joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100539d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x10053a60
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.100f8ff0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x10053a2f
sub eax, ebp
jmp 0x10053a31
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10053a20
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x10053a50
sub eax, ebp
jmp 0x10053a52
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10053a41
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x10053b93
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
mov dword [esp + 0x10], edx
cmp ebx, ecx
jbe 0x10053a88
mov ebx, ecx
test ebx, ebx
je 0x10053add
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10053aa9
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
call fcn.10056080
jmp 0x10053ac1
cmp eax, 2
jne 0x10053acb
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x10053abb
xor eax, eax
jmp 0x10053ac8
push ebx
call fcn.100529b0
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.100f8ff0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x10053b07
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x10053b1b
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x100539e0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x10053b93
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x10053b62
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x10053b42
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.100f8db0
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x10053b93
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x10053b7c
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.100f8db0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10067830
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10113c2b
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1015d2f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0
push 0x1012714c
lea ecx, [ebp - 0x2c]
call fcn.100041b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10033a40
mov ecx, eax
call fcn.1005af10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1002b8e0
cmp dword [ebp - 0x10], 0
je 0x100678a0
jmp 0x100678e8
xor ecx, ecx
mov byte [ebp - 0x2d], cl
push str.CHECK_failed:_field___NULL:
push 0x118f
push 0x10127164
push 3
lea ecx, [ebp - 0x58]
call fcn.100a1b10
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x68], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x5c]
or eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x68]
call fcn.100a1850
push eax
lea ecx, [ebp - 0x2d]
call fcn.100a1c20
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x5c]
and ecx, 1
je 0x10067903
and dword [ebp - 0x5c], 0xfffffffe
lea ecx, [ebp - 0x58]
call fcn.100a1b50
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x44]
call edx
mov dword [ebp - 0x6c], eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [eax + 0x100]
call edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x70]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100790e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x10079112
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x100790eb
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10085a10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101151ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1015d2f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x11], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x12], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.10004190
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.10004190
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10099dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.10099a32
push eax
push esi
push dword [ebp + 8]
call fcn.100999e7
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax

Function at 0x10099de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10099a32
push eax
push esi
push dword [ebp + 8]
call fcn.100999e7
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
inc ebp
loopne 0x10099ebd
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10099a32
push eax
push esi
push dword [ebp + 8]
call fcn.100999e7
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10099a22
push es
shl dword [ecx], cl
mov byte [0xff7c9d88], al
invalid
Function at 0x1009a150
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1009a0f9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1009a117
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1009a175
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
invalid
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1009a15c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1009a165
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1009a16f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1009a151
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1009a0db
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1009a1c2
dec eax
je 0x1009a1b9
sub eax, 3
je 0x1009a1b0
mov dword [ebp - 4], 0x40
jmp 0x1009a1df
mov dword [ebp - 4], 4
jmp 0x1009a1c5
mov dword [ebp - 4], 0x20
jmp 0x1009a1c5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1009a211
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1009a191
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10099a22
inc eax
adc ecx, dword [esi]
pop esi
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1009a21d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1009a250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dh, al
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
cld
invalid
call dword [edi - 0x3a]
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
Function at 0x1009a2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.10099a32
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100999e7
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10099a32
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100999e7
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.10099a32
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100999e7
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.10099a22
cmc
invalid
Function at 0x100a28b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10116d24
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1015d2f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
movzx ecx, byte [eax + 9]
test ecx, ecx
jne 0x100a28ec
jmp 0x100a2934
xor edx, edx
mov byte [ebp - 0x11], dl
push 0x1012a310
push 0x8a
push 0x1012a2dc
push 3
lea ecx, [ebp - 0x3c]
call fcn.100a1b10
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x4c]
call fcn.100a1850
push eax
lea ecx, [ebp - 0x11]
call fcn.100a1c20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x40]
and edx, 1
je 0x100a294f
and dword [ebp - 0x40], 0xfffffffe
lea ecx, [ebp - 0x3c]
call fcn.100a1b50
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
push eax
call fcn.10101ff5
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x100a2979
call fcn.100f7654
cmp dword [eax], 4
je 0x100a294f
cmp dword [ebp - 0x10], 0
jge 0x100a298c
call fcn.100f7654
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x100f30a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1015d2f0]
jne 0x100f30b0
repz ret
jmp fcn.100fcb62
Function at 0x1010cf2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100feb12
and dword [ebp - 4], 0
cmp dword [0x10162038], 0
mov ebx, eax
jne 0x1010cfdc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1010d08d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1010d08d
push eax
call fcn.100feaa0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10162038], eax
call esi
push eax
call fcn.100feaa0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1016203c], eax
call esi
push eax
call fcn.100feaa0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10162040], eax
call esi
push eax
call fcn.100feaa0
pop ecx
mov dword [0x10162048], eax
test eax, eax
je 0x1010cfdc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100feaa0
pop ecx
mov dword [0x10162044], eax
mov eax, dword [0x10162044]
cmp eax, ebx
je 0x1010d034
cmp dword [0x10162048], ebx
je 0x1010d034
push eax
call fcn.100feb1b
push dword [0x10162048]
mov esi, eax
call fcn.100feb1b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1010d034
test edi, edi
je 0x1010d034
call esi
test eax, eax
je 0x1010d02b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010d02b
test byte [ebp - 0xc], 1
jne 0x1010d034
or dword [ebp + 0x10], 0x200000
jmp 0x1010d06d
mov eax, dword [0x1016203c]
cmp eax, ebx
je 0x1010d06d
push eax
call fcn.100feb1b
pop ecx
test eax, eax
je 0x1010d06d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1010d06d
mov eax, dword [0x10162040]
cmp eax, ebx
je 0x1010d06d
push eax
call fcn.100feb1b
pop ecx
test eax, eax
je 0x1010d06d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10162038]
call fcn.100feb1b
pop ecx
test eax, eax
je 0x1010d08d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1010d08f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10111f76
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10111fa7
call fcn.100f7667
mov dword [eax], esi
call fcn.100f7654
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100f3f46
add esp, 0x14
push 0x16
pop eax
jmp 0x10111ffc
test dword [ebp + 0xc], 0xfffffff9
jne 0x10111f83
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10111fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100f767a
pop ecx
call fcn.100f7654
mov eax, dword [eax]
jmp 0x10111ffc
test al, 0x10
jne 0x10111ffa
test al, 1
je 0x10111ffa
test byte [ebp + 0xc], 2
je 0x10111ffa
call fcn.100f7667
mov dword [eax], 5
call fcn.100f7654
mov dword [eax], 0xd
jmp 0x10111fcb
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401812
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401829
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40185e
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40185a
cmp edi, eax
jae 0x40185e
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40184c
cmp edi, eax
jb 0x401862
xor eax, eax
jmp 0x40186b
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x402abf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x402acd
push 0xd
pop eax
jmp 0x402b00
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x402ad4
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x402f8b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x43f050]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push ecx
push dword [esi]
mov dword [ebp - 0x21c], ecx
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.00402f4d
mov ebx, eax
cmp ebx, edi
je 0x402ff1
cmp dword [ebp - 0x214], edi
je 0x402fea
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x403089
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403019
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402f8b
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x40309a
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x402ff9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], edi
je 0x403064
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call fcn.00403107
mov esi, eax
cmp dword [ebp - 0x214], edi
je 0x403087
push dword [ebp - 0x214]
call ebx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fc9d
leave
ret 4
cmp dword [ebp - 0x214], edi
je 0x4030ae
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x403089

