joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491c40
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5038
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x491c89
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x491ddb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x491da6
test eax, eax
je 0x491da6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x491da9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x491d2b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x491d1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x491d2b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x491d39
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00412160
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x491da6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x491ce4
jmp 0x491da9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x491dd2
test edx, edx
je 0x491dce
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x491ca0
mov al, 1
jmp 0x491ddd
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x491ddb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2dd3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x496b60
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ea008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push pe_nt_image_headers32
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x496bf7
cmp dword [esp + 8], 6
jb 0x496bf7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004a2dd3
add esp, 0x118
ret

Function at 0x496c10
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5870
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4ea008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004122a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00481d20
mov ecx, eax
call fcn.00481de0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412240
push 0xb
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push str.crypt32.dll
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004122a0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00481d20
mov ecx, eax
call fcn.00481de0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00412240
test ebx, ebx
je 0x496d6d
test esi, esi
je 0x496d6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0e10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4a0e1b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004a0e40
Function at 0x408f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x407015
lea edi, [esi - 0x6015]
push edi
jmp 0x408f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408f70
mov eax, 1
add ebx, ebx
jne 0x408f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408f88
jne 0x408fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408f88
xor ecx, ecx
sub eax, 3
jb 0x408fb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40902a
mov ebp, eax
add ebx, ebx
jne 0x408fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408ff4
inc ecx
add ebx, ebx
jne 0x408fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408fd5
jne 0x408ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408fd5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409014
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409005
jmp 0x408f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409014
add edi, ecx
jmp 0x408f76
pop esi
mov edi, esi
mov ecx, 0xe00
jmp 0x409065
mov al, byte [edi]
inc edi
cmp al, 0x80
jb 0x409045
cmp al, 0x8f
ja 0x409045
cmp byte [edi - 2], 0xf
je 0x40904b
sub al, 0xe8
cmp al, 1
ja 0x40906f
cmp ecx, 4
jb 0x409074
mov eax, dword [edi]
sub al, 8
jne 0x40906f
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jb 0x409074
mov al, byte [edi]
inc edi
jmp 0x409045
sub ecx, 1
jae 0x409034
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x4090bc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40907a
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa5a8]
or eax, eax
je 0x4090b6
mov dword [ebx], eax
add ebx, 4
jmp 0x409097
call dword [esi + 0xa5a4]
mov ebp, dword [esi + 0xa5ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4090f0
sub esp, 0xffffff80
jmp 0x40106f
Function at 0x407f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x38
lea eax, [fcn.00407f90]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], 0x6e10c310
mov si, word [esp + 0x16]
mov di, si
xor di, 0x61f7
mov word [esp + 0x16], di
mov dword [esp + 0x2c], eax
mov word [esp + 0xe], si
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
jmp 0x408037
mov eax, dword [esp + 0x2c]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [esp + 0x2c], eax
mov al, 1
test al, 1
jne 0x408037
jmp 0x407ffd
mov eax, dword [esp + 0x30]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 8]
and eax, 0x333adf03
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0
jmp 0x407ff1
cmp dword [esp + 0x10], 0x3e17fb01
jae 0x40804f
jmp 0x40801c
mov ax, word [esp + 0xe]
xor ax, ax
mov word [esp + 0x16], ax
jmp 0x407fd7
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x40801c
jmp 0x407fd7
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 4]
mov dword [esp + 0x24], edx
mov esi, dword [eax + 0x3c]
mov word [esp + 0x16], 0xc1e0
mov bl, byte [esp + 0x1f]
mov bh, 0xed
sub bh, bl
mov byte [esp + 0x1f], bh
mov eax, dword [eax + esi]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
cmp eax, 0x4550
jne 0x408028
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
jmp 0x407ff1
Function at 0x1002220
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push 0x104
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100224f
push 0x1001298
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1002319
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push 0x1001288
lea eax, [ebp - 0x30c]
push eax
call esi
lea eax, [ebp - 0x30c]
push 0x1001284
push eax
call fcn.0100374d
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100228e
push 0x1001260
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1002317
lea eax, [ebp - 0x208]
push eax
call fcn.01003681
lea eax, [ebp - 0x104]
push eax
call fcn.0100361a
pop ecx
pop ecx
push 0x100125c
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x208]
je 0x10022ec
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x104]
push 0x1001248
push eax
call fcn.010035c2
add esp, 0x10
jmp 0x1002301
push eax
lea eax, [ebp - 0x104]
push 0x1001230
push eax
call fcn.010035c2
add esp, 0xc
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.0100354b
push edi
call fcn.010034fa
add esp, 0xc
pop edi
pop esi
leave
ret 4
Function at 0x1002441
Capabilities:
Get common file path
Get file size
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push 0x41
pop esi
push 0x104
lea eax, [ebp - 0x114]
xor ebx, ebx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100247f
push 0x1001298
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
jmp 0x1002567
push edi
push 0x10012e8
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
je 0x1002563
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002544
push esi
call fcn.01003950
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x1002544
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002544
push 0x10012d0
push dword [ebp - 4]
call fcn.010038d0
cmp eax, ebx
pop ecx
pop ecx
je 0x1002544
mov esi, 0x10012c4
push esi
push eax
call fcn.010038d0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x1002544
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 0x20
push edi
call fcn.01003810
cmp eax, ebx
pop ecx
pop ecx
je 0x1002529
mov byte [eax], bl
push edi
call fcn.01003765
pop ecx
mov ecx, eax
mov eax, 0x3ff
add ecx, eax
shr ecx, 0xa
add ecx, eax
shr ecx, 0xa
mov dword [ebp - 8], ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x100255b
push dword [ebp - 4]
call fcn.01003760
pop ecx
push 0x41
pop eax
cmp dword [ebp - 8], eax
jb 0x1002566
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10026d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x20c]
push eax
push 0x208
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001354
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0x1001348
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
je 0x1002790
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x208
call edi
push 0x1001338
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0x1001328
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
mov dword [ebp - 4], eax
call esi
cmp dword [ebp - 4], 0xffffffff
jne 0x1002829
mov eax, dword [ebp - 4]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x1001310
push eax
call fcn.010035c2
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.01002220
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x310]
push eax
push 0xd9
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010035c2
add esp, 0xc
push ebx
lea eax, [ebp - 0x310]
push eax
push 0x64
push 0
call esi
push eax
call edi
push 0x10
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [0x100aca8]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100282e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
je 0x100285d
cmp byte [ebx], 0
je 0x100285d
push ebx
lea eax, [ebp - 0x210]
push 0x10013e8
push eax
call fcn.010035c2
add esp, 0xc
jmp 0x1002870
lea eax, [ebp - 0x210]
push 0x10013d0
push eax
call fcn.010035c2
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
call fcn.01002220
and dword [ebp + 8], 0
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x1002949
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x10013c8
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x10028bc
mov dword [ebp + 8], 5
jmp 0x1002949
push 0x10013b8
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x10028d7
mov dword [ebp + 8], 3
jmp 0x1002949
lea eax, [ebp - 0x210]
push 0x10013b0
push eax
call fcn.010038d0
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x210]
je 0x1002915
push 0x10013c8
push eax
mov dword [ebp + 8], 1
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
je 0x1002949
mov dword [ebp + 8], 4
jmp 0x1002949
push 0x10013a0
push eax
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
je 0x100292f
mov dword [ebp + 8], 2
jmp 0x1002949
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002934
sub eax, edx
mov dword [ebp - 8], eax
je 0x1002949
mov dword [ebp + 8], 6
push 0x1001384
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 4]
push eax
mov edi, 0xf003f
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x210]
push eax
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10029c4
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push edi
push ebx
push 0x1001382
push ebx
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10029c4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x314]
push 0x1001370
push eax
call fcn.010035c2
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
call fcn.01002220
jmp 0x10029f8
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
pop edi
push edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push 0x1001368
push dword [ebp - 4]
call esi
push edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push 0x1001360
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1002b26
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x1002bc2
push ebx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1002bc1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x1002b6e
xor esi, esi
jmp 0x1002bb7
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1002b85
and dword [ebp - 4], 0
jmp 0x1002bad
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1001420
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002b7f
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x1002bc7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x100142c
push 0x80000002
xor ebx, ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c6f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
push edi
push 0x1001424
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002c6f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.01002a6c
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [0x100ab8c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1002c6f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.01002b26
test eax, eax
je 0x1002c6f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x1002c6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x1002c6d
inc ebx
jmp 0x1002c6f
xor ebx, ebx
cmp dword [ebp - 4], edi
je 0x1002c7d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1002c83
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x1001384
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002ce4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x1001360
push dword [ebp - 4]
call esi
push 0x1001448
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x1002d70
Capabilities:
Log keystrokes via polling
Shutdown system

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x7f02
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov esi, dword [esp + 0x14]
cmp esi, ebp
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
je 0x1002d9b
push ebp
push esi
call ebx
push dword [esp + 0x18]
push ebp
push esi
call dword [0x100ab94]
mov edi, eax
cmp edi, 1
jne 0x1002de2
push 0x68
call fcn.0100256b
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1002dcb
push ebp
call fcn.010029ff
jmp 0x1002e03
push 1
call fcn.010029ff
call fcn.01002658
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1002e03
cmp esi, ebp
je 0x1002e0c
cmp edi, 0xfffffff7
jne 0x1002df2
call fcn.010026d3
jmp 0x1002e03
mov eax, edi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.0100256b
pop ecx
cmp esi, ebp
je 0x1002e0c
push 1
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10032e1
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x10014e8
call fcn.010047f8
mov edi, 0x94
mov eax, edi
call fcn.01004850
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x100acc8], ecx
mov eax, dword [esi + 4]
mov dword [0x100acd4], eax
mov edx, dword [esi + 8]
mov dword [0x100acd8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100accc], esi
cmp ecx, 2
je 0x1003341
or esi, 0x8000
mov dword [0x100accc], esi
shl eax, 8
add eax, edx
mov dword [0x100acd0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x100337c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100337c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003394
cmp eax, 0x20b
je 0x1003381
mov dword [ebp - 0x1c], esi
jmp 0x10033a8
cmp dword [ecx + 0x84], 0xe
jbe 0x100337c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x10033a2
cmp dword [ecx + 0x74], 0xe
jbe 0x100337c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.010047a5
pop ecx
test eax, eax
jne 0x10033bc
push 0x1c
call fcn.010032bd
pop ecx
call fcn.0100471c
test eax, eax
jne 0x10033cd
push 0x10
call fcn.010032bd
pop ecx
mov dword [ebp - 4], esi
call fcn.0100448f
test eax, eax
jge 0x10033e1
push 0x1b
call fcn.01003298
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100c4b4], eax
call fcn.01004369
mov dword [0x100acb8], eax
call fcn.010042c7
test eax, eax
jge 0x1003407
push 8
call fcn.01003298
pop ecx
call fcn.0100407b
test eax, eax
jge 0x1003418
push 9
call fcn.01003298
pop ecx
call fcn.01003b4d
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x100342b
push eax
call fcn.01003298
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.01004012
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x100344c
movzx eax, word [ebp - 0x34]
jmp 0x100344f
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.01002f44
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x100346d
push edi
call fcn.01003c6c
call fcn.01003c8e
jmp 0x100349f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.01004831
ret