joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ec60
Capabilities:
Get process heap flags
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x413be3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.00401000
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.004010a0
lea ecx, [esp + 0x14]
call fcn.00410ff8
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x1c]
push str.SELECTFROM_Ygjcxxb_WHERE_YGid_s_and_YGxm_s
push edx
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::Format
xor edi, edi
add esp, 0x10
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.00402540
push ecx
mov ebp, eax
mov dword [esp + 0x14], esp
mov ebx, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
mov byte [esp + 0x34], 5
je 0x40ed21
push ebp
mov dword [esi + 4], edi
mov dword [esi + 8], 1
call fcn.004115da
test eax, eax
mov dword [esi], eax
jne 0x40ed23
test ebp, ebp
je 0x40ed23
push 0x8007000e
call fcn.0041171f
jmp 0x40ed23
xor esi, esi
test esi, esi
mov byte [esp + 0x34], 4
mov dword [ebx], esi
jne 0x40ed38
push 0x8007000e
call fcn.0041171f
lea ecx, [esp + 0x20]
call fcn.00401550
mov eax, dword [eax]
test eax, eax
je 0x40ed55
mov ecx, dword [eax]
mov edi, eax
push eax
mov dword [esp + 0x1c], edi
call dword [ecx + 4]
jmp 0x40ed5f
push 0x80004003
call fcn.0041171f
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push edi
call dword [edx + 0x50]
test eax, eax
jge 0x40ed7a
push 0x41b188
push edi
push eax
call fcn.0041172d
cmp word [esp + 0x10], 0
mov byte [esp + 0x30], 3
je 0x40edd1
test edi, edi
je 0x40ed91
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
jmp 0x40ee1b
test edi, edi
je 0x40eddb
mov edx, dword [edi]
push edi
call dword [edx + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.00401040
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x405646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x405655
pop dword [ebp - 0xc]
mov eax, 0xbcef25d6
sub eax, 0xbcaecf81
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x74b18e32
add dword [ebp - 0x1c], 0xd9a0b719
mov dword [ebp - 0x18], 0x980c6d4e
add dword [ebp - 0x18], 0x9a26def7
mov dword [ebp - 0x14], 0x3b0330b4
sub dword [ebp - 0x14], 0xeeb6ec86
mov dword [ebp - 0x10], 0x82a13162
add dword [ebp - 0x10], 0x7d5ece9e
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb5190498
sub eax, 0xb4d89354
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x61bcc871
add dword [ebp - 0x1c], 0x12b5a0e5
mov dword [ebp - 0x18], 0x43005c1b
add dword [ebp - 0x18], 0xfe6c055a
mov dword [ebp - 0x14], 0xf0b419b4
add dword [ebp - 0x14], 0x72bb52b8
mov dword [ebp - 0x10], 0x5c5fdefc
sub dword [ebp - 0x10], 0x5c5fdefc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x53ffd51
add eax, 0xfb0073bf
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x355c3
push 0
call eax
mov ecx, 0x41c3
xor esi, esi
add esi, eax
mov edx, 0x7de28e80
sub edx, 0x7d9f2e80
add edx, dword [ebp - 0xc]
mov ebx, 0x42786159
xor dword [ebp - 8], 0x3e4eed16
mov edi, dword [edx]
sub dword [ebp - 8], 0xf8052a7e
xor edi, ebx
sub dword [ebp - 8], esi
mov dword [esi], edi
sub dword [ebp - 4], 0x3b81318
add esi, 4
add edx, 0xd8434a95
sub edx, 0xd8434a91
loop 0x40576d
add eax, 0xa939c6e5
sub eax, 0xa938cd06
mov ebx, eax
add eax, 0xe05bb210
sub eax, 0xe05bb20b
mov ecx, 0xe56769ec
sub ecx, 0xe52769ec
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4058f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421968
push esi
call fcn.00405d21
push esi
call fcn.004058a8
mov edi, eax
test edi, edi
jne 0x405916
xor eax, eax
jmp 0x405968
push edi
call fcn.00405f83
test byte [0x423f78], 0x80
je 0x40592f
mov al, byte [edi]
test al, al
je 0x405912
cmp al, 0x5c
je 0x405912
sub edi, esi
jmp 0x405947
call fcn.0040601c
test eax, eax
je 0x405941
test byte [eax], 0x10
je 0x405912
push esi
call fcn.0040585b
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405933
call fcn.00405814
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059f5
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x4059f8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070041b6
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x700d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
je 0x700d95b
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070041b6
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d999
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d98c
push 0x7013b70
jmp 0x700d954
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8

