joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55dc90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [0x599cb4], 0x1b1e
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x599cb8], 0x26bb
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x55dd2a
mov dword [0x599cb8], 0xcb4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x55ddc0
mov dword [0x599cb8], 0x1ac7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x55dd54
jmp 0x55ddc0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x55dd88
jmp 0x55ddc0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x55dd6f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x55dd16
jmp 0x55ddc0
mov dword [0x599cb4], 0xfffffca7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x55ddac
jmp 0x55ddc0
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x55dd2a
jmp 0x55dd40
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x55ddc0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x55dcd0
jmp 0x55ddc0
mov eax, 1
mov dword [0x599cb4], 0xffffe8ea
mov dword [ebp - 0x24], eax
jmp 0x55ddcf
xor eax, eax
mov dword [0x599cb8], 0x888
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x55de80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x599cc0], 0
mov byte [0x599cc4], 0
mov dword [0x599cb4], 0xd7
mov dword [0x599cbc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x55deea
mov dword [0x599cb4], 0x19d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x599cbc], 0
mov dword [ebp - 0x20], eax
jmp 0x55df21
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x599cb8]
add eax, 0xfffff809
mov dword [0x599cb4], eax
mov eax, dword [0x599cbc]
add eax, 1
mov dword [0x599cbc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x55deea
jmp 0x55ded9
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x599cc8], 0
mov dword [0x599cb8], 0x69c
mov edx, dword [0x599cc0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x599cc8], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x599cc0], edx
mov dword [0x599cb4], 0x1aca
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x599cc4], cl
mov dword [0x599cb4], 0x24a1
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x599cc4]
mov edx, dword [0x599cc0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x599cb4], 0x17ba
mov edx, dword [0x599cbc]
add edx, 1
mov dword [0x599cbc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x55df21
jmp 0x55dec7
Function at 0x55eaf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x599cbc], 0
mov dword [0x599cc0], 0
mov dword [0x599ccc], 0
mov dword [0x599cb8], 0x1f51
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x55ec86
jmp 0x55ec72
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x599cb4], 0xe18
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x599cbc], edx
mov dword [0x599cb8], 0x9fe
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x599cc0], edx
mov dword [0x599cb4], 0xfffff931
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x599cc4], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x599cb8], 0x26b8
mov cl, byte [0x599cc4]
mov edx, dword [0x599cc0]
mov byte [edi + edx], cl
mov edx, dword [0x599cb8]
mov ebx, edx
add ebx, 0x2ee
mov dword [0x599cb4], ebx
mov ebx, dword [0x599cbc]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x599cc0]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov dword [0x599cb4], 0x1bba
and ecx, 0xff
mov dword [0x599ccc], ecx
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov ch, byte [ebx + esi]
mov bl, cl
add bl, byte [0x599cd1]
mov byte [0x599cd0], bl
mov byte [0x599cd1], ch
mov byte [0x599cd2], cl
xor ch, cl
add edx, 0x1245
mov dword [0x599cb4], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [0x599cb4]
add edx, 0xc87
mov dword [0x599cb4], edx
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x55ecb9
jmp 0x55ec98
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x55eb49
mov dword [0x599cb8], 0x17fb
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x599cbc]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x599cc0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x55eb49
jmp 0x55ec86
Function at 0x55f000
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov esi, dword [0x599cb8]
add esi, 0xd41
mov dword [0x599cb8], esi
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0xc2
mov dword [0x599cb4], 0x1613
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
call fcn.0055ecc0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
call fcn.0055e050
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x55f13c
mov eax, dword [ebp - 0x38]
mov dword [0x599cb4], 0x748
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.0055e4b0
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x599cb4], 0x624
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x10], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x38], ecx
mov dword [0x599cb8], 0x2425
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x55f13c
mov dword [0x599cb4], 0x1f4e
mov eax, dword [ebp - 0x40]
add eax, 0x128a
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x55f4d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov dword [0x599cb8], 0xdcc
call fcn.00401080
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x55f5fb
jmp 0x55f579
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0055e730
lea ecx, [0x55e660]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x78], edx
mov dword [esp + 0x58], 0x141e00
mov dword [0x599cb4], 0xa58
mov edx, dword [0x599ca0]
mov dword [esp + 0x88], edx
mov edx, dword [0x599ca4]
mov dword [esp + 0x68], edx
mov edx, dword [0x599ca8]
mov dword [esp + 0x80], edx
mov edx, dword [0x599cac]
mov dword [esp + 0x3c], edx
mov dword [0x599cb8], 0xfffff8f0
mov edx, dword [0x599cb0]
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x55f637
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jne 0x55f64a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x38]
mov dword [esp + 0x5c], eax
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], eax
mov dword [0x599cb4], 0x22cb
mov dword [0x599cb8], 0xa7d
mov eax, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0055f000
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x599cb8], 0x10cf
mov dword [esp + 0xc], eax
jmp 0x55f65e
lea eax, [esp + 0x38]
mov dword [0x599cb4], 0x8f5
mov ecx, dword [0x599cb8]
add ecx, 0x14ca
mov dword [0x599cb8], ecx
mov dword [esp + 8], eax
call fcn.0055dc90
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x55f4fe
jmp 0x55f65e
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x55f581
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x55f637
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x55f579
Function at 0x55f760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [0x599cb4], 0xffffff8f
mov dword [ebp - 0x10], eax
call fcn.0055f1f0
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x599cb8], 0x460
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x599cb4], 0x1e54
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x55f8bb
jmp 0x55f7e6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
jmp 0x55f7f8
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
jmp 0x55f7ca
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x47], bl
je 0x55f854
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x46]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x47], dl
jne 0x55f7f8
mov al, byte [ebp - 0x47]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
jne 0x55f885
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
jb 0x55f7ca
jmp 0x55f8b4
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [0x599cb4], 0x1812
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x599cb8], 0xaf2
mov dword [ebp - 0x28], esi
jmp 0x55f8bb
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x55f8bb
mov eax, dword [ebp - 0x28]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x205109e9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x474552fb
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xc3f3515c
int3
in al, dx
jnp 0x414b15
sbb dword [edx - 0xc46611a], edi
fisttp word [edi]
jnp 0x414a7e
mov bh, 0xb5
dec edi
sbb cl, ch
sbb al, byte [edi + 0xd]
out 0x37, eax
sbb eax, 0x204934
push edi
popfd
mov ecx, 0xfb3fb348
invalid
mov bh, 0xdf
inc esi
or eax, 0xf2b92048
mov bh, 0xdf
mov ecx, 0xb9dfb7f2
mov bh, 0xdf
mov ecx, 0xbd3334f2
xor eax, 0x5a55fbb3
cmc
fbstp tbyte [eax - 0x464807f7]
xor dh, 0xdf
div dword [ebp - 0x37c4f8f1]
xor dword [esi + esi*2 - 0x5d], esp
xlatb
lcall 0xe2b9, 0x66f10d90
neg edi
cmp byte [0xf2b9dfb6], dh
xor dword ss:[eax - 0x7c], edx
xor dword [eax - 0x7c], edx
mov edi, 0xb61c383d
fistp qword [ecx - 0xd00f20e]
mov bl, CoUninitialize
pop esi
push esi
push eax
jnp 0x414b57
popfd
dec eax
aaa
xchg edx, eax
mov bh, 0xdf
add bl, al
fiadd dword [esp + edi*2]
stosd dword es:[edi], eax
jl 0x414b25
sahf
sub dword [edx], esi
out 0x93, al
pop esp
jge 0x414b78
sbb byte ss:[ecx], bh
ret 0x9f80
Function at 0x544007
Capabilities:
Encode data using xor

Disassembly:
stc
leave
sti
stc
inc edi
xor ebp, edx
xor al, 0x6f
or edx, dword [esp + ebx*4 + 0x30a0258c]
loopne 0x54400c
fdiv st(0)
sbb esp, dword [ebp + 0x19]
push 0x101129f9
add bh, dl
inc edx
mov eax, dword [0x7e6a3381]
invalid
Function at 0x1001c77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100504c]
jne 0x1001c88
test ecx, 0xffff0000
jne 0x1001c88
ret
jmp fcn.01001c92
Function at 0x100322d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
test edi, edi
mov eax, dword [0x100504c]
mov dword [ebp - 4], eax
push esi
je 0x10032a8
mov esi, dword [sym.imp.ntdll.dll_wcslen]
push edi
call esi
pop ecx
mov ecx, 0x104
cmp eax, ecx
ja 0x10032a8
push ecx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x20c]
push eax
call esi
pop ecx
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
mov cx, word [eax]
cmp cx, 0x5c
je 0x1003289
cmp cx, 0x2f
jne 0x100328f
and word [eax], 0
jmp 0x1003278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x10032aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.01001c77
leave
ret
Function at 0x10032ba
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x100504c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push dword [ebx + 4]
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x104]
push eax
call esi
push dword [ebx + 4]
call dword [sym.imp.ntdll.dll_wcslen]
lea eax, [ebp + eax*2 - 0x104]
push 0x1001514
push eax
mov dword [ebp - 0x65c], eax
call esi
add esp, 0x14
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x658], eax
jne 0x100333b
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003464
push edi
mov edi, dword [sym.imp.ntdll.dll_wcscmp]
lea eax, [ebp - 0x628]
push 0x1001200
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1003439
lea eax, [ebp - 0x628]
push 0x100150c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1003439
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.ntdll.dll__wcslwr]
push eax
push dword [ebp - 0x65c]
call esi
mov eax, dword [ebx + 0xc]
add esp, 0xc
test eax, eax
je 0x10033a2
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ntdll.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x628]
push eax
push dword [ebx + 8]
call fcn.010036c5
test eax, eax
je 0x1003439
cmp dword [ebx + 0xc], 0
je 0x1003416
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
lea edx, [ebp - 0x104]
call fcn.01003161
test eax, eax
je 0x1003416
test byte [ebp - 0x654], 0x10
je 0x1003439
lea edi, [ebp - 0x204]
call fcn.0100322d
test eax, eax
je 0x1003439
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x404]
push eax
mov eax, edi
push eax
mov eax, dword [ebp + 8]
call fcn.01002fb8
jmp 0x1003439
lea edi, [ebp - 0x104]
call fcn.0100322d
test eax, eax
je 0x1003439
mov eax, edi
push eax
mov eax, dword [ebp - 0x660]
call fcn.01003091
mov edi, eax
test edi, edi
jne 0x1003461
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
test edi, edi
jne 0x100333c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003461
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.01001c77
leave
ret 8
Function at 0x1003925
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001520
call fcn.01003ae8
cmp word [0x1000000], 0x5a4d
jne 0x1003964
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1003964
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x100397d
cmp ecx, 0x20b
je 0x100396a
and dword [ebp - 0x1c], 0
jmp 0x1003994
cmp dword [eax + 0x1000084], 0xe
jbe 0x1003964
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x100398e
cmp dword [eax + 0x1000074], 0xe
jbe 0x1003964
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1006a80], 0xffffffff
or dword [0x1006a84], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1005600]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10055fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1006a88], eax
call fcn.01003ade
cmp dword [0x1005254], 0
jne 0x10039f1
push fcn.01003ade
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003ac7
push 0x1001198
push 0x1001194
call sub.msvcrt.dll__initterm
mov eax, dword [0x10055f8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10055f4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1001190
push 0x1001188
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001a24
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1003a69
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003a9e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003b23
ret
Function at 0x490af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x490b49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x490b49
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x490b38
cmp esi, edx
jae 0x490b49
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x490b26
cmp esi, edx
jae 0x490b49
cmp word [esi], 0
je 0x490b49
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x491190
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x7adbc4]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, ecx
mov dword [esp + 4], 0
mov ecx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0x1c], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004910b0
mov esi, eax
test esi, esi
je 0x491211
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4911f8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00669a8a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x491279
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00491190
mov esi, eax
test esi, esi
jne 0x4912cb
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x491240
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x491292
push eax
call esi
mov dword [esp + 0xc], 0
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], 0
call fcn.00490e80
mov ecx, dword [esp + 0xc]
mov edi, eax
test ecx, ecx
je 0x4912b2
push ecx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00669a8a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4911f8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00669a8a
mov esp, ebp
pop ebp
ret 4