Function at 0x403107
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x44fc08], 0
jne 0x403137
push 0x436278
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403130
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44fc0c], eax
mov byte [0x44fc08], 1
mov eax, dword [0x44fc0c]
test eax, eax
je 0x40314f
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x40315b
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x404d69
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x433407
call fcn.0042e975
mov eax, dword [0x440f0c]
mov ecx, 0x440f0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x3e8
add eax, 4
lea ecx, [ebp - 0x10]
call fcn.00405279
mov esi, dword [ebp - 0x10]
push 5
push 0
push 0
push esi
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.00401cc5
xor eax, eax
call fcn.0042ea14
ret 4

Function at 0x404fb9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebx + 0xc], 0x202
jne 0x40500c
push esi
push edi
mov esi, eax
lea edi, [ebx + 0x18]
add esi, 0x54
push edi
call fcn.0041f50d
lea eax, [ebp - 4]
push eax
call fcn.0041f52f
mov eax, dword [edi]
push edi
mov dword [ebx + 0x1c], eax
call fcn.0041f50d
push 5
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401cc5
pop edi
pop esi
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
leave
ret 4

Function at 0x405018
Capabilities:
Check os version

Disassembly:
push ebx
push esi
lea esi, [eax + 0x6c]
mov eax, dword [eax + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [esi + 8], eax
call edi
movzx ebx, al
call edi
shr eax, 8
movzx eax, al
cmp ebx, 6
ja 0x405042
jne 0x40506a
test eax, eax
jbe 0x40506a
mov eax, dword [esi]
test eax, eax
je 0x405051
and dword [esi], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 0x439350
push 0x17
push 0
push 0x43446c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40506e
or dword [esi + 4], 0xffffffff
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x405279
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x4052ce
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
push edi
call fcn.00401ac3
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4052c2
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4052c2
push ecx
push eax
call fcn.0042048e
pop ecx
pop ecx
mov edx, esi
call fcn.00401ae9
mov eax, edi
pop edi
jmp 0x4052d5
call fcn.004019a8
xor eax, eax
pop esi
pop ebx
ret 4