joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032fb8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10050478]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10032ffe
cmp word [ebx], dx
jne 0x10032ffe
or byte [eax + edi + 0x28], 4
jmp 0x10033003
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10033166
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10033146
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10033044
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1003307a
cmp eax, edx
jae 0x10033088
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1003301f
jmp 0x10033166
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10033141
cmp dword [ebp - 0x18], 0
je 0x10033141
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10050478]
test byte [eax + edi + 0x28], 0x48
je 0x10033117
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100330db
mov word [esi], cx
jmp 0x10033112
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10050478]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10050478]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10050478]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10033166
pop eax
cmp word [ebp - 4], ax
jne 0x10033127
cmp esi, ebx
jne 0x10033127
mov word [esi], ax
jmp 0x10033163
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100339f1
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10033166
push 0xd
pop eax
jmp 0x10033122
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10050478]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10033160
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10033166
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10035c55
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10035cf2
push ebx
push esi
call fcn.10035c1e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10034a32
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10035c9f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035cf1
push edi
push eax
call fcn.1002d065
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10035cbf
call fcn.1002d02b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035cf0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10034a32
add esp, 0x20
test eax, eax
jne 0x10035cde
push edi
call fcn.1002d02b
jmp 0x10035ce6
push ebx
call fcn.1002d02b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10039a5a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1002e4a4
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10039ac9
cmp esi, dword [ebp - 4]
je 0x10039ac4
cmp dword [ebp + 0xc], 0
je 0x10039ac4
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10039aa1
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100395ac
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10039acb
xor eax, eax
inc eax
jmp 0x10039acb
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10039b30
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1002e4a4
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1002e4a4
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10039ba7
cmp word [ecx], dx
je 0x10039ba7
mov eax, dword [0x1004384c]
push edi
dec eax
push eax
push 0x10043738
call fcn.10039acf
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10039c1a
cmp word [eax], dx
je 0x10039c1a
mov eax, dword [edi]
test eax, eax
je 0x10039bcb
cmp word [eax], dx
je 0x10039bcb
lea eax, [ebp - 0x10]
push eax
call fcn.100394b2
jmp 0x10039bd4
lea eax, [ebp - 0x10]
push eax
call fcn.1003954d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10039c44
mov eax, dword [0x10043734]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10043428
call fcn.10039acf
add esp, 0xc
test al, al
je 0x10039c44
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10039c0f
cmp word [eax], di
je 0x10039c0f
lea eax, [ebp - 0x10]
push eax
call fcn.100394b2
pop ecx
jmp 0x10039c46
lea eax, [ebp - 0x10]
push eax
call fcn.1003954d
jmp 0x10039c0c
mov eax, dword [edi]
test eax, eax
je 0x10039c31
cmp word [eax], dx
je 0x10039c31
lea eax, [ebp - 0x10]
push eax
call fcn.10039467
pop ecx
jmp 0x10039c44
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10039d0f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10039954
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10039d0f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10039d0f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10039d0f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10039c9c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1003100d
test ebx, ebx
je 0x10039d0a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1003100d
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10039d0f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10039d0f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1003aab1
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10039d11
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001de4f
leave
ret
Function at 0x1003c300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003c32d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003c32d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405a12
pop dword [ebp - 0x44]
mov eax, 0x717951a9
add eax, 0x8ec70869
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x60ccbf54
add dword [ebp - 0x54], 0xed8585f7
mov dword [ebp - 0x50], 0xe3d68639
add dword [ebp - 0x50], 0x4e5cc60c
mov dword [ebp - 0x4c], 0xe0685c10
sub dword [ebp - 0x4c], 0x941c17e2
mov dword [ebp - 0x48], 0x90f6f194
sub dword [ebp - 0x48], 0x90f6f194
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe5014377
add eax, 0x1b3f3d8d
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb74c5fb7
add dword [ebp - 0x54], 0xbd26099f
mov dword [ebp - 0x50], 0x3e5f3edf
sub dword [ebp - 0x50], 0xfcf2dd6a
mov dword [ebp - 0x4c], 0xc95cf685
sub dword [ebp - 0x4c], 0x65ed8a19
mov dword [ebp - 0x48], 0xd9a0bba2
add dword [ebp - 0x48], 0x265f445e
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x2b3f0b78
add eax, 0xd5017588
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x35dd8
push 0
call eax
mov ecx, 0x1110f6cb
add ecx, 0xeeef4cbf
mov edi, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x44]
mov ebx, 0x3af1e08c
add ebx, 0xd3c10ab
mov dword [ebp - 4], 0x31565c0c
mov edx, dword [esi]
add dword [ebp - 0x40], 0xc53fed97
xor edx, ebx
xor dword [ebp - 0x40], esi
mov dword [edi], edx
xor dword [ebp - 0x38], ebx
add edi, 0x74e70fe7
sub edi, 0x74e70fe3
add esi, 0x66a4d7e3
sub esi, 0x66a4d7df
loop 0x405b2e
add eax, 0x292742e5
sub eax, 0x292641ea
mov ebx, eax
add eax, 0xb85ab7e6
sub eax, 0xb85ab7e1
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.10009034
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.10009034
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10009034
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10009034
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10009034
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10009034
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10009034
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10009034
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10009034
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10009034
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10009043
pop dword [ebp - 0x30]
mov eax, 0x10009043
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf44efcad
add dword [ebp - 0x40], 0x5a03489e
mov dword [ebp - 0x3c], 0x8f0d1af0
sub dword [ebp - 0x3c], 0x5cd9ceab
mov dword [ebp - 0x38], 0x79507814
sub dword [ebp - 0x38], 0x2d0433e6
mov dword [ebp - 0x34], 0x55f9ca54
add dword [ebp - 0x34], 0xaa0635ac
lea eax, [ebp - 0x40]
push eax
mov eax, 0x72aef7f4
sub eax, 0x62ad67dc
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1a0fd0b
sub dword [ebp - 0x40], 0x8d2e93b5
mov dword [ebp - 0x3c], 0x421f9f2
add dword [ebp - 0x3c], 0x3d4a6783
mov dword [ebp - 0x38], 0x86b4ae6d
sub dword [ebp - 0x38], 0x23454201
mov dword [ebp - 0x34], 0xd23f6b9c
add dword [ebp - 0x34], 0x2dc09464
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x818b743a
add eax, 0x8e761bda
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3fbaa
push 0
call eax
mov ecx, 0x5971
xor edx, edx
add edx, eax
mov edi, 0x1002be00
add edi, dword [ebp - 0x30]
mov esi, 0x8c069a20
sub esi, 0x1d2f703f
xor dword [ebp - 0x2c], ebx
mov ebx, dword [edi]
mov dword [ebp - 0x20], 0x485bb899
sub ebx, esi
sub dword [ebp - 0xc], 0xcac192b3
mov dword [edx], ebx
sub dword [ebp - 0x14], edx
add edx, 4
add edi, 4
loop 0x10009156
add eax, 0x15897
mov ebx, eax
add eax, 0xa77d0654
sub eax, 0xa77d064f
mov ecx, 0x43b865fd
sub ecx, 0x33b865fd
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40b8f2
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
xor ebx, ebx
mov esi, 0x80004005
cmp word [0x410eb4], bx
mov dword [ebp - 4], esi
je 0x40b928
push dword [ebp + 0xc]
push 0x410eb4
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
xor eax, eax
jmp 0x40ba53
push edi
mov edi, dword [ebp + 8]
push edi
push ebx
push ebx
push 0x801a
push ebx
call sub.SHFOLDER.dll_SHGetFolderPathW
test eax, eax
jne 0x40ba4f
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [ebp + 0xc]
push 0x403550
push edi
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
push edi
call fcn.00408e5e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x40b97a
cmp eax, 0xb7
je 0x40b97a
mov dword [ebp - 4], esi
jmp 0x40ba4f
cmp edi, ebx
mov dword [ebp - 4], ebx
mov esi, 0x104
je 0x40ba40
lea eax, [ebp - 0x230]
push esi
push eax
push dword [ebp + 8]
call fcn.0040b5ef
lea eax, [ebp - 0x12c]
push 0x105
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40ba40
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push esi
lea eax, [ebp - 0x12c]
push 0x403770
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ba40
test al, 0x10
je 0x40ba40
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x12b], bl
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
mov word [ebp - 0x14], 0x614
mov dword [ebp - 0x12], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
call sub.SHELL32.dll_SHFileOperationA
push esi
push dword [ebp + 8]
push 0x410eb4
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx