joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fb3
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
push edi
lea eax, [esp + 0x14]
push 0x1001348
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005c3d
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x100304e
cmp edi, 0x190
jl 0x1002fc8
push esi
push 0
push 0x1001344
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x100303f
xor ebp, ebp
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 8
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1003017
xor eax, eax
inc eax
mov dword [0x100b880], eax
mov ebp, eax
jmp 0x100303f
Function at 0x10035dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push edi
xor edi, edi
push edi
lea eax, [ebp - 0x24]
push 0x1001330
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call ebx
add esp, 0xc
push 0xa
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10036a6
push esi
jmp 0x1003620
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x100368c
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
lea edi, [esi + 8]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp + 8]
test eax, eax
push esi
je 0x100369b
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push 0x1001330
push eax
call ebx
add esp, 0xc
push 0xa
lea eax, [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x100361e
jmp 0x10036a5
mov dword [0x100aa5c], 0x80070714
mov dword [ebp - 8], edi
jmp 0x10036a5
and dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 4

Function at 0x1003786
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x100ac44
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01005c3d
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10037d9
test al, 0x10
jne 0x10037d9
push 8
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10037e2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4
Function at 0x1003ed7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1003f17
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01003943
call fcn.010035be
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x1003f7e
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10013c4
push esi
call fcn.01005c3d
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1003f71
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003f71
test al, 0x10
je 0x1003f71
xor eax, eax
mov dword [0x100aa5c], ebp
inc eax
jmp 0x1003f7d
call fcn.010035be
mov dword [0x100aa5c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10041c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1004200
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003943
call fcn.010035be
mov dword [0x100aa5c], eax
xor eax, eax
leave
ret
push 2
push 2
lea eax, [ebp - 0x104]
push eax
call fcn.01003f84
leave
ret
Function at 0x1004611
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
xor eax, eax
cmp dword [ebp + 8], esi
je 0x1004702
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10046ba
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100b888], esi
mov ecx, dword [ebp + 0xc]
jne 0x1004694
mov al, byte [0x100b48c]
test bl, al
je 0x1004694
test al, 2
jne 0x1004694
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1004694
mov dword [0x100b48c], ecx
push ecx
call fcn.01002933
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
test byte [0x100b495], 4
je 0x10046ff
cmp dword [ebp + 0xc], esi
jge 0x10046ff
jmp 0x10046fd
call fcn.010035be
push esi
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
push 0x4c4
push esi
call fcn.01003943
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1004785
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x100489f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x100488c
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x100488c
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x100488c
cmp byte [0x100aa80], bl
mov esi, 0x100aa80
jne 0x1004829
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1004829
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1004829
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1002981
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x100487a
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100aa80], bl
je 0x1004874
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x10048b3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x10048a9
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003943
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10048ba
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005cd5
test eax, eax
jne 0x10048d4
mov eax, ebx
jmp 0x100492f
cmp dword [0x100ac3c], 0
jne 0x1004921
test byte [0x100b898], bl
jne 0x1004921
push 6
push 0
push 0x10038b4
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01004212
sub eax, 6
je 0x100491f
dec eax
je 0x1004935
sub eax, 0x832
jne 0x1004921
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x100492d
Function at 0x1004bcb
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004c58
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.01002fb3
test eax, eax
je 0x1004cc1
lea eax, [ebp - 0x128]
push eax
mov esi, 0x100ac44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1004c4b
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004c40
dec eax
je 0x1004c39
dec eax
je 0x1004c32
dec eax
jne 0x1004c4b
push 0x1001424
jmp 0x1004c45
push 0x100141c
jmp 0x1004c45
push 0x1001414
jmp 0x1004c45
push 0x100140c
push esi
call fcn.01005c3d
push 0x1001251
push esi
call fcn.01005c3d
jmp 0x1004c67
push dword [ebp + 8]
mov esi, 0x100ac44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01003ed7
test eax, eax
jne 0x1004c87
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004ca0
mov dword [0x100b880], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01003f84
test eax, eax
je 0x1004cac
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
jmp 0x1004cc3
call fcn.010035be
mov dword [0x100aa5c], eax
jmp 0x1004cc1
cmp dword [0x100b880], ebx
je 0x1004cc1
push esi
mov dword [0x100b880], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004cc9
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b4a4], eax
xor eax, eax
mov ecx, 0x23f
mov edi, 0x100aba0
rep stosd dword es:[edi], eax
push 0x41
mov ecx, 0xcb
mov edi, 0x100b880
rep stosd dword es:[edi], eax
pop ecx
mov edi, 0x100aa80
rep stosd dword es:[edi], eax
push 0x7f
mov esi, 0x100abb4
xor edi, edi
push esi
xor ebx, ebx
inc edi
push 0x1001450
mov dword [ebp - 4], ebx
mov dword [0x100ae4c], edi
call fcn.01002a6d
cmp eax, ebx
je 0x1004eee
cmp eax, 0x80
ja 0x1004eee
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa50], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b494
push 0x1001444
call fcn.01002a6d
test eax, eax
je 0x1004d86
test byte [0x100b494], 0xc0
je 0x1004e16
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001434
call fcn.01002a6d
test eax, eax
jne 0x1004da5
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003943
mov dword [0x100aa5c], 0x80070714
jmp 0x1004efe
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa54], eax
je 0x1004e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1004e16
test byte [0x100b494], 0x80
je 0x1004de5
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003943
jmp 0x1004dfb
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003943
cmp eax, 6
je 0x1004e16
push dword [0x100aa54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100aa5c], 0x800700b7
jmp 0x1004efe
push dword [ebp + 0xc]
mov dword [0x100aa60], ebx
call fcn.010030e0
test eax, eax
jne 0x1004e37
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1004ef8
cmp byte [0x100b89a], bl
je 0x1004e4e
push 0x100b89a
call fcn.01001cb7
jmp 0x1004efe
push 0xa
push 0x1001428
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1004e6f
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2bc], ebx
je 0x1004e7d
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100b884], ebx
jne 0x1004eea
push dword [ebp - 4]
call fcn.0100427e
test eax, eax
je 0x1004efe
mov ax, word [0x100aa64]
cmp ax, di
je 0x1004ea8
cmp ax, 2
je 0x1004ea8
cmp ax, 3
jne 0x1004eea
test byte [0x100b495], 1
je 0x1004eea
test byte [0x100b898], 1
jne 0x1004eea
call fcn.010016c3
test eax, eax
jne 0x1004eea
push 0x83e
push 0x547
push 0x10017e9
push ebx
push 0x7d6
push dword [0x100b4a4]
call fcn.01004212
cmp eax, 0x83d
jne 0x1004efe
mov eax, edi
jmp 0x1004f00
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003943
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10059af
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
xor esi, esi
cmp word [0x100b898], si
jne 0x10059e7
cmp dword [0x100b884], esi
jne 0x10059de
call fcn.01003e11
test eax, eax
je 0x10059f9
cmp word [0x100b898], si
jne 0x10059e7
call fcn.01004532
test eax, eax
je 0x10059f9
call fcn.01003d8a
test eax, eax
je 0x10059f9
call fcn.010056e7
test eax, eax
jne 0x1005a00
xor eax, eax
jmp 0x1005b08
push ebx
push edi
push 0x105
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001244
lea eax, [ebp - 0x108]
push eax
call fcn.01005c3d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
mov edi, 0x100ac44
je 0x1005a51
push 0x10014ac
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x1005a51
push esi
push edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100b884], esi
jne 0x1005a78
cmp dword [0x100b490], esi
jne 0x1005a78
call fcn.010041c3
test eax, eax
jne 0x1005a78
xor eax, eax
jmp 0x1005b06
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1005a9f
push esi
push 0x10
push esi
push esi
push 0x4bc
push esi
call fcn.01003943
call fcn.010035be
mov dword [0x100aa5c], eax
jmp 0x1005a71
cmp dword [0x100b88c], esi
jne 0x1005ab0
call fcn.010052ba
test eax, eax
je 0x1005a71
test byte [0x100bba8], 0xc0
jne 0x1005ace
xor eax, eax
mov ax, word [0x100aa64]
push eax
call fcn.01001f30
mov dword [0x100ab84], eax
jmp 0x1005ad4
mov dword [0x100ab84], esi
cmp dword [0x100b884], esi
jne 0x1005aed
cmp dword [0x100b490], esi
jne 0x1005aed
call fcn.01005339
test eax, eax
je 0x1005a71
cmp word [0x100b898], si
jne 0x1005b03
cmp dword [0x100b884], esi
jne 0x1005b03
call fcn.01004708
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1005b69
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005b90
inc esi
mov al, byte [esi]
test al, al
je 0x1005b89
cmp al, 0x22
jne 0x1005b7e
cmp byte [esi], 0x22
jne 0x1005ba1
jmp 0x1005ba0
cmp al, 0x20
jle 0x1005ba1
inc esi
cmp byte [esi], 0x20
jg 0x1005b94
jmp 0x1005ba1
cmp al, 0x20
jg 0x1005ba7
inc esi
mov al, byte [esi]
test al, al
jne 0x1005b9c
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005bc1
movzx eax, word [ebp - 0x14]
jmp 0x1005bc4
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1005cd5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005ce8
xor eax, eax
jmp 0x1005cf0
shr eax, 4
not eax
and eax, 1
ret 4
Function at 0x1005e2d
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
and dword [ebp + 0x74], 0
cmp dword [0x100a2cc], 0xfffffffe
mov dword [ebp + 0x6c], 0xc
jne 0x1005f14
and dword [0x100a2cc], 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1005f14
cmp dword [ebp - 0x28], 1
jne 0x1005f14
cmp dword [ebp - 0x34], 4
jne 0x1005f14
cmp dword [ebp - 0x30], 0xa
jae 0x1005f14
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1005f14
lea eax, [ebp + 0x70]
push eax
push 0x20019
push 0
push 0x10014bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005f14
push edi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x1001251
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x70]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005f14
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.01005d27
test eax, eax
je 0x1005f14
and dword [ebp + 0x74], 0x3ff
cmp dword [ebp + 0x74], 1
je 0x1005f0a
cmp dword [ebp + 0x74], 0xd
jne 0x1005f14
mov dword [0x100a2cc], 1
mov eax, dword [0x100a2cc]
add ebp, 0x78
leave
ret

Function at 0x1005f1e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1005f54
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005f58
xor eax, eax
jmp 0x1005f6e
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x100719a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x10071d5
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x10071b2
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10071f1
dec esi
je 0x10071ea
dec esi
jne 0x10071f6
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40135b
Capabilities:
Check os version

Disassembly:
push 0x11c
mov eax, 0x40c65f
call fcn.0040b7c8
mov esi, ecx
lea eax, [esi + 0x1044]
xor ebx, ebx
mov dword [ebp - 0x128], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, 0x410
push edi
push ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00404db0
push edi
lea eax, [esi + 0x410]
push ebx
push eax
call fcn.00404db0
push 0x400
lea eax, [esi + 0x820]
push ebx
push eax
call fcn.00404db0
push edi
lea eax, [esi + 0xc20]
push ebx
push eax
call fcn.00404db0
push 0x110
lea eax, [ebp - 0x120]
push ebx
push eax
mov byte [esi + 0x1030], bl
mov byte [esi + 0x1031], bl
mov dword [esi + 0x1034], ebx
mov byte [esi + 0x1032], bl
mov byte [esi + 0x1038], 1
mov byte [esi + 0x1054], bl
mov dword [ebp - 0x124], 0x114
call fcn.00404db0
add esp, 0x3c
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401426
cmp dword [ebp - 0x120], 6
jb 0x401426
mov byte [esi + 0x1032], 1
call fcn.00401452
mov ebx, esi
call fcn.00402296
mov eax, esi
call fcn.0040b84b
ret
Function at 0x4020ca
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x41102c]
xor eax, ebp
mov dword [ebp + 0x398], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x40e
lea eax, [ebp - 0x76]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x80], esi
mov word [ebp - 0x78], bx
call fcn.00404db0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x1a
push ebx
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40213e
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40213a
cmp dword [ebp - 0x7c], ebx
je 0x40213e
push dword [ebp - 0x7c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40213e
mov word [ebp - 0x78], bx
lea eax, [ebp - 0x78]
push 0x40ec98
push eax
call fcn.00404316
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402161
mov word [ebp - 0x78], bx
mov edi, 0x410
push edi
add esi, 0xc20
push ebx
push esi
call fcn.00404db0
lea eax, [ebp - 0x78]
push eax
call fcn.00404fc0
add esp, 0x10
test eax, eax
jne 0x40223e
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0x1034]
cmp eax, ebx
jne 0x40219c
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x40f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jae 0x40223e
cmp eax, ebx
je 0x40223e
mov ecx, dword [ebp - 0x80]
push 0x5c
push esi
mov word [ecx + eax*2 + 0xc20], bx
call fcn.004042e6
cmp eax, ebx
pop ecx
pop ecx
jne 0x4021e0
push 0x2f
push esi
call fcn.004042e6
cmp eax, ebx
pop ecx
pop ecx
je 0x4021e4
mov word [eax + 2], bx
push str.config
push esi
call fcn.00404316
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402232
push 0x40ecb8
push esi
call fcn.00404316
push 0x40ecbc
push esi
call fcn.00404316
add esp, 0x10
push ebx
push 0x80
push 4
push ebx
push 7
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x402237
mov word [esi], bx
jmp 0x40223e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00404fc0
test eax, eax
pop ecx
jne 0x40227e
push 0x207
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.00404d6d
push esi
call fcn.00404fc0
add esp, 0x10
test eax, eax
jbe 0x40227e
push 0x40ecb8
push esi
call fcn.00404316
push 0x40ecbc
push esi
call fcn.00404316
add esp, 0x10
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042d7
add ebp, 0x39c
leave
ret