8
call fcn.00401ca4
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00401ca4
pop ecx
push 1
call fcn.00401ca4
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00401ca4
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00401ca4
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00401ca4
jmp 0x402495
Function at 0x4b2e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x70000]
push edi
jmp 0x4b2e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2e70
mov eax, 1
add ebx, ebx
jne 0x4b2e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2ea4
jne 0x4b2ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2ec3
dec eax
add ebx, ebx
jne 0x4b2eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2e88
add ebx, ebx
jne 0x4b2ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b2f15
xor ecx, ecx
sub eax, 3
jb 0x4b2edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2f4a
sar eax, 1
mov ebp, eax
jmp 0x4b2ee6
add ebx, ebx
jne 0x4b2ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
inc ecx
add ebx, ebx
jne 0x4b2ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
add ebx, ebx
jne 0x4b2f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b2ef6
jne 0x4b2f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b2ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2f26
jmp 0x4b2e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2f34
add edi, ecx
jmp 0x4b2e76
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2f52
cmp byte [edi], 0x13
jne 0x4b2f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2f57
lea edi, [esi + 0xae000]
mov eax, dword [edi]
or eax, eax
je 0x4b2fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb40a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb41fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2f84
mov ecx, edi
jns 0x4b2fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb4200]
or eax, eax
je 0x4b2fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2fa1
call dword [esi + 0xb4210]
mov ebp, dword [esi + 0xb4204]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b3003
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x1002bb22
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002bb58
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x5a60
push 0x47dd
call fcn.1002bd9e
add esp, 0x14
jmp 0x1002bb84
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002bb72
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1002bb84
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002bb84
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esp, ebp
pop ebp
ret
Function at 0x10035c06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10035d16
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10035c4c
push 0xf96
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10035d11
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x372ba29f
je 0x10035c84
mov dword [ebp - 0x14], 1
jmp 0x10035c88
and dword [ebp - 0x14], 0
push 3
mov ecx, dword [ebp - 0xc]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jl 0x10035cac
mov dword [ebp - 0x18], 1
jmp 0x10035cb0
and dword [ebp - 0x18], 0
push 2
mov ecx, dword [ebp - 0xc]
call fcn.1000e0ff
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x10035ccc
mov dword [ebp - 0x1c], 1
jmp 0x10035cd0
and dword [ebp - 0x1c], 0
push 1
mov ecx, dword [ebp - 0xc]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x18]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x1c]
jle 0x10035cee
mov dword [ebp - 0x20], 1
jmp 0x10035cf2
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jle 0x10035d05
mov dword [ebp - 0x24], 1
jmp 0x10035d09
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x10035da3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10035d58
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10035d56
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10035da3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10035d86
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10035da3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x64]
call fcn.1000e0ff
mov dword [eax], 0x1d686a37
jmp 0x10035d7b
mov esp, ebp
pop ebp
ret
Function at 0x1003634e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x20], 0x145b
cmp dword [ebp - 0x20], 0xcfd
jge 0x100363f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x10007a24
call fcn.1004a93b
add esp, 0xc
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
je 0x100363d5
lea eax, [ebp - 0xc]
push eax
push 0x1000774c
call fcn.1004a93b
pop ecx
pop ecx
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.1002abc8
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1002abc8
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x10]
cdq
idiv ecx
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x10036384
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x100363e6
mov dword [ebp - 0x1c], 0x10007b60
jmp 0x100363ed
mov dword [ebp - 0x1c], 0x10007b64
push dword [ebp - 0x1c]
call fcn.1004b3f4
pop ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036491
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10036444
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10036442
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1003648f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10036472
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003648f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.1000e0ff
mov dword [eax], 4
jmp 0x10036467
jmp 0x10036507
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x100364fa
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100364db
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100364f8
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x60]
call fcn.1000e0ff
mov dword [eax], 4
jmp 0x100364d0
jmp 0x10036507
push 1
push 0x1145
call dword [sym.imp.USER32.dll_FlashWindow]
mov esp, ebp
pop ebp
ret
Function at 0x100369d5
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10036a5e
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10036a11
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10036a5c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10036a3f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10036a5c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000e0ff
mov dword [eax], 9
jmp 0x10036a34
jmp 0x10036a8c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.10035e91
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003cb78
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1003cc3b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003cbee
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x15
jmp 0x1003cbce
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 9
jg 0x1003cbec
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003cbea
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1003cbc3
jmp 0x1003cc39
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003cc1c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1003cc39
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.1000e0ff
mov dword [eax], 0xe352601c
jmp 0x1003cc11
jmp 0x1003cca7
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003cc87
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
movzx eax, word [eax]
sar eax, 0xc
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
jmp 0x1003cca7
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x1003cca7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x1003d337
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003d395
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003d365
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1003d393
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003d393
push 0
push 0x1224
push 0
push 0
push 0x2181
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1003d3d5
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1003d3b7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x1003d3d5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003d3d5
push 0
push 0x865
push 0x1972
call dword [sym.imp.GDI32.dll_CreatePen]
mov esp, ebp
pop ebp
ret