joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005390
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1004b014]
mov dword [esp + 0xc], eax
mov eax, dword [0x1004b010]
push esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor ecx, ecx
add eax, 0x10
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
cmp ecx, dword [0x1004cf60]
jb 0x100053de
ja 0x100053d4
cmp eax, dword [0x1004cf5c]
jbe 0x100053de
mov eax, 0xfffffffc
pop esi
add esp, 0x28
ret
cmp dword [0x1004b01c], 0xffffffff
je 0x100054fc
mov eax, dword [0x1004cf54]
or eax, dword [0x1004cf58]
je 0x100054fc
push 0x1004cde4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esp + 8]
push esi
push dword [0x1004cf54]
call fcn.10015de0
mov eax, dword [0x1004b014]
add esp, 0xc
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
push 0
push 8
lea eax, [esp + 0x14]
push eax
push dword [0x1004b01c]
xorps xmm0, xmm0
movq qword [esp + 0x2c], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000547c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1000547c
push 0x1004cde4
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x28
ret
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x100054a2
push eax
push dword [0x1004b010]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100054c3
push dword [0x1004b01c]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x1004cde4
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x28
ret
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x20]
push eax
push dword [0x1004b01c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100054ae
mov esi, dword [esp + 4]
neg esi
sbb esi, esi
neg esi
push 0x1004cde4
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
add esp, 0x28
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x28
ret
Function at 0x100068c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1004b014]
push esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
test byte [esi + 0x12], 1
mov eax, dword [0x1004b010]
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
je 0x100068ef
xor eax, eax
pop esi
add esp, 0x28
ret
push ebx
push edi
mov edi, dword [esp + 0x40]
xor ecx, ecx
lea ebx, [edi + 0x16]
mov dword [esp + 0x14], ecx
lea eax, [ebx + 0x10]
mov dword [esp + 0x10], eax
cmp ecx, dword [0x1004cf60]
jb 0x10006923
ja 0x10006917
cmp eax, dword [0x1004cf5c]
jbe 0x10006923
pop edi
pop ebx
mov eax, 0xfffffffc
pop esi
add esp, 0x28
ret
cmp dword [0x1004b01c], 0xffffffff
je 0x10006a88
mov eax, dword [0x1004cf54]
or eax, dword [0x1004cf58]
je 0x10006a88
push 0x1004cde4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x1004cf54]
push edi
push dword [esp + 0x40]
mov dword [ecx + 4], 0
mov eax, dword [0x1004cf54]
mov dword [ecx + 0xc], ebx
mov dword [eax + 8], 0
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
movq xmm0, qword [esi]
movq qword [ecx + 0x10], xmm0
movq xmm0, qword [esi + 8]
movq qword [ecx + 0x18], xmm0
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x20], eax
mov ax, word [esi + 0x14]
mov word [ecx + 0x24], ax
lea eax, [ecx + 0x26]
push eax
call fcn.10015de0
mov eax, dword [0x1004b014]
add esp, 0xc
mov dword [esp + 0x30], 0
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push dword [0x1004b01c]
xorps xmm0, xmm0
movq qword [esp + 0x34], xmm0
movq qword [esp + 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10006a04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10006a04
push 0x1004cde4
mov esi, 0xfffffffc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
add esp, 0x28
ret
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x10006a2a
push eax
push dword [0x1004b010]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10006a4d
push dword [0x1004b01c]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x1004cde4
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
add esp, 0x28
ret
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x1004b01c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10006a36
mov esi, dword [esp + 0xc]
neg esi
sbb esi, esi
neg esi
push 0x1004cde4
dec esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
add esp, 0x28
ret
pop edi
pop ebx
mov eax, 0xfffffffd
pop esi
add esp, 0x28
ret
Function at 0x1000a700
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1000a700
push 0xffffffffffffffff
push 0x1003a19c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1004b3c8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
mov dword [edi], vtable.nfapi::EventQueue_class_nfapi::NFEvent_.0
push 0
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100017d5
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [esp + 0x18], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.10001dbb
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 1
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.10001dbb
mov dword [edi + 0x14], eax
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.10001c12
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 3
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.10001c12
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
mov dword [edi + 0x24], eax
push 0
mov dword [edi + 0x2c], 0xffffffff
call esi
push 0
push 0
mov dword [edi + 0x2c], eax
push 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0
mov dword [edi + 0x44], 0xffffffff
call esi
push 0
push 0
push 1
mov dword [edi + 0x44], eax
push 0
mov dword [edi + 0x48], 0xffffffff
call esi
lea ecx, [edi + 0x50]
xorps xmm0, xmm0
mov dword [edi + 0x48], eax
mov dword [edi + 0x34], 0
movq qword [ecx], xmm0
movq qword [ecx + 8], xmm0
movq qword [ecx + 0x10], xmm0
call fcn.1000196f
mov dword [edi + 0x4c], 1
mov byte [edi + 0x30], 0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1000a8c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x1000a8c0
push 0xffffffffffffffff
push 0x1003a1fc
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1004b3c8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
mov dword [edi], vtable.nfapi::EventQueue_class_nfapi::NFEventOut_.0
push 0
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1000123a
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [esp + 0x18], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.10001dbb
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 1
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.10001dbb
mov dword [edi + 0x14], eax
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.10001c12
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 3
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.10001c12
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
mov dword [edi + 0x24], eax
push 0
mov dword [edi + 0x2c], 0xffffffff
call esi
push 0
push 0
mov dword [edi + 0x2c], eax
push 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
push 0
mov dword [edi + 0x44], 0xffffffff
call esi
push 0
push 0
push 1
mov dword [edi + 0x44], eax
push 0
mov dword [edi + 0x48], 0xffffffff
call esi
lea ecx, [edi + 0x50]
xorps xmm0, xmm0
mov dword [edi + 0x48], eax
mov dword [edi + 0x34], 0
movq qword [ecx], xmm0
movq qword [ecx + 8], xmm0
movq qword [ecx + 0x10], xmm0
call fcn.1000196f
mov dword [edi + 0x4c], 1
mov byte [edi + 0x30], 0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10012860
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetServicesTcpip6Parameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10012886
xor al, al
add esp, 0x10
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x1003f0b4
push dword [esp + 0x18]
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100128bd
cmp dword [esp + 8], eax
je 0x100128bd
mov eax, dword [esp]
jmp 0x100128bf
xor eax, eax
cmp byte [esp + 0x14], 0
je 0x100128cb
or eax, 8
jmp 0x100128ce
and eax, 0xfffffff7
push esi
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.DisabledComponents
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x10
ret

Function at 0x10012980
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1004b3c8]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x124]
push eax
push str.SYSTEMCurrentControlSetServices_s
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.100164ee
add esp, 0x10
lea eax, [esp + 4]
push eax
push 3
push 0
lea eax, [esp + 0x1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100129f0
xor al, al
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10015717
add esp, 0x114
ret
cmp byte [esp + 0x11c], 0
je 0x10012a20
lea eax, [esp + 8]
push eax
push esi
lea eax, [esp + 0x14]
push eax
push 0
push 0x1003f024
push dword [esp + 0x18]
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x10012a36
push 4
push esi
push 4
push 0
push 0x1003f028
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
xor eax, eax
test esi, esi
sete al
pop esi
xor ecx, esp
call fcn.10015717
add esp, 0x114
ret
Function at 0x10012af0
Capabilities:
Create service
Query service status
Start service

Disassembly:
sub esp, 0x438
mov eax, dword [0x1004b3c8]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
push ebp
mov ebp, dword [esp + 0x448]
push esi
push edi
mov edi, dword [esp + 0x44c]
push edi
push 0x1003ef00
lea eax, [esp + 0x244]
push 0x104
push eax
xor bl, bl
mov dword [esp + 0x24], 0
xor esi, esi
call fcn.100165b5
add esp, 0x10
lea eax, [esp + 0x34]
push edi
test ebp, ebp
je 0x10012b5c
push ebp
push str._S_S.sys
push 0x104
push eax
call fcn.100165b5
add esp, 0x14
jmp 0x10012b6f
push str.system32drivers_S.sys
push 0x104
push eax
call fcn.100165b5
add esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10012b8e
or eax, 0xffffffff
jmp 0x10012cc4
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1003ef4c
lea ecx, [esp + 0x48]
push ecx
push 1
push 1
push 1
push 0xf01ff
lea ecx, [esp + 0x264]
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test byte [0x1004cdc4], 8
mov ebp, eax
je 0x10012bfc
test ebp, ebp
je 0x10012bdb
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x10012c9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, 0x431
jne 0x10012ca4
mov bl, 1
jmp 0x10012ca4
test ebp, ebp
je 0x10012c2b
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebp
jmp 0x10012ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x10012c9e
push 0x14
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x10012c95
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10012c69
cmp dword [esp + 0x1c], 4
jne 0x10012c69
mov bl, 1
jmp 0x10012c81
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
movzx ebx, bl
mov edx, 1
test eax, eax
cmovne ebx, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call ebp
jmp 0x10012ca4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x10]
call ebp
push 0
push edi
call fcn.100124f0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test bl, bl
setne al
dec eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10015717
add esp, 0x438
ret
Function at 0x10012ce0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x124
mov eax, dword [0x1004b3c8]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [str.NDIS]
mov ecx, dword [esp + 0x128]
mov dword [esp + 4], eax
movzx eax, byte [0x1003ef60]
mov byte [esp + 8], al
mov eax, dword [str.tcpip]
mov dword [esp + 0xc], eax
mov ax, word [0x1003ef68]
mov word [esp + 0x10], ax
movzx eax, byte [0x1003ef6a]
mov byte [esp + 0x12], al
mov eax, dword [0x1003ef6c]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [0x1003ef70]
push 0x1003ef74
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.100164ee
add esp, 0x10
lea eax, [esp]
push eax
push 3
push 0
lea eax, [esp + 0x28]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10012d8b
xor al, al
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.10015717
add esp, 0x124
ret
cmp byte [esp + 0x12c], 0
push esi
je 0x10012dca
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 5
lea eax, [esp + 0xc]
push eax
push 1
push 0
push 0x1003ef9c
push dword [esp + 0x18]
call esi
push 7
lea eax, [esp + 0x14]
push eax
push 7
push 0
push str.DependOnService
push dword [esp + 0x18]
call esi
jmp 0x10012de4
push 8
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push str.Group
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
xor eax, eax
test esi, esi
sete al
pop esi
xor ecx, esp
call fcn.10015717
add esp, 0x124
ret
Function at 0x10012e10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10012e35
xor al, al
add esp, 8
ret
cmp byte [esp + 0xc], 0
push esi
push edi
je 0x10012ecd
mov edi, dword [esp + 0x1c]
push edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x1003f05c
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10012e7b
mov eax, dword [edi]
add eax, 4
push eax
call fcn.100149a7
mov esi, dword [esp + 0x1c]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x10012e8d
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop esi
add esp, 8
ret
push edi
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x1003f064
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x10012f01
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
call fcn.10014932
add esp, 4
mov dword [esi], 0
pop edi
xor al, al
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x1c]
mov edx, dword [esi]
cmp edx, 4
jbe 0x10012ede
shr edx, 2
dec edx
jmp 0x10012ee0
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov dword [eax], edx
push dword [esi]
push dword [ecx]
push 3
push 0
push str.PNP_TDI
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
add esp, 8
ret
Function at 0x1001dc8a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004b3c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.100185be
mov dword [ebp - 0x14], eax
cmp dword [0x1004dd78], edi
jne 0x1001dd7b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1001dd08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1001de5b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1001de5b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001de5b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1004dd78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x1004dd7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1004dd80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1004dd88], eax
test eax, eax
je 0x1001dd78
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1004dd84], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1001dda0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001dd93
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1001ddb5
push 4
pop eax
jmp 0x1001de5d
cmp dword [ebp - 0x14], edi
je 0x1001ddb5
push dword [0x1004dd78]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1001dd9a
mov eax, dword [0x1004dd84]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1001de13
cmp dword [0x1004dd88], esi
je 0x1001de13
push eax
call ebx
push dword [0x1004dd88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1001de13
test eax, eax
je 0x1001de13
call ecx
test eax, eax
je 0x1001de08
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1001de08
test byte [ebp - 8], 1
jne 0x1001de13
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1001de43
mov eax, dword [0x1004dd7c]
cmp eax, esi
je 0x1001de40
push eax
call ebx
test eax, eax
je 0x1001de40
call eax
mov edi, eax
test edi, edi
je 0x1001de40
mov eax, dword [0x1004dd80]
cmp eax, esi
je 0x1001de40
push eax
call ebx
test eax, eax
je 0x1001de40
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1004dd78]
call ebx
test eax, eax
je 0x1001de5b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1001de5d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015717
leave
ret
Function at 0x1003011a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100181d5
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10030152
xor eax, eax
jmp 0x1003017e
cmp esi, dword [ebp - 4]
je 0x1003017b
cmp dword [ebp + 0xc], 0
je 0x1003017b
push dword [edi + 0x9c]
call fcn.1002fd28
push dword [edi + 0x9c]
mov esi, eax
call fcn.1001db66
pop ecx
pop ecx
cmp esi, eax
je 0x1003014e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x4090448b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x49290226
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219