joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5a02e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x5a9544]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0xfe
lea edx, [ebp - 0x127]
push 0
push edx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], ecx
mov byte [ebp - 0x128], 0
call fcn.00528340
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push 0x57b544
mov dword [ebp - 0x28], 0x53746547
mov dword [ebp - 0x24], 0x65747379
mov dword [ebp - 0x20], 0x7269446d
mov dword [ebp - 0x1c], 0x6f746365
mov dword [ebp - 0x18], 0x417972
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xff
lea ecx, [ebp - 0x128]
push ecx
call eax
mov edi, ebx
lea esi, [ebp - 0x128]
mov byte [ebp - 0x125], 0
call fcn.00405a40
test eax, eax
je 0x405de9
lea edx, [ebp - 0x14]
push edx
push 0x57b544
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x416c6175
mov dword [ebp - 0xc], 0x636f6c6c
mov word [ebp - 8], 0x7845
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0x12c]
mov ecx, dword [ebx]
push 0x40
push 0x3000
push edi
push 0
push ecx
call eax
mov dword [ebp - 0x12c], eax
test eax, eax
je 0x405de9
mov edx, dword [ebp - 0x130]
mov esi, dword [ebx]
push edx
call fcn.00405ad0
add esp, 4
test eax, eax
je 0x405de9
mov eax, dword [ebp - 0x12c]
push eax
mov esi, ebx
call fcn.00405b60
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00526910
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00526910
mov esp, ebp
pop ebp
ret

Function at 0x406b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406b2b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406b62
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x406b5e
jmp 0x406b50
cmp esi, eax
jae 0x406b62
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406b50
cmp esi, eax
jb 0x406b69
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407300
Capabilities:
Query or enumerate registry value

Disassembly:
cmp byte [0x5aa928], 0
jne 0x4073d8
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj22.4_.4202:zb0.1:bb
mov byte [0x5aa928], 1
call fcn.00527619
push 0x12a0
push 0
push 0x5a9548
call fcn.00528340
push 0
push 0x5a9566
push 0x57bd18
call fcn.00407060
push 0
push 0x5a9764
push 0x57bd20
call fcn.00407060
push 0x5a97a0
push 0
push 0x57bd28
call fcn.00407060
push 0
push 0x5a97a4
push 0x57bd30
call fcn.00407060
add esp, 0x40
push 0
push 0x5a99a2
push 0x57bd38
call fcn.00407060
push 0x5a99e0
push 0
push 0x57bd40
call fcn.00407060
push 0
push 0x5a99e4
push 0x57bd48
call fcn.00407060
push 0
push 0x5a9be2
push 0x57bd50
call fcn.00407060
push 0x5a9c20
push 0
push 0x57bd58
call fcn.00407060
add esp, 0x3c
mov eax, 0x5a9548
jmp fcn.004071c0
ret

Function at 0x407710
Capabilities:
Create thread
Hide graphical window

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call dword [sym.imp.USER32.dll_GetInputState]
call fcn.00407300
push 0
push 0
push 0
push 0x4075c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
ret 0x10
Function at 0x4163fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x416442
call fcn.00459993
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x416442
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41645e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00415efb
mov esi, eax
test edi, edi
je 0x41645c
test ebx, ebx
je 0x41645c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x418585
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5472de
call fcn.00527fab
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4185aa
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4185fc
call fcn.0043e411
push eax
lea ecx, [ebp - 0x10]
call fcn.00406fc0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005280b5
push eax
call fcn.00406d70
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004052b0
mov eax, esi
call fcn.00528083
ret 8

Function at 0x42cf4a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x42cf64
call fcn.00459993
mov esi, dword [eax + 0xc]
push dword [0x5a4748]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42cf82
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x42cf7a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x42cfaf
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x42cf7c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0042ce78
mov esi, eax
jmp 0x42cfa1
Function at 0x44db44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44db8c
call fcn.00459993
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44db8c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x44dbcf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x44dbb8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x44dbb8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x44dbcc
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4515b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00459993
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4515ea
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004511ee
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x451648
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x45166c
cmp dword [edi + 0x74], 0
jne 0x45166c
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00459993
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00451609
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45a037
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x541ec9
call fcn.00527fab
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00408b40
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x45a099
call fcn.00459256
cmp eax, 1
jne 0x45a099
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00450316
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040c803
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004052b0
mov dword [ebp + 8], closesocket
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004052b0
mov eax, esi
call fcn.00528083
ret 0x10

