joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da974
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x4daa07
xor ebx, ebx
mov byte [ebp - 9], 0
lea eax, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp + 8]
call fcn.0045c480
dec edi
test edi, edi
jl 0x4daa07
inc edi
mov dword [ebp - 0x10], edi
xor edx, edx
inc ebx
mov esi, ebx
and esi, 0xff
mov al, byte [ebp + esi - 0x110]
add byte [ebp - 9], al
xor ecx, ecx
mov cl, byte [ebp - 9]
mov cl, byte [ebp + ecx - 0x110]
mov byte [ebp + esi - 0x110], cl
xor ecx, ecx
mov cl, byte [ebp - 9]
mov byte [ebp + ecx - 0x110], al
add al, byte [ebp + esi - 0x110]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0x4da9b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e9eb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4e9f67
add edx, ebx
mov eax, edx
mov edi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x20]
add edx, ebx
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x4e9f4b
test edi, edi
jbe 0x4e9f67
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.0040a518
test eax, eax
jne 0x4e9f3c
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0x4e9f67
add ebx, esi
mov esi, ebx
jmp 0x4e9f67
add dword [ebp - 8], 2
add dword [ebp - 4], 4
dec edi
test edi, edi
ja 0x4e9f11
jmp 0x4e9f67
mov edi, edx
sub edi, dword [eax + 0x10]
cmp edi, dword [eax + 0x14]
jae 0x4e9f67
mov eax, edi
shl eax, 2
add eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0x4e9f67
add ebx, esi
mov esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x420190
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435064]
jne 0x42019a
repz ret
jmp fcn.00424850
Function at 0x42ea70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
cmp dword [0x7636c0], 0x37
jne 0x42eb42
push 0
push 0x4171a0
push 0
push 0x4171e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4171f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0x417210
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea ecx, [ebp - 0x528]
push ecx
push 0x41723c
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x928]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
push 0x41724c
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0
push 0x417260
push 0
push 0x417280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov edx, dword [0x75b10c]
add edx, dword [ebp + 8]
mov eax, dword [0x7636c4]
add eax, dword [ebp + 8]
mov cl, byte [eax + 0x12336]
mov byte [edx], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x42efa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14d0
call fcn.00422c00
mov dword [ebp - 4], 0
jmp 0x42efbf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x42f045
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x7636c0], 0x9e
jne 0x42f035
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x4172a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0x417360
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
cmp dword [ebp - 4], 0x9be51dc
jle 0x42f040
jmp 0x42f045
jmp 0x42efb6
push 0x435e50
mov edx, dword [0x7636c0]
push edx
mov eax, dword [0x75b10c]
push eax
call fcn.0042ef30
mov dword [ebp - 0xa4], 0
jmp 0x42f077
mov ecx, dword [ebp - 0xa4]
add ecx, 1
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0xa4], 0x3e79e
jge 0x42f096
cmp dword [ebp - 0xa4], 0x1e673
jne 0x42f094
call fcn.0042ea50
jmp 0x42f068
mov dword [ebp - 0xa8], 0
jmp 0x42f0b1
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 0xdd9a7
jge 0x42f0dd
cmp dword [0x7636c0], 0xc01
jne 0x42f0db
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
jmp 0x42f0a2
jmp dword [0x75b10c]
Function at 0x1001b68
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b94
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001beb
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012e8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001bd5
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001beb
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001bf5
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003cba
xor eax, eax
jmp 0x1001bf8
push 1
pop eax
pop esi
leave
ret

Function at 0x1001bfb
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
je 0x1001c07
push 2
pop eax
jmp 0x1001c0c
call fcn.01001b3e
cmp eax, 2
jne 0x1001c54
test byte [esp + 4], 4
je 0x1001c1d
push 6
pop eax
jmp 0x1001c34
push 4
push 0x40
push 0
push 0x10012c4
push 0x522
push 0
call fcn.01003cba
cmp eax, 6
jne 0x1001c54
cmp word [0x100bc04], 0
jne 0x1001c4f
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1001c54
call fcn.01001b68
ret 4

Function at 0x1001c57
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100a300], 0
je 0x1001c9a
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c9a
push 0x100a300
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1001e91
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
xor ebx, ebx
cmp byte [0x100a300], bl
je 0x1001f89
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f89
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x344]
push eax
push ebx
mov esi, 0x100a300
push ebx
push esi
mov dword [ebp - 8], 0x238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f7f
mov al, byte [0x10012c4]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001f3a
lea eax, [ebp - 0x10c]
push 0x10012c4
push eax
call fcn.01005a72
lea eax, [ebp - 0x10c]
push 0x100ae84
push eax
lea eax, [ebp - 0x344]
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret

Function at 0x10020f2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100214f
lea eax, [ebp - 0x104]
push 0x1001324
push eax
call fcn.01005a72
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x100214f
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1002155
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100219e
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1002195
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x10021a6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10021f3
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10021ea
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1002248
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002265
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002268
and eax, 0x10
ret 4

Function at 0x100239a
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
and byte [edi], 0
cmp byte [esi], 0x23
jne 0x1002466
movsx eax, byte [esi + 1]
inc esi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov esi, eax
je 0x1002466
cmp bl, 0x57
je 0x100245a
lea eax, [ebp - 0x108]
push 0x1001334
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.01005a72
lea eax, [ebp + 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x108]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002470
lea eax, [ebp + 8]
push eax
push edi
push 0
push 0
push 0x10012c4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100244f
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002470
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1002470
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x100247d
push esi
push edi
call fcn.01005a72
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002825
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b6dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100ade0
rep stosd dword es:[edi], eax
mov ecx, 0xcb
mov edi, 0x100aaa0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100b720
pop ecx
mov esi, 0x100adf4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013a4
mov dword [0x100b08c], edi
call fcn.01003e14
cmp eax, ebx
je 0x1002a44
cmp eax, 0x80
ja 0x1002a44
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa7c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b6d4
push 0x1001398
call fcn.01003e14
test eax, eax
je 0x10028e2
test byte [0x100b6d4], 0xc0
je 0x1002972
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001388
call fcn.01003e14
test eax, eax
jne 0x1002901
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cba
mov dword [0x100b704], 0x80070714
jmp 0x1002a54
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa80], eax
je 0x1002972
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002972
test byte [0x100b6d4], 0x80
je 0x1002941
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003cba
jmp 0x1002957
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003cba
cmp eax, 6
je 0x1002972
push dword [0x100aa80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100b704], 0x800700b7
jmp 0x1002a54
push dword [ebp + 0xc]
mov dword [0x100b824], ebx
call fcn.0100523c
test eax, eax
jne 0x1002993
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1002a4e
cmp byte [0x100aaba], bl
je 0x10029aa
push 0x100aaba
call fcn.01001f8c
jmp 0x1002a54
push 0xa
push 0x100137c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10029cb
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2f8], ebx
je 0x10029d9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100aaa4], ebx
jne 0x1002a40
push dword [ebp - 4]
call fcn.01003149
test eax, eax
je 0x1002a54
mov ax, word [0x100bc04]
cmp ax, di
je 0x10029fe
cmp ax, 2
jne 0x1002a40
test byte [0x100b6d5], 1
je 0x1002a40
test byte [0x100aab8], 1
jne 0x1002a40
call fcn.01001600
test eax, eax
jne 0x1002a40
push 0x83e
push 0x547
push 0x100170a
push ebx
push 0x7d6
push dword [0x100b6dc]
call fcn.01005950
cmp eax, 0x83d
jne 0x1002a54
mov eax, edi
jmp 0x1002a56
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003cba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002b5d
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x10049a3
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [0x100ae80]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, esi
je 0x10049f6
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100aaa4], ebp
jne 0x10049e6
cmp dword [0x100b6d0], ebp
jne 0x10049e6
push pe_nt_image_headers32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x10049c1
cmp dword [0x100aaa0], ebp
je 0x1004a46
cmp dword [0x100aaa4], ebp
jne 0x1004a46
cmp dword [0x100b6d0], ebp
jne 0x1004a46
lea eax, [esp + 0x10]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004a31
lea eax, [esp + 0x10]
push eax
call fcn.01005ab1
push 0x1001318
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x10]
push eax
call fcn.01001f8c
cmp word [0x100bc04], 1
je 0x1004a5d
cmp dword [0x100aaa0], ebp
je 0x1004a5d
call fcn.01001c57
pop edi
mov dword [0x100aaa0], ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x10038e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor esi, esi
push 1
cmp dword [ebp + 8], esi
pop ebx
jne 0x10038ff
xor eax, eax
jmp 0x10039d7
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100398f
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100aaa8], esi
mov ecx, dword [ebp + 0xc]
jne 0x1003969
mov al, byte [0x100b6cc]
test bl, al
je 0x1003969
test al, 2
jne 0x1003969
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1003969
mov dword [0x100b6cc], ecx
push ecx
call fcn.010039dd
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
test byte [0x100b6d5], 4
je 0x10039d4
cmp dword [ebp + 0xc], esi
jge 0x10039d4
jmp 0x10039d2
call fcn.01005723
mov dword [0x100b704], eax
push esi
lea eax, [ebp - 0x210]
push 0x200
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
lea eax, [ebp - 0x210]
push 0x10
push eax
push dword [ebp + 8]
push 0x4c4
push esi
call fcn.01003cba
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003aba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x1003bd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1003bc1
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1003bc1
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1003bc1
cmp byte [0x100b720], bl
mov esi, 0x100b720
jne 0x1003b5e
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1003b5e
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1003b5e
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1003a99
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1003baf
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100b720], bl
je 0x1003ba9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1003be8
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1003bde
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003cba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1003e14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0xa
xor edi, edi
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
ja 0x1003e7d
cmp dword [ebp + 0xc], edi
je 0x1003e7d
cmp ebx, edi
je 0x1003e5d
push 0xa
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
jne 0x1003e61
xor eax, eax
jmp 0x1003e7f
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
mov esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003f14
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 1
pop ebx
push edi
mov esi, ebx
call fcn.01005a22
test eax, eax
jne 0x1003f2e
mov eax, ebx
jmp 0x1003f8d
cmp dword [0x100ae7c], 0
jne 0x1003f7b
test byte [0x100aab8], bl
jne 0x1003f7b
push 6
push 0
push 0x1002ecc
mov dword [0x100b0a4], edi
push dword [0x100aa78]
push 0x7d3
push dword [0x100b6dc]
call fcn.01005950
sub eax, 6
je 0x1003f79
dec eax
je 0x1003f93
sub eax, 0x832
jne 0x1003f7b
mov dword [0x100ae7c], ebx
mov esi, ebx
test esi, esi
je 0x1003f8b
push pe_nt_image_headers32
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
xor esi, esi
jmp 0x1003f7b

Function at 0x10040b9
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi]
test cl, cl
je 0x100411d
mov al, byte [edi + 1]
lea esi, [edi + 1]
xor ebx, ebx
cmp al, 0x3a
jne 0x10040dd
cmp byte [edi + 2], 0x5c
jne 0x10040dd
lea esi, [edi + 3]
jmp 0x10040ec
cmp cl, 0x5c
jne 0x10040ec
cmp al, cl
jne 0x10040ec
push 2
lea esi, [edi + 2]
pop ebx
mov al, byte [esi]
test al, al
je 0x100411d
cmp al, 0x5c
jne 0x1004112
cmp byte [esi - 1], 0x3a
je 0x1004112
test ebx, ebx
je 0x1004103
dec ebx
jmp 0x1004112
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x10040ec
pop edi
pop esi
pop ebx
ret 4

Function at 0x1004a6e
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
mov eax, edi
inc edi
push eax
lea eax, [esp + 0x14]
push 0x1001470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005a72
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004ad6
cmp edi, 0x190
jl 0x1004a83
jmp 0x1004ae9
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004ae9
push 1
pop ebp
mov dword [0x100aaa0], ebp
test ebp, ebp
jne 0x1004b14
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004b14
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8