joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c7a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43c7d3
push esi
call fcn.0043f8b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43c7cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43c859
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c842
mov eax, dword [esi + 8]
test eax, eax
je 0x43c7f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43c83e
cmp eax, 2
je 0x43c842
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43c7ea
cmp eax, 3
je 0x43c81d
cmp eax, 1
jne 0x43c7ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43c7ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43c7ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043c880
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43c868
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043c880
add esp, 4
pop esi
ret

Function at 0x449790
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x5412d8
push 1
push 0
push 0x5412c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4497be
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x5413a8
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4497f2
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x46519f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4651d7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00463256
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046322e
jmp 0x4651e3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x466892
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4668d4
call fcn.0046c576
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4668d4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4668cb
xor eax, eax
jmp 0x4668dc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004668e2
pop edi
pop esi
pop ebx
ret 4

Function at 0x46caa6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46cad4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46caf2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046ca0c
jmp 0x46caf2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46caf2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046ca0c
test edi, edi
mov eax, edi
jne 0x46cadc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401dd0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [0x4109f8]
sub esp, 8
test eax, eax
jne 0x401e55
mov ecx, dword [0x410a24]
mov dword [0x4109f8], 1
test ecx, ecx
je 0x401df4
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [0x410a28]
test ecx, ecx
je 0x401e55
mov edx, dword [ecx]
call dword [edx + 0x28]
mov eax, dword [0x410b50]
test eax, eax
je 0x401e21
mov eax, dword [0x410b5c]
test eax, eax
je 0x401e55
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
jmp 0x401e55
mov edx, dword [0x410b5c]
test edx, edx
je 0x401e55
mov ecx, dword [0x410a18]
test ecx, ecx
je 0x401e55
mov eax, dword [0x410a1c]
test eax, eax
je 0x401e55
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push edx
mov dword [esp + 8], ecx
call dword [sym.imp.MSVCRT.dll__utime]
add esp, 8
push 4
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
Function at 0x402280
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4109f8]
sub esp, 8
test eax, eax
jne 0x402305
mov ecx, dword [0x410a24]
mov dword [0x4109f8], 1
test ecx, ecx
je 0x4022a4
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [0x410a28]
test ecx, ecx
je 0x402305
mov edx, dword [ecx]
call dword [edx + 0x28]
mov eax, dword [0x410b50]
test eax, eax
je 0x4022d1
mov eax, dword [0x410b5c]
test eax, eax
je 0x402305
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
jmp 0x402305
mov edx, dword [0x410b5c]
test edx, edx
je 0x402305
mov ecx, dword [0x410a18]
test ecx, ecx
je 0x402305
mov eax, dword [0x410a1c]
test eax, eax
je 0x402305
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push edx
mov dword [esp + 8], ecx
call dword [sym.imp.MSVCRT.dll__utime]
add esp, 8
push 4
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
Function at 0x403420
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x410b2c]
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_printf]
xor ebx, ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x4034cc
mov ecx, dword [0x4108e4]
mov dword [0x410b2c], 1
cmp ecx, ebx
jne 0x40346e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
cmp ecx, ebx
mov dword [0x4108e4], ecx
jne 0x40346e
xor eax, eax
jmp 0x4034b3
mov eax, dword [0x4108e0]
cmp eax, ebx
jne 0x40348c
push str.LoadStringA
push ecx
call edi
cmp eax, ebx
mov dword [0x4108e0], eax
jne 0x40348c
xor eax, eax
jmp 0x4034b3
mov ecx, dword [0x410b74]