Function at 0x45a0c2
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x541ec9
call fcn.00527fab
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00408b40
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x45a124
call fcn.00459256
cmp eax, 1
jne 0x45a124
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00450316
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040c803
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004052b0
mov dword [ebp + 8], closesocket
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004052b0
mov eax, esi
call fcn.00528083
ret 0x14

Function at 0x49f8f0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x49f92e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49f93c
push str.MoveFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49f93c
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x49f93e
cmp dword [esi + 4], 0
je 0x49f93c
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4d2d24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4d2d3c
mov edi, dword [esi + 0xc]
jmp 0x4d2d7c
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4d2d55
call fcn.00451a2a
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4d2d6a
call fcn.00451a2a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4d2d7c
call fcn.00451a2a
call fcn.00459993
cmp dword [eax + 0x3c], 0
je 0x4d2d91
push edi
mov ecx, ebx
call fcn.004d1bd8
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004d2c3e
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4d2daf
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d2dbb
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4f523b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0051d6f2
call fcn.004593c4
cmp dword [eax + 0x14], 0
jne 0x4f5258
mov ecx, esi
pop esi
jmp fcn.004f4d40
pop esi
ret

Function at 0x4f86af
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0046d08d
call fcn.004593c4
cmp dword [eax + 0x14], 0
jne 0x4f86cc
mov ecx, esi
pop esi
jmp fcn.004f8082
pop esi
ret

Function at 0x50a9bb
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0050a65f
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x50aa05
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004143f4
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040ecc2
jmp 0x50aa10
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00466734
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x50aa16
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00417e4d
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x50aa53
call fcn.0050a65f
mov dword [esi + 0xc], 1
jmp 0x50aa58
call fcn.0050a65f
cmp dword [esi], 0
je 0x50aaa1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x50aa79
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004143f4
jmp 0x50aa8b
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00406d30
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040ecc2
jmp 0x50aac5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x50aac5
push dword [esi]
push dword [ebp + 8]
call fcn.00466734
pop esi
pop ebp
ret 0xc

Function at 0x526910
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a02e4]
jne 0x52691a
repz ret
jmp fcn.0052ce44
Function at 0x539208
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a02e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052f6e5
and dword [ebp - 0x14], 0
cmp dword [0x5a8628], 0
mov dword [ebp - 0x18], eax
jne 0x5392bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x539363
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57a3ec
push ebx
call edi
test eax, eax
je 0x539363
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x57a3dc
push ebx
mov dword [0x5a8628], eax
call edi
push eax
call esi
push 0x57a3c8
push ebx
mov dword [0x5a862c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5a8630], eax
call edi
push eax
call esi
mov dword [0x5a8638], eax
test eax, eax
je 0x5392bb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5a8634], eax
mov eax, dword [0x5a8634]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x539314
cmp dword [0x5a8638], ecx
je 0x539314
push eax
call esi
push dword [0x5a8638]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x539314
test ebx, ebx
je 0x539314
call edi
test eax, eax
je 0x53930b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53930b
test byte [ebp - 8], 1
jne 0x539314
or dword [ebp + 0x10], 0x200000
jmp 0x539347
mov eax, dword [0x5a862c]
cmp eax, dword [ebp - 0x18]
je 0x539347
push eax
call esi
test eax, eax
je 0x539347
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x539347
mov eax, dword [0x5a8630]
cmp eax, dword [ebp - 0x18]
je 0x539347
push eax
call esi
test eax, eax
je 0x539347
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5a8628]
call esi
test eax, eax
je 0x539363
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x539365
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00526910
leave
ret
Function at 0x78aa1e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x78aa1e8f
pop dword [ebp - 0x14]
mov eax, 0x491058e7
add eax, 0x2f99c5a8
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x521aa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3cbdf606
add ecx, 0xc3424d40
xor esi, esi
add esi, eax
mov edi, 0xdd892a57
sub edi, 0x64d33c57
add edi, dword [ebp - 0x14]
mov edx, 0xee325749
sub edx, 0x75621af1
xor dword [ebp - 8], 0x58b64cba
mov ebx, dword [edi]
add ebx, edx
add dword [ebp - 8], edx
mov dword [esi], ebx
sub dword [ebp - 8], esi
add esi, 4
add edi, 4
loop 0x78aa1eeb
add eax, 0x2fe1a847
add eax, 0xd01f57a4
xor ebx, ebx
add ebx, eax
add eax, 0x8274ed2a
sub eax, 0x8274ed25
mov ecx, 0x78aa0000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x3008862e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x3008863d
pop dword [ebp - 0x10]
mov eax, 0xc753d149
sub eax, 0x974b4b0c
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x6ea0d
push 0
mov eax, 0xa70eb7b5
add eax, 0x89145ad3
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x93e2d43e
add ecx, 0x6c1d80f2
xor ebx, ebx
add ebx, eax
mov edi, 0x30396000
add edi, dword [ebp - 0x10]
mov edx, 0xa12152ee
add edx, 0x4d930512
mov dword [ebp - 8], 0x9566ae05
mov esi, dword [edi]
xor dword [ebp - 0xc], 0xd285300
xor esi, edx
add dword [ebp - 0xc], ebx
mov dword [ebx], esi
sub dword [ebp - 0xc], 0xc1176f9d
add ebx, 0xb4605b14
add ebx, 0x4b9fa4f0
add edi, 0x67c9b72a
add edi, 0x983648da
loop 0x30088698
add eax, 0x29f7367f
add eax, 0xd60a1114
mov ebx, eax
add eax, 0xfe6a4c5e
add eax, 0x195b3a7
mov ecx, 0x4d20abdc
add ecx, 0xe2df5424
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x300c7cde
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
lea eax, [ebp - 0x1c]
push eax
mov esi, str.Windows
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [ebp - 0xc]
dec eax
je 0x300c7d43
dec eax
jne 0x300c7d57
cmp dword [ebp - 0x18], 6
jne 0x300c7d16
mov esi, str.Windows_Vista
jmp 0x300c7d57
cmp dword [ebp - 0x18], 5
jne 0x300c7d36
cmp dword [ebp - 0x14], 1
jne 0x300c7d29
mov esi, str.Windows_XP
jmp 0x300c7d57
cmp dword [ebp - 0x14], 0
jne 0x300c7d57
mov esi, str.Windows_2000
jmp 0x300c7d57
cmp dword [ebp - 0x18], 4
jne 0x300c7d57
mov esi, str.Windows_NT
jmp 0x300c7d57
cmp dword [ebp - 0x14], 0
jbe 0x300c7d50
mov esi, str.Windows_98_ME
jmp 0x300c7d57
jne 0x300c7d57
mov esi, str.Windows_95
mov eax, esi
pop esi
add ebp, 0x78
leave
ret

Function at 0x300c7fd4
Capabilities:
Check os version
Delete file
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb4
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x30], 2
jne 0x300c8003
cmp dword [ebp - 0x3c], 6
jb 0x300c8003
mov al, 1
jmp 0x300c80f7
push ebx
lea eax, [ebp + 0x70]
push eax
push str.SoftwareMacromediaFlashPlayer
xor ebx, ebx
push reloc.oleaut32.dll_SysReAllocString
mov dword [ebp + 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
jne 0x300c8063
push esi
push str.AutoUpdate
lea ecx, [ebp + 0x54]
call fcn.30032e0f
mov eax, dword [ebp + 0x58]
inc eax
push eax
push dword [ebp + 0x54]
push 1
push ebx
push str.AutoUpdateTest
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x70]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x70], ebx
call fcn.300046b5
cmp esi, ebx
pop esi
je 0x300c806a
xor al, al
jmp 0x300c80f6
lea ecx, [ebp + 0x60]
call fcn.30031759
mov ecx, dword [ebp + 0x7c]
lea eax, [ebp + 0x60]
push eax
call fcn.3008862e
test al, al
je 0x300c80ec
push str.Macromed
lea ecx, [ebp + 0x60]
call fcn.3008862e
push 0x3023b70c
lea ecx, [ebp + 0x60]
call fcn.3008862e
push str.testUpdate.txt
lea ecx, [ebp + 0x60]
call fcn.3008862e
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp + 0x60]
call fcn.30031883
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, ebx
je 0x300c80ec
cmp eax, 0xffffffff
je 0x300c80ec
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x300c80ec
lea ecx, [ebp + 0x60]
call fcn.30031883
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x300c80ec
mov bl, 1
lea ecx, [ebp + 0x60]
call fcn.300315be
mov al, bl
pop ebx
add ebp, 0x74
leave
ret

Function at 0x300c8ad4
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 4], 7
jl 0x300c8ae8
call fcn.3008862e
test ax, ax
jne 0x300c8aee
xor eax, eax
ret
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
push eax
call fcn.300c7d8f
add esp, 4
ret