Function at 0x700dbc5
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010ec2
call fcn.07001aa5
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0700da5a
and dword [esi + 0xc], 0
and dword [ebp - 4], 0
mov dword [esi], vtable.FileSharedStream.0
mov byte [esi + 0x10], 0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0700d99e
lea ecx, [ebp + 8]
call fcn.0700d6a0
mov eax, dword [esi + 0x14]
push dword [eax + 0x14]
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
call edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc35
mov eax, dword [eax + 0x14]
jmp 0x700dc3a
mov eax, 0x7012365
push 0x7013bb4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x700dc5a
push 0x7013ba0
push eax
call fcn.070041b6
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
call edi
push dword [ebp + 8]
mov ecx, 0x701a480
call fcn.070041b6
mov eax, esi
call fcn.07002d5f
ret 4
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100020b2
Capabilities:
Check os version
Initialize winhttp library
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.1000774f
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x100021fd
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
ja 0x100020e3
jne 0x100020de
cmp ah, 2
ja 0x100020e3
mov dword [ebp + 8], ebx
jmp 0x100020ea
mov dword [ebp + 8], 4
push ebx
push ebx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push edi
mov dword [esi + 0x10], eax
call fcn.10005dd8
cmp dword [esi + 0x10], ebx
je 0x100021fd
push dword [esi]
call fcn.1000774f
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100021fd
cmp dword [ebp + 0xc], ebx
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
je 0x1000213b
push 4
lea eax, [ebp + 0xc]
push eax
push 3
push dword [esi + 0x10]
call edi
test eax, eax
je 0x100021fd
push ebx
push 0x50
push dword [ebp - 4]
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
push dword [ebp - 4]
mov dword [esi + 0x14], eax
call fcn.10005dd8
cmp dword [esi + 0x14], ebx
je 0x100021fd
push dword [esi + 4]
mov ebx, 0x100
mov dword [ebp + 8], ebx
call fcn.1000774f
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x100021fd
push dword [ebp + 8]
mov eax, dword [0x1000a2d4]
push ecx
push ecx
push ecx
push dword [ebp - 4]
lea eax, [eax + 0x1000b768]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
push dword [ebp - 4]
mov dword [esi + 0x18], eax
call fcn.10005dd8
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100021fd
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp + 8]
push ecx
push 0x1f
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
test eax, eax
je 0x100021d7
or dword [ebp + 8], ebx
push 4
lea eax, [ebp + 8]
push eax
push 0x1f
push dword [esi + 0x18]
call edi
push 4
lea eax, [ebp + 0xc]
push eax
push 6
push dword [esi + 0x18]
call edi
test eax, eax
je 0x100021fd
push 4
lea eax, [ebp + 0xc]
push eax
push 5
push dword [esi + 0x18]
call edi
test eax, eax
je 0x100021fd
xor eax, eax
jmp 0x10002203
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
leave
ret 8
Function at 0x1000259f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x28
push 0x100092b8
call fcn.10007d94
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp word [eax + 4], 0x14c
jne 0x100025c8
add eax, 0x78
jmp 0x100025cd
add eax, 0x88
mov esi, dword [eax]
add esi, ecx
cmp dword [eax], edx
je 0x100026bb
cmp dword [eax + 4], edx
je 0x100026bb
cmp dword [esi + 0x1c], edx
je 0x100026bb
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x28], eax
cmp eax, edx
je 0x100026bb
mov eax, dword [esi + 0x1c]
add eax, ecx
mov dword [ebp - 0x30], eax
cmp dword [esi + 0x24], edx
je 0x100026ab
mov edi, dword [esi + 0x24]
add edi, ecx
mov dword [ebp - 0x38], edi
mov ebx, dword [esi + 0x20]
add ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jae 0x100026bb
and dword [ebp - 0x1c], 0
xor eax, eax
inc eax
je 0x1000263c
movzx ecx, word [edi]
add ecx, dword [esi + 0x10]
cmp eax, ecx
jmp 0x1000266d
mov eax, dword [ebx]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor ecx, ecx
inc ecx
je 0x1000265a
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002676
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jmp 0x1000266d
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x2c]
call fcn.10007704
xor ecx, ecx
cmp ecx, eax
jne 0x10002676
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x10002695
movzx eax, word [edi]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x20], eax
xor eax, eax
je 0x100026bb
mov ecx, dword [ebx]
add ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x100026bb
add ebx, 4
mov dword [ebp - 0x34], ebx
inc edi
inc edi
mov dword [ebp - 0x38], edi
inc dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
jmp 0x1000261d
mov dword [ebp - 0x20], eax
jmp 0x100026bb
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
call fcn.10007dcf
ret 4