push 0x400
push 0x4104e0
push 0x7d0
push ecx
call eax
test eax, eax
jne 0x4034ae
mov byte [0x4104e0], bl
mov eax, 0x4104e0
push eax
push 0x410158
call ebp
push str._Version_6.00.8168
call ebp
push str._nCopyright__C__Microsoft_Corp_1990_1998._All_rights_reserved._n_n
call ebp
add esp, 0x10
mov ecx, dword [0x4108e4]
cmp ecx, ebx
jne 0x4034f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
cmp ecx, ebx
mov dword [0x4108e4], ecx
jne 0x4034f1
xor eax, eax
jmp 0x403536
mov eax, dword [0x4108e0]
cmp eax, ebx
jne 0x40350f
push str.LoadStringA
push ecx
call edi
cmp eax, ebx
mov dword [0x4108e0], eax
jne 0x40350f
xor eax, eax
jmp 0x403536
mov edx, dword [0x410b74]
push 0x400
push 0x4104e0
push 0x7d1
push edx
call eax
test eax, eax
jne 0x403531
mov byte [0x4104e0], bl
mov eax, 0x4104e0
push eax
push str._s_n_n
call ebp
add esp, 8
mov esi, 0x7d2
mov ecx, dword [0x4108e4]
cmp ecx, ebx
jne 0x40356b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
cmp ecx, ebx
mov dword [0x4108e4], ecx
jne 0x40356b
xor eax, eax
jmp 0x4035ac
mov eax, dword [0x4108e0]
cmp eax, ebx
jne 0x403589
push str.LoadStringA
push ecx
call edi
cmp eax, ebx
mov dword [0x4108e0], eax
jne 0x403589
xor eax, eax
jmp 0x4035ac
mov ecx, dword [0x410b74]
push 0x400
push 0x4104e0
push esi
push ecx
call eax
test eax, eax
jne 0x4035a7
mov byte [0x4104e0], bl
mov eax, 0x4104e0
push eax
push 0x4101b8
call ebp
add esp, 8
inc esi
cmp esi, 0x7e3
jle 0x403546
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
pop ebx
nop
nop
nop
nop
mov eax, dword [0x4109f4]
test eax, eax
je 0x4035df
mov eax, dword [0x4109e8]
ret
mov eax, dword [0x410028]
dec eax
ret
Function at 0x409680
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [0x412b88]
sub esp, 0x30
test eax, eax
push esi
je 0x4097ec
mov eax, dword [0x41024c]
test eax, eax
jne 0x4097ec
mov eax, dword [0x410b54]
test eax, eax
je 0x4096ac
call fcn.00402280
mov eax, dword [0x412b88]
mov esi, dword [eax + 4]
test esi, esi
je 0x4097ec
mov al, byte [0x412fa8]
test al, al
je 0x4097ec
lea ecx, [esp + 0x10]
push ecx
push 0x412fa8
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
cmp eax, 0xffffffff
je 0x4097ec
lea edx, [esi + esi*4]
push ebx
push ebp
push edi
lea esi, [esi + edx*2 + 0xa]
push esi
mov dword [esp + 0x1c], esi
call fcn.0040e2f0
mov edi, eax
mov eax, dword [esp + 0x3c]
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [0x410a24]
lea eax, [esp + 0x10]
lea ebx, [edi + 0xa]
mov edx, dword [ecx]
push eax
push 0x412fa8
call dword [edx + 8]
test eax, eax
jne 0x409733
push 0x413bec
push 0x5e5
call fcn.00401160
add esp, 8
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov dx, word [0x410250]
mov word [edi + 8], dx
mov esi, dword [0x412b88]
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
test eax, eax
mov dword [esp + 0x10], edx
je 0x40975f
mov eax, dword [eax]
test eax, eax
jne 0x409770
mov ebx, dword [esi + 8]
inc ecx
cmp ecx, ebx
jge 0x409794
mov eax, dword [esi]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x409762
mov ebx, dword [eax + 8]
mov ebp, dword [ebx]
mov dword [edx], ebp
mov bp, word [ebx + 4]
mov word [edx + 4], bp
mov bl, byte [ebx + 6]
mov byte [edx + 6], bl
mov edx, dword [esp + 0x10]
mov ebx, dword [eax + 4]
mov dword [edx + 7], ebx
add edx, 0xb
jmp 0x409751
mov ecx, dword [0x410a28]
lea eax, [esp + 0x14]
push eax
push str._bsc_ordinfo
mov edx, dword [ecx]
call dword [edx + 0x2c]
test eax, eax
je 0x4097cd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push eax
push edi
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
je 0x4097cd
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
call dword [edx + 0x18]
test eax, eax
jne 0x4097e0
mov eax, dword [0x410b5c]
push eax
push 0x5df
call fcn.00401160
add esp, 8
push edi
call fcn.0040e320
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x42f557
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 4], 0xd62c
salc
rol al, 6
call fcn.0043b5f8
shl bl, cl
mov ebx, eax
bt bx, bp
pushal
stc
cmp byte [edi], 0x23
call fcn.0043cbd2
mov byte [edi + 0xefc35e4], bh
mov ecx, 0x1b9464c1
popfd
aad 0x5b
xor byte [esi - 0x79], bh
mov ch, byte [ecx + 0x41a4f9db]
push ebp
mov ch, 0xba
test eax, 0xfc8e5e56
cmc
xchg esp, eax
mov al, byte [esi]
cmpsb byte [esi], byte es:[edi]
push ebp
jnp 0x42f55d
mov esi, 0x83c11880
sbb ecx, dword [eax + 0x2c767a5]
aad 0x71
mov dh, dl
ror dword [ebx + 0x21], 0x41
call 0x3ce756ef
test eax, 0x2906e9c6
rcl dword [eax - 0x2df1b313]
aam 0x5c
sahf
sal byte [esp + ebx], 1
push esp
and byte [esi], ah
sub dword gs:[ecx], ebp
jmp 0x42f643
xchg ecx, eax
insb byte es:[edi], dx
idiv dword [ebx + 0x555b17f]
sub eax, 0xdaef3a37
and bl, ah
adc byte [ecx + 0x567c7b38], ah
push edx
adc edi, dword [eax + 0x3e]
bnd jne 0x42f6d5
push ss
sbb al, 0x10
push edi
sub eax, 0x150e4372
xchg ebx, eax
xchg edx, eax
push esi
invalid
into
pop edx
getsec
loop 0x42f6d7
movsd dword es:[edi], dword [esi]
mov al, byte [0xe860cfa2]
sub bl, bh
and al, 0x8e
mov eax, 0xb61e9a87
or dl, byte [eax]
lds esi, [eax]
mov edx, esp
mov edi, 0xedac140f
imul eax, dword [ebx + edx*8], 0x78
ret 0x5fc7
Function at 0x1009a4a
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x101d689
call fcn.0101caf8
sub esp, 0x70
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, ecx
je 0x1009b85
push edi
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [ebx]
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 2
call dword [eax + 4]
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xa0]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x104d
push dword [esi + 0x9c]
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x28], ebx
call edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x1074
push dword [esi + 0x9c]
mov dword [esi + 0xa0], eax
mov dword [ebp - 0x74], 1
call edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x7c]
push eax
push dword [esi + 0xa0]
mov dword [ebp - 0x74], 2
push 0x1074
push dword [esi + 0x9c]
call edi
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x6c], 0xf000
call dword [eax + 8]
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ebp - 0x7c]
push eax
push dword [esi + 0xa0]
push 0x102b
push dword [esi + 0x9c]
inc ecx
shl ecx, 0xc
mov dword [ebp - 0x70], ecx
call edi
inc dword [esi + 0xa0]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1009e26
Capabilities:
Get common file path

Disassembly:
mov eax, 0x101d709
call fcn.0101caf8
sub esp, 0x694
mov eax, dword [0x1023fb4]
push ebx
push esi
push edi
push 7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x690], ecx
pop eax
xor ebx, ebx
lea ecx, [ebp - 0x69c]
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], 0x18
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x678], ecx
push ebx
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jl 0x100a036
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x674]
call sub.MFC42u.DLL_CString::CString_2
push 0x5c
lea ecx, [ebp - 0x674]
mov dword [ebp - 4], ebx
call sub.MFC42u.DLL_CString::ReverseFind
mov edi, eax
cmp edi, 0xffffffff
je 0x100a027
push 0x1002328
lea ecx, [ebp - 0x680]
call sub.MFC42u.DLL_CString::CString_2
mov esi, eax
push edi
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::Left
push esi
push eax
lea eax, [ebp - 0x688]
push eax
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_operator
push eax
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::operator
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x68c]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x67c]
call fcn.0101c24c
push 0x100231c
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString_2
push eax
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 5
call fcn.0101c3f0
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100a019
test byte [ebp - 0x670], 2
je 0x1009fae
lea eax, [ebp - 0x644]
push 0x1002304
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1009ffc
test byte [ebp - 0x670], 0x10
jne 0x1009ffc
push 0x10
call sub.MFC42u.DLL_operatornew
pop ecx
mov ecx, eax
mov dword [ebp - 0x6a0], ecx
cmp ecx, ebx
mov byte [ebp - 4], 6
je 0x1009fea
push dword [ebp - 0x674]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x644]
push eax
call fcn.01008b0b
jmp 0x1009fec
xor eax, eax
mov ecx, dword [ebp - 0x690]
push eax
mov byte [ebp - 4], 4
call fcn.0100950a
lea eax, [ebp - 0x670]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1009f8d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call sub.MFC42u.DLL_CString::CString
add dword [ebp - 0x678], 4
mov eax, dword [ebp - 0x678]
mov eax, dword [eax]
cmp eax, ebx
jne 0x1009e6e
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
inc eax
pop ebx
call fcn.0101bddf
leave
ret
Function at 0x100b6cf
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x101d977
call fcn.0101caf8
sub esp, 0x698
mov eax, dword [0x1023fb4]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
push esi
mov eax, 0x80000002
push edi
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x69c], 0x80000001
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x694], 0x10026c4
mov dword [ebp - 0x690], 0x10026b4
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x674], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], ebx
push 0x20019
push 0x1002630
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x674]
call fcn.0100985e
test eax, eax
jne 0x100b8af
mov eax, dword [ebp - 0x678]
mov edi, dword [ebp + eax - 0x694]
cmp edi, ebx
mov dword [ebp - 0x688], 0x104
je 0x100b8a4
lea eax, [ebp - 0x688]
push eax
push edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x674]
call fcn.0100652a
test eax, eax
jne 0x100b8a4
lea ecx, [ebp - 0x674]
call fcn.0100650c
push ebx
push 0x1002624
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wmakepath]
add esp, 0x14
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x680], eax
je 0x100b8af
test byte [ebp - 0x670], 2
je 0x100b80d
lea eax, [ebp - 0x644]
push 0x1002304
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100b87b
test byte [ebp - 0x670], 0x10
jne 0x100b87b
push 0x1c
call sub.MFC42u.DLL_operatornew
pop ecx
mov ecx, eax
mov dword [ebp - 0x6a4], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x100b837
call fcn.010090c1
mov esi, eax
jmp 0x100b839
xor esi, esi
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x100b87b
lea eax, [ebp - 0x218]
push eax
push edi
push 0x1002630
push dword [ebp - 0x67c]
lea eax, [ebp - 0x670]
push eax
mov ecx, esi
call fcn.0100af7d
test eax, eax
je 0x100b873
mov ecx, dword [ebp - 0x684]
push esi
call fcn.01009a4a
jmp 0x100b87b
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100b7ec
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x100b8af
lea ecx, [ebp - 0x674]
call fcn.0100650c
add dword [ebp - 0x678], 4
mov eax, dword [ebp - 0x678]
mov eax, dword [ebp + eax - 0x6a0]
cmp eax, ebx
mov dword [ebp - 0x67c], eax
jne 0x100b73c
lea ecx, [ebp - 0x674]
call fcn.0100650c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101bddf
leave
ret
Function at 0x100d643
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
push 0x4653
push esi
call fcn.01018e13
mov ecx, esi
mov edi, eax
call fcn.0100caa3
test eax, eax
jl 0x100d682
mov ecx, esi
call fcn.0100d4af
test eax, eax
jl 0x100d682
push 1
push 0x4652
push esi
call fcn.01018e13
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x100d6be
push 0x4654
push esi
call fcn.01018e13
test eax, eax
je 0x100d6be
push 0x1001b3c
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x4652
push esi
call fcn.01018e13
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x100d6be
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret

Function at 0x100da3e
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100da58
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01018e13
test eax, eax
jne 0x100da5f
mov eax, 0x80004005
jmp 0x100da6a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop ebp
ret 8

Function at 0x10100c2
Capabilities:
Manipulate boot configuration

Disassembly:
mov eax, 0x101e053
call fcn.0101caf8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
push 0x6a
mov dword [ebp - 0x10], esi
call fcn.0101c354
lea eax, [esi + 0x90]
mov dword [ebp - 4], ebx
mov dword [eax], 0x1001d90
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 1
mov dword [esi], 0x10035fc
mov dword [eax], 0x10035d4
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString_1
lea edi, [esi + 0xcc]
mov ecx, edi
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString_1
push 0x10035b8
mov ecx, edi
mov byte [ebp - 4], 5
mov dword [esi + 0xc4], ebx
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x101ced5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1004da0
push 0x80000000
call dword [entry0]
test eax, eax
jne 0x101cf2d
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1004ddc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101cf20
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101cf2f
xor eax, eax
pop esi
leave
ret 4
Function at 0x40331c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x470020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403394
xor eax, eax
push ebp
push 0x40338d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403394
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x470020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x470020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x472048], 0
je 0x404111
cmp word [0x47221c], 0xd7b2
jne 0x4040d9
cmp dword [0x472224], 0
jbe 0x4040d9
mov eax, 0x472218
call dword [0x472234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404138
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x470030], 0
jne 0x40412d
push 0
push 0x470064
push 0x47006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret