joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ec99
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1004eaa7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004ee08
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004ee08
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004edbd
jg 0x1004ecf5
test eax, eax
je 0x1004edb3
push 1
push 0x1000
call fcn.10051539
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004ed18
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004edaa
push 0x8000
push ebx
call fcn.1004c57e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004ed41
jg 0x1004ed3c
cmp ecx, 0x1000
jb 0x1004ed41
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10049771
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004ed86
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004ed3c
jl 0x1004ed6d
test ecx, ecx
jne 0x1004ed2e
push dword [ebp - 0xc]
push ebx
call fcn.1004c57e
push esi
call fcn.1004c35c
add esp, 0xc
xor ebx, ebx
jmp 0x1004ee16
cmp byte [edi + 0x24], 0
je 0x1004ed9d
cmp dword [edi + 0x20], 5
jne 0x1004ed9d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004eda8
mov ebx, dword [edi + 0x18]
jmp 0x1004edaa
xor ebx, ebx
push esi
call fcn.1004c35c
pop ecx
jmp 0x1004ee16
test ecx, ecx
jg 0x1004ed7f
jl 0x1004edbd
test eax, eax
jae 0x1004ed7f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10048dbc
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004eddd
cmp byte [edi + 0x1c], 0
je 0x1004ed7f
jmp 0x1004ee0e
push ebx
call fcn.1004e811
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004ed7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004ee16
cmp byte [edi + 0x1c], 0
je 0x1004ee13
mov ebx, dword [edi + 0x18]
jmp 0x1004ee16
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10048dbc
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100564d2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100563a6
Function at 0x1005a333
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1007c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x1005a37e
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.1005a690
test al, al
jne 0x1005a378
sub edx, 2
cmp edx, edi
jne 0x1005a35e
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x1005a3a0
lea eax, [edi + 2]
cmp edx, eax
je 0x1005a3a0
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.10059ffa
add esp, 0x10
jmp 0x1005a49a
push esi
lea ecx, [ebp - 0x255]
call fcn.1005a690
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1005a3e3
push dword [ebp - 0x25c]
jmp 0x1005a390
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x1005a420
cmp word [ebp - 0x226], 0
je 0x1005a441
cmp word [ebp - 0x226], ax
jne 0x1005a420
cmp word [ebp - 0x224], 0
je 0x1005a441
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.10059ffa
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x1005a48d
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x1005a3fa
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x1005a475
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1005a49a
push 0x10059bfc
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10022270
add esp, 0x10
jmp 0x1005a46a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015fd5
leave
ret
Function at 0x1005b6d8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005b775
push ebx
push esi
call fcn.1005b694
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10051130
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005b722
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005b774
push edi
push eax
call fcn.1004c396
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005b742
call fcn.1004c35c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005b773
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10051130
add esp, 0x20
test eax, eax
jne 0x1005b761
push edi
call fcn.1004c35c
jmp 0x1005b769
push ebx
call fcn.1004c35c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1005b778
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1005b789
pop esi
ret
push ebx
push edi
push esi
call fcn.1005b694
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1004c396
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1005b7b1
push ebx
push esi
push edi
call fcn.1001fe90
add esp, 0xc
push 0
call fcn.1004c35c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1005c055
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005ba26

Function at 0x1005f5fe
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004cef3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005f66d
cmp esi, dword [ebp - 4]
je 0x1005f668
cmp dword [ebp + 0xc], 0
je 0x1005f668
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005f645
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005f150
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1005f66f
xor eax, eax
inc eax
jmp 0x1005f66f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1005f6d4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004cef3
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004cef3
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1005f74b
cmp word [ecx], dx
je 0x1005f74b
mov eax, dword [0x100741c4]
push edi
dec eax
push eax
push 0x100740b0
call fcn.1005f673
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1005f7be
cmp word [eax], dx
je 0x1005f7be
mov eax, dword [edi]
test eax, eax
je 0x1005f76f
cmp word [eax], dx
je 0x1005f76f
lea eax, [ebp - 0x10]
push eax
call fcn.1005f056
jmp 0x1005f778
lea eax, [ebp - 0x10]
push eax
call fcn.1005f0f1
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1005f7e8
mov eax, dword [0x100740ac]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10073da0
call fcn.1005f673
add esp, 0xc
test al, al
je 0x1005f7e8
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1005f7b3
cmp word [eax], di
je 0x1005f7b3
lea eax, [ebp - 0x10]
push eax
call fcn.1005f056
pop ecx
jmp 0x1005f7ea
lea eax, [ebp - 0x10]
push eax
call fcn.1005f0f1
jmp 0x1005f7b0
mov eax, dword [edi]
test eax, eax
je 0x1005f7d5
cmp word [eax], dx
je 0x1005f7d5
lea eax, [ebp - 0x10]
push eax
call fcn.1005efed
pop ecx
jmp 0x1005f7e8
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1005f8b3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1005f4f8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1005f8b3
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1005f8b3
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1005f8b3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005f840
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1004dee7
test ebx, ebx
je 0x1005f8ae
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1004dee7
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005f8b3
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005f8b3
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10055ccd
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1005f8b5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015fd5
leave
ret
Function at 0x1005fd1f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1005fd62
call fcn.10042578
mov dword [eax], 0xf
call fcn.1004258b
mov dword [eax], 0xd
call fcn.1004b9c3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015fd5
leave
ret
test eax, eax
jne 0x1005fd69
inc eax
jmp 0x1005fd56
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1005fd54
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1005fd56

Function at 0x40c7fb
Capabilities:
Encode data using xor

Disassembly:
adc byte [ecx + 0x38fcfcfc], bl
or al, 0x10
adc al, 0x18
arpl word [ecx + 0x2036f8b3], di
and al, 0x28
sub al, 0x30
xor al, 0x1c
xor al, 0x1c
cmp byte [eax + 0x46c72c], bh
mov eax, 0x46c72c
push eax
push dword fs:[0]
mov dword fs:[0], esp
and eax, 0
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x40c87b
arpl word [edx + esi], si
je 0x40c898
inc ecx
sub al, 0x61
jl 0x40c7dc
sub byte [ecx], 0xcb
bound eax, qword [edi - 0x7c]
ja 0x40c80a
jno 0x40c7f7
mov byte [eax + edx*4 + 0x1dc771dc], cl
xchg esp, eax
cwde
pushfd
adc al, 0xc6
sbb eax, 0xa8a4a077
xchg edx, eax
sub al, 0x61
sub al, 0x81
dec esp
aad 0xf3
xor eax, 0x83d40ca8
cmp eax, dword [0x290d2ef8]
jae 0x40c83c
pop ebp
in eax, dx
push 0x38c2fc19
daa
arpl word [ebx], di
das
dec edi
sub al, 0x67
dec esi
hlt
sbb byte [eax], dl
sbb al, 0x14
invalid
mov eax, dword [0x3702acb1]
mov cl, 0xac
add dh, byte [edi]
sal byte [eax], 0x22
or dword [edi], ecx
stosd dword es:[edi], eax
add al, 0x24
jmp 0x40c897
Function at 0x4012a4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [0x41b5b0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5b4]
mov dword [ebp - 0x34], eax
call fcn.0040129d
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5b8]
add edi, 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5bc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0x2d3ee8c]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132d
push 0x418228
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x2d3ee8c]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d3ee88]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x2d3ee88], eax
mov eax, dword [0x2d3ede0]
cmove eax, dword [ebp - 0x24]
mov dword [0x2d3ede0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x2d3ee84], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4012f5
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d37c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404ce5
mov dword [ebp - 0x14], eax
cmp dword [0x445540], esi
jne 0x40d46f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d54f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d54f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d54f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x445540], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x445544], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x445548], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x445550], eax
test eax, eax
je 0x40d46c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44554c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d494
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d487
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d4a9
push 4
pop eax
jmp 0x40d551
cmp dword [ebp - 0x14], esi
je 0x40d4a9
push dword [0x445540]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d48e
mov eax, dword [0x44554c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d507
cmp dword [0x445550], edi
je 0x40d507
push eax
call ebx
push dword [0x445550]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d507
test eax, eax
je 0x40d507
call ecx
test eax, eax
je 0x40d4fc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4fc
test byte [ebp - 8], 1
jne 0x40d507
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d537
mov eax, dword [0x445544]
cmp eax, edi
je 0x40d534
push eax
call ebx
test eax, eax
je 0x40d534
call eax
mov esi, eax
test esi, esi
je 0x40d534
mov eax, dword [0x445548]
cmp eax, edi
je 0x40d534
push eax
call ebx
test eax, eax
je 0x40d534
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x445540]
call ebx
test eax, eax
je 0x40d54f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d551
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040404b
mov esp, ebp
pop ebp
ret
Function at 0x546100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x546015
lea edi, [esi - 0x145015]
push edi
or ebp, 0xffffffff
jmp 0x546122
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x546129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x546118
mov eax, 1
add ebx, ebx
jne 0x54613b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x546130
jne 0x54614c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x546130
xor ecx, ecx
sub eax, 3
jb 0x546160
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5461d2
mov ebp, eax
add ebx, ebx
jne 0x54616b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x546178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x54619c
inc ecx
add ebx, ebx
jne 0x546188
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54617d
jne 0x546199
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54617d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5461bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5461ad
jmp 0x54611e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5461bc
add edi, ecx
jmp 0x54611e
pop esi
mov ebp, dword [esi + 0x14a1b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x546207
sub esp, 0xffffff80
jmp 0x543ef0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003050
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x10003074
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x100030e0
push 0
push 0
call fcn.1009f7d7
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret

Function at 0x10003090
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0xc], eax
je 0x100030d8
cmp byte [ebp + 8], 0
je 0x100030d8
mov eax, dword [esi + 8]
test eax, eax
je 0x100030d8
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100030d8
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
pop esi
pop ebp
ret 8
Function at 0x100064f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4926
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.10075220
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1010]
push 0x1000
push 0
mov dword [ebp - 0x1034], esi
push eax
mov dword [ebp - 0x1030], 1
call fcn.1009c2f0
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x102c], 0x800
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAcNYT9wv6OGo2LxfcPIj7LcA
push eax
call fcn.100473c0
add esp, 0x14
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x102c]
push ecx
lea ecx, [ebp - 0x1010]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x1030]
push ecx
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push str.InstallLocation
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100065e2
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebx + 0x58]
cmp dword [eax - 0xc], 0
je 0x100065e2
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10006440
mov ecx, eax
test ecx, ecx
je 0x10006699
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x1010]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.10005ae0
test al, al
jne 0x1000663e
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006620
sub ecx, edx
lea eax, [ebp - 0x1010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10006f80
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x1000667a
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006670
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100066a3
push edx
push ecx
call fcn.10074e52
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005aa0
call fcn.1009fa75
int3