Function at 0x1000288c
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x10002973
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push edi
push edi
push SysStringLen
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x10002a7c
push ebx
push 8
pop esi
mov ebx, 0x104
push ebx
call fcn.10003bf6
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x10002a72
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
push edi
push edi
push edi
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0xea
jne 0x10002a24
cmp dword [ebp - 8], ebx
jbe 0x100029fc
inc dword [ebp - 4]
xor esi, esi
jmp 0x10002a46
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jbe 0x10002a6a
push dword [ebp - 0x14]
call fcn.10005dd8
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x10], eax
call fcn.10003bf6
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x100029f8
push 8
pop esi
jmp 0x10002a6a
cmp esi, edi
jne 0x10002a60
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.10001817
mov esi, eax
cmp esi, edi
jne 0x10002a60
push edi
push dword [0x1000a2c4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100029c6
jmp 0x10002a6a
cmp esi, 0x103
jne 0x10002a6a
xor esi, esi
push dword [ebp - 0x18]
call fcn.10005dd8
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x10002e06
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
jne 0x10002e24
mov eax, dword [0x1000a2c8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.100058dc
cmp edi, ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
jne 0x10002e8a
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10002e99
add eax, eax
push eax
push ebx
push dword [0x1000a290]
call edi
mov ebx, eax
test ebx, ebx
je 0x10002e99
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10002e79
mov eax, dword [ebp - 4]
add eax, eax
mov ecx, ebx
call fcn.10007704
xor dword [esi], eax
push ebx
push 0
push dword [0x1000a290]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10002e99
mov eax, dword [esi]
xor eax, dword [0x1000a2d0]
xor eax, 0x4c0ca0ae
mov dword [esi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x10002eee
add eax, eax
push eax
push 0
push dword [0x1000a290]
call edi
mov edi, eax
test edi, edi
je 0x10002eee
lea eax, [ebp - 4]
push eax
push edi
call ebx
test eax, eax
je 0x10002edf
mov eax, dword [ebp - 4]
add eax, eax
mov ecx, edi
call fcn.10007704
xor dword [esi + 0xc], eax
push edi
push 0
push dword [0x1000a290]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
inc eax
cpuid
lea edi, [ebp - 0x18]
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
pop edi
xor eax, dword [ebp - 0x18]
pop ebx
xor dword [esi + 4], eax
leave
ret
Function at 0x10003a9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x10003ace
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100026ca
mov esi, eax
cmp esi, ebx
je 0x10003b55
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
cmp esi, ebx
jne 0x10003b55
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call esi
cmp dword [ebp + 8], ebx
je 0x10003b47
push dword [ebp + 8]
call fcn.10003bf6
mov edi, eax
cmp edi, ebx
je 0x10003b42
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call esi
mov esi, eax
cmp esi, ebx
jne 0x10003b3a
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x10003b4c
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x10003b4c
push edi
call fcn.10005dd8
jmp 0x10003b4c
push 8
pop esi
jmp 0x10003b4c
mov esi, 0xe8
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18

Function at 0x10003d49
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [edx + 0x3c]
add ecx, edx
movzx edx, word [ecx + 0x14]
push esi
movzx esi, word [ecx + 6]
xor eax, eax
lea ecx, [edx + ecx + 0x18]
xor edx, edx
cmp dword [ecx + 4], eax
jne 0x10003d6e
cmp dword [ecx], 0x7373622e
jne 0x10003d6e
mov edx, ecx
add ecx, 0x28
dec esi
je 0x10003d78
cmp edx, eax
je 0x10003d5f
cmp edx, eax
je 0x10003d9c
mov ecx, dword [edx + 0xc]
cmp ecx, eax
je 0x10003d98
mov edx, dword [edx + 0x10]
cmp edx, eax
je 0x10003d98
mov esi, dword [esp + 8]
mov dword [esi], ecx
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
jmp 0x10003d9f
push 0xb
jmp 0x10003d9e
push 2
pop eax
pop esi
ret 8

Function at 0x10003ecd
Capabilities:
Check os version

Disassembly:
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x1000a2c4], eax
je 0x10003f2f
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x10003f2a
mov dword [0x1000a2b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 4]
push eax
push 0
push 0x10047a
mov dword [0x1000a2b0], eax
mov dword [0x1000a2bc], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [0x1000a2ac], eax
jne 0x10003f26
or dword [0x1000a2ac], 0xffffffff
xor eax, eax
jmp 0x10003f35
push 0x32
pop eax
jmp 0x10003f35
call dword [sym.imp.KERNEL32.dll_GetLastError]
ret 4
Function at 0x10004b25
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x192
push 0x54d38000
push dword [ebp - 4]
push dword [ebp - 8]
call sub.ntdll.dll__aulldiv
push eax
mov dword [ebp - 8], eax
mov eax, dword [0x1000a2d4]
lea ecx, [eax + 0x1000b8a2]
push ecx
lea eax, [eax + 0x1000b57c]
push eax
lea eax, [ebp - 0x34]
push 0x16
push eax
mov dword [ebp - 4], edx
call sub.ntdll.dll__snwprintf
add esp, 0x14
lea eax, [ebp - 0x34]
push eax
push 0x1000
push 0
push 4
push 0x1000a2f8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x10004bda
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x10004ba8
push 2
pop edi
jmp 0x10004bd1
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10004bc9
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor edi, edi
jmp 0x10004be2
call edi
mov edi, eax
test edi, edi
je 0x10004be2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004be2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x10004bea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000a2d4]
and dword [ebp - 4], 0
push ebx
lea eax, [eax + 0x1000ba30]
push eax
mov dword [ebp - 0xc], 4
call fcn.10004a68
mov ebx, eax
test ebx, ebx
je 0x10004c7c
mov eax, dword [0x1000a2d4]
push edi
lea eax, [eax + 0x1000ba8c]
push eax
call fcn.10004a68
mov edi, eax
test edi, edi
je 0x10004c75
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004c6f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10004c66
and dword [ebp - 4], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.10005dd8
push ebx
call fcn.10005dd8
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret