joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fc53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x42d9d0]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41fcfd
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x41fdff
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x41fdad
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fe00
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fda2
cmp dword [ebp - 0x24], 1
jne 0x41fda2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x42700c
push eax
call fcn.0040cbbf
add esp, 0xc
cmp eax, 1
jne 0x41fda2
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41fe00
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x41fe00
lea ecx, [ebp - 0x18]
push ecx
push 0x41fc3d
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x41fe00
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x41fe25
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.0041fbb4
cmp eax, ebx
pop ecx
jne 0x41fe27
inc edi
cmp edi, esi
jl 0x41fe0f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a861
leave
ret 4
Function at 0x41fe38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x42d788
je 0x41fef4
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fedc
mov esi, dword [ebx + 4]
jmp 0x41fed6
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fec6
cmp dword [ebp - 0xc], 4
jne 0x41fec6
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x41febe
or dword [eax + 0x9c], ecx
jmp 0x41fec6
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x41fe8a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x41fe6d
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x4202e7
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x421f73
call fcn.0040c97c
sub esp, 0x124
mov eax, dword [0x42d9d0]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x4203f5
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4203c9
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403610
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.004202e7
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401170
test bl, bl
jne 0x4203c9
or dword [ebp - 4], 0xffffffff
jmp 0x420334
cmp esi, 0x103
je 0x4203d9
cmp esi, 0x3f2
jne 0x4203e9
push dword [edi]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a861
leave
ret 8
Function at 0x420cc5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x420cfa
cmp edi, dword [esi + 0xc]
jge 0x420cfa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x420cfa
cmp edi, dword [eax + 8]
jge 0x420cfa
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x420cfc
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x420e00
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x420e34
jmp fcn.004177b7
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x420ea5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x420f9e
cmp eax, dword [edi + 0xc]
jge 0x420f9e
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x420ef6
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x420f87
cmp dword [ebp + 0xc], ebx
je 0x420f87
jmp 0x420f20
push 0x10
call fcn.00420b91
cmp eax, ebx
je 0x420f0c
mov ecx, eax
call fcn.00420df7
mov esi, eax
jmp 0x420f0e
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x420f37
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x420f47
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x420f59
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004177b7
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0040c9f0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x420f99
cmp ecx, dword [esi + 8]
jge 0x420f99
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x420f9f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4217f7
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x422067
call fcn.0040c97c
sub esp, 0x198
mov eax, dword [0x42d9d0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x420785
mov ecx, 0x430aa8
mov dword [ebp - 0x10], eax
call fcn.00420d25
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x42185b
cmp esi, ebx
jne 0x421839
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x42188d
cmp byte [esi], 1
jne 0x421887
cmp byte [esi + 1], 1
jne 0x421887
mov dword [edi + 0xc], 0x4217c4
call fcn.00420aa3
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x42189a
push 0x1c
call fcn.0041bb41
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x421891
push 0xa
call fcn.00417d1d
jmp 0x421893
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x4218fd
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x4218cc
push 0x1c
call fcn.0041bb41
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x4218c3
push 0xa
call fcn.00417d1d
jmp 0x4218c5
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x4218fa
push 0x1c
call fcn.0041bb41
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x4218f5
push 0xa
call fcn.0041790b
jmp 0x4218f7
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a861
leave
ret 4
Function at 0x43db6b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4b4119
call fcn.004b3750
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x608b
cmp dword [ebp - 0x18], 0x621a
jle 0x43dbd8
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov esi, edx
mov eax, esi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xae6c18
call fcn.0042e2b8
inc ebx
cmp ebx, 0x19d1
jl 0x43dba3
inc edi
cmp edi, 0x3025
mov esi, dword [ebp - 0x14]
jl 0x43db9a
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x69a
jl 0x43db98
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
call fcn.0049e07d
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5d09
jge 0x43dbfd
mov edx, 0xacbe6c
mov ecx, 0xae6c18
call fcn.0043006e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063a0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4063df
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4063df
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4063df
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4063df
cmp dword [ecx + 0x74], 0xe
jbe 0x4063df
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40bf33
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bfd0
push ebx
push esi
call fcn.0040befc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040be90
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bf7d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfcf
push edi
push eax
call fcn.0040cb50
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bf9d
call fcn.0040a9f1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bfce
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040be90
add esp, 0x20
test eax, eax
jne 0x40bfbc
push edi
call fcn.0040a9f1
jmp 0x40bfc4
push ebx
call fcn.0040a9f1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d2cd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b0008
push 0x4b0000
push str.FlsAlloc
push 0x1f
call fcn.0040d18c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d301
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d307
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d34b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b0018
push 0x4b0010
push str.FlsGetValue
push 0x21
call fcn.0040d18c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d382
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d38a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4b0020
push 0x4b0018
push str.FlsSetValue
push 0x22
call fcn.0040d18c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3c4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10017288
pop dword [ebp - 0x10]
mov eax, 0x10017288
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x26a1adb5
add dword [ebp - 0x20], 0x27b09796
mov dword [ebp - 0x1c], 0xf5baf06d
add dword [ebp - 0x1c], 0x3c785bd8
mov dword [ebp - 0x18], 0xe58873c9
add dword [ebp - 0x18], 0x66c3d065
mov dword [ebp - 0x14], 0xb2a1b006
sub dword [ebp - 0x14], 0xb2a1b006
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xc7c17c46
add dword [ebp - 0x20], 0xacb0ed10
mov dword [ebp - 0x1c], 0x89b4f1d9
sub dword [ebp - 0x1c], 0x48489064
mov dword [ebp - 0x18], 0x7beb5894
sub dword [ebp - 0x18], 0x187bec28
mov dword [ebp - 0x14], 0xce6beef7
add dword [ebp - 0x14], 0x31941109
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x29e436cb
add eax, 0xe61d6941
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c2df
push 0
call eax
mov ecx, 0x8caadc3d
sub ecx, 0x8caa8cd8
xor edi, edi
add edi, eax
mov ebx, 0x2d415deb
add ebx, 0xe2c0ec15
add ebx, dword [ebp - 0x10]
mov edx, 0x7439dbdc
sub edx, 0xb40c01f5
sub dword [ebp - 0xc], edx
mov esi, dword [ebx]
mov dword [ebp - 8], 0xc025d816
add esi, edx
add dword [ebp - 0xc], eax
mov dword [edi], esi
xor dword [ebp - 0xc], edi
add edi, 0x7b785332
add edi, 0x8487acd2
add ebx, 0x13f7749d
add ebx, 0xec088b67
loop 0x100173a2
add eax, 0x481e5e85
sub eax, 0x481d2e1e
xor ebx, ebx
add ebx, eax
add eax, 0x16c1fb05
sub eax, 0x16c1fb00
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1000567b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001ae0c
call fcn.1001a6e0
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100056f8
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100056f8
call fcn.10003dca
mov esi, eax
jmp 0x100057fe
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000571b
call fcn.10003dca
jmp 0x100057f1
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10005711
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000574e
mov esi, 0x8007000e
jmp 0x100057f3
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x1000582c
jb 0x10005769
cmp eax, 0xffffffff
ja 0x1000582c
cmp eax, 0x400
jbe 0x1000577e
push eax
lea ecx, [ebp - 0x418]
call fcn.1000ce10
jmp 0x100057a0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x100057a0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005744
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005711
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.1000ce10
mov esi, eax
test edi, edi
je 0x100057fe
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005817
lea ecx, [ebp - 0x418]
call fcn.10003d92
lea ecx, [ebp - 0x428]
call fcn.10004436
mov eax, esi
call fcn.1001a631
ret 0x10
push 0x80070216
call fcn.1000ce10
int3
Function at 0x10005e6b
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1001aed0
call fcn.1001a63e
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x20
call fcn.1000ce10
mov esi, eax
pop ecx
test esi, esi
je 0x10005eab
and dword [esi + 4], 0
lea ecx, [esi + 8]
mov edi, ecx
xor eax, eax
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [esi + 0x18], 0
mov edi, dword [ebp - 0x10]
jmp 0x10005ead
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
jne 0x10005ec2
mov ebx, 0x8007000e
jmp 0x10005fa1
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esi], edi
test edi, edi
je 0x10005f1b
test ebx, ebx
je 0x10005f9c
cmp dword [ebp + 8], 0
jne 0x10005f9c
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebx
mov edi, eax
mov eax, dword [esi + 4]
cmp edi, eax
je 0x10005f15
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x10005f0f
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x10005fe5
jmp 0x10005f37
and dword [esi + 4], 0
xor eax, eax
test eax, eax
jne 0x10005f37
jmp 0x10005eb8
test ebx, ebx
jne 0x10005f9c
cmp dword [ebp + 8], ebx
je 0x10005f9c
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantChangeType]
mov ebx, eax
test ebx, ebx
js 0x10005fa1
lea ecx, [esi + 0x18]
call fcn.1000ce10
mov ebx, eax
test ebx, ebx
js 0x10005fa1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fef
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x10006064
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10005f8b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005f8f
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x10005fa1
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10005fa1
mov ebx, 0x80070057
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10005fdb
mov dword [ebp - 4], 8
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fc1
and dword [esi + 0x18], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.1000ce10
pop ecx
mov eax, ebx
call fcn.1001a60f
ret 4
push 0x8007000e
call fcn.1000ce10
push 0
push 0x152139a
call fcn.1000ce10
int3
Function at 0x1000ce10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000ce1f
pop dword [ebp - 0x48]
mov eax, 0xfbffd4fa
add eax, 0x1400f925
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8d17264e
sub dword [ebp - 0x58], 0x3ec4e103
mov dword [ebp - 0x54], 0x1543971
add dword [ebp - 0x54], 0x30df12d4
mov dword [ebp - 0x50], 0xed01c896
sub dword [ebp - 0x50], 0xa0b58468
mov dword [ebp - 0x4c], 0xf75c30b3
sub dword [ebp - 0x4c], 0xf75c30b3
lea eax, [ebp - 0x58]
push eax
mov eax, 0x3f0e9207
sub eax, 0x2f0cd11b
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6fb19838
add dword [ebp - 0x58], 0x4c0d11e
mov dword [ebp - 0x54], 0x4e52c493
sub dword [ebp - 0x54], 0xce6631e
mov dword [ebp - 0x50], 0x65177627
sub dword [ebp - 0x50], 0x1a809bb
mov dword [ebp - 0x4c], 0x213d7253
add dword [ebp - 0x4c], 0xdec28dad
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b7d8
push 0
call eax
mov ecx, 0x4635
mov edi, eax
mov esi, 0x10029a00
add esi, dword [ebp - 0x48]
mov ebx, 0x150674e5
xor dword [ebp - 0x20], ebx
mov edx, dword [esi]
add dword [ebp - 4], 0x3f93df51
xor edx, ebx
add dword [ebp - 0x40], eax
mov dword [edi], edx
mov dword [ebp - 0x30], 0x97c54f32
add edi, 0xdddcbe54
add edi, 0x222341b0
add esi, 0x20c217a7
add esi, 0xdf3de85d
loop 0x1000cf2a
add eax, 0x10ba7
xor ebx, ebx
add ebx, eax
add eax, 0x91e94a40
sub eax, 0x91e94a3b
mov ecx, 0xe2f91b6
sub ecx, 0xfe2f91b6
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10005520
Capabilities:
Encode data using xor

Disassembly:
pushfd
push eax
push edx
mov edx, edi
and edx, 0xfff
mov eax, 4
sub eax, edi
and eax, 3
cmp eax, ecx
jb 0x1000553b
mov eax, ecx
sub ecx, eax
push ecx
mov ecx, eax
call fcn.10005502
pop ecx
mov eax, ecx
shr eax, 2
and ecx, 3
push ecx
mov ecx, eax
test ecx, 0xffffffff
je 0x10005570
mov eax, dword [edx + 0x10006110]
xor dword [edi + esi], eax
add edx, 4
and edx, 0xfff
add edi, 4
loop 0x10005559
pop ecx
call fcn.10005502
pop edx
pop eax
popfd
ret
Function at 0x4035ab
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x403600
push dword [esp + 0x10]
push 0x40352a
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0xa22d98]
test esi, esi
je 0x403659
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4035f8
cmp byte [esi + 0x10], 0
je 0x4035f8
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4035d4
jmp 0x403659
mov esi, dword [0xa22d98]
test esi, esi
je 0x403659
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x403652
cmp byte [esi + 0x11], 0
je 0x40362e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x403645
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0xa22d98
call fcn.0040ef7f
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40360d
pop ebp
pop edi
pop esi
pop ebx
ret 4