joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424ba0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.004116c0
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x42e33c]
je 0x424ca7
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x424c10
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x424c17
cmp ebx, ebx
jne 0x424c17
xor eax, eax
jmp 0x424caa
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x424c24
mov byte [esi + 0x20], bl
jmp 0x424c38
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040fe98
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040fe98
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040fe98
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x424c93
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x424ca7
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x425698
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x436588]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4256e7
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4256e7
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4256f3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004116a4
leave
ret 8
Function at 0x4263f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x436588]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x42643f
push dword [ebp + 8]
call fcn.0042897a
mov esi, eax
test esi, esi
je 0x426467
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x426467
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x42cf80
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004116a4
leave
ret 0xc

Function at 0x4273cd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x436588]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x42742b
push 0x42e444
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00411f28
add esp, 0x10
cmp eax, 0xffffffff
je 0x42743f
cmp eax, esi
jae 0x42743f
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x427441
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x4273f6
jmp 0x427442
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004116a4
leave
ret
Function at 0x427462
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x436588]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x427504
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x427606
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4275b4
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push reloc.FTD2XX.dll_Ordinal_1
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427607
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4275a9
cmp dword [ebp - 0x24], 1
jne 0x4275a9
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x42e454
push eax
call fcn.004109fc
add esp, 0xc
cmp eax, 1
jne 0x4275a9
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427607
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x427607
lea ecx, [ebp - 0x18]
push ecx
push 0x42744c
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x427607
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x42762d
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.004273cd
cmp eax, ebx
pop ecx
pop ecx
jne 0x42762f
inc edi
cmp edi, esi
jl 0x427616
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004116a4
leave
ret 4
Function at 0x42763e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x43631c
je 0x4276fa
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push reloc.FTD2XX.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4276e2
mov esi, dword [ebx + 4]
jmp 0x4276dc
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4276cc
cmp dword [ebp - 0xc], 4
jne 0x4276cc
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4276c4
or dword [eax + 0x9c], ecx
jmp 0x4276cc
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x427690
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x427673
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x427ab4
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x42a72e
call fcn.00411720
sub esp, 0x11c
mov eax, dword [0x436588]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x427bad
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x427b81
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040edc3
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00427ab4
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401030
test bl, bl
jne 0x427b81
or dword [ebp - 4], 0xffffffff
jmp 0x427af2
cmp esi, 0x103
je 0x427b91
cmp esi, 0x3f2
jne 0x427ba1
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004116a4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x428065
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x42809a
cmp edi, dword [esi + 0xc]
jge 0x42809a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42809a
cmp edi, dword [eax + 8]
jge 0x42809a
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x42809c
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4281a0
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4281d4
jmp fcn.0041d6cf
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x428245
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x42833e
cmp eax, dword [edi + 0xc]
jge 0x42833e
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x428296
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x428327
cmp dword [ebp + 0xc], ebx
je 0x428327
jmp 0x4282c0
push 0x10
call fcn.00427f31
cmp eax, ebx
je 0x4282ac
mov ecx, eax
call fcn.00428197
mov esi, eax
jmp 0x4282ae
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4282d7
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4282e7
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4282f9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041d6cf
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004116c0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x428339
cmp ecx, dword [esi + 8]
jge 0x428339
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x42833f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4283fd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42842b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x428449
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00428367
jmp 0x428449
mov eax, dword [esi + 0x14]
test eax, eax
je 0x428449
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00428367
test edi, edi
mov eax, edi
jne 0x428433
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4391cc]
test ecx, ecx
je 0x4284fc
jmp 0x4283fc
ret 8
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d030]
jne 0x40107a
repz ret
jmp fcn.00401ac1

Function at 0x409195
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bf5
and dword [ebp - 4], 0
cmp dword [0x43f794], 0
mov ebx, eax
jne 0x409246
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092f7
push eax
call fcn.00404b83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43f794], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f798], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f79c], eax
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x43f7a4], eax
test eax, eax
je 0x409246
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x43f7a0], eax
mov eax, dword [0x43f7a0]
cmp eax, ebx
je 0x40929e
cmp dword [0x43f7a4], ebx
je 0x40929e
push eax
call fcn.00404bfe
push dword [0x43f7a4]
mov esi, eax
call fcn.00404bfe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40929e
test edi, edi
je 0x40929e
call esi
test eax, eax
je 0x409295
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409295
test byte [ebp - 0xc], 1
jne 0x40929e
or dword [ebp + 0x10], 0x200000
jmp 0x4092d7
mov eax, dword [0x43f798]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4092d7
mov eax, dword [0x43f79c]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f794]
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b010
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x43d030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c1d01c]
push ebx
mov ebx, dword [0x2c1ce68]
push esi
mov esi, dword [0x43df60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b051
push str.pirebewaxamicafivojazirisibilig
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c1d01c]
mov dword [0x43f8f4], esi
cmp eax, 0x114e
jne 0x40b07b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.sosepukuvupafizafaguwiferayiv
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c1d01c]
cmp eax, 0x2f
jne 0x40b09d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040af50
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401070
add esp, 0x428
ret
Function at 0x100092c3
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push pe_nt_image_headers32
call sub.glib_lite.dll_Ordinal_406
mov edi, eax
pop ecx
test edi, edi
je 0x1000934d
push edi
xor ebp, ebp
push ebp
push 0x1001d834
push 0x10023880
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x10009352
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_1
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x10009352
cmp eax, 0xffffffff
je 0x10009352
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
jmp 0x1000934f

Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax*4 + 0x1001e2c8]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], ecx
lea edi, [ecx + ecx]
pop esi
mov ebx, esi
xor edx, edx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl edx, eax
mov al, bl
sub edx, ecx
mov ecx, edx
sar ecx, 0x1f
xor dl, cl
sub al, dl
add al, cl
mov ecx, dword [esp + 0x14]
add al, cl
xor al, bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0x80
jle 0x1001054d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10013a33
pop dword [ebp - 0x1c]
mov eax, 0x10013a33
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x96e08d97
add dword [ebp - 0x2c], 0xb771b7b4
mov dword [ebp - 0x28], 0x422147df
add dword [ebp - 0x28], 0xf0120466
mov dword [ebp - 0x24], 0x1efa51c2
add dword [ebp - 0x24], 0x2d51f26c
mov dword [ebp - 0x20], 0x84338b04
sub dword [ebp - 0x20], 0x84338b04
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xc08b4e53
add eax, 0x4f76722d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf8adbb7d
add dword [ebp - 0x2c], 0x7bc4add9
mov dword [ebp - 0x28], 0x66bb69ac
sub dword [ebp - 0x28], 0x254f0837
mov dword [ebp - 0x24], 0x76a3033f
sub dword [ebp - 0x24], 0x133396d3
mov dword [ebp - 0x20], 0xe58a1ecc
sub dword [ebp - 0x20], 0xe58a1ecc
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xc09830e4
sub eax, 0xb09670e4
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34ccd
push 0
call eax
mov ecx, 0x6f7c9ac8
sub ecx, 0x6f7c5d3a
mov ebx, eax
mov esi, 0x10026800
add esi, dword [ebp - 0x1c]
mov edx, 0x517d1682
sub edx, 0x67b7530e
xor dword [ebp - 0x18], edi
mov edi, dword [esi]
mov dword [ebp - 0xc], 0xbdc5a65e
xor edi, edx
xor dword [ebp - 0xc], esi
mov dword [ebx], edi
add dword [ebp - 0x10], 0x735ea4e4
add ebx, 0x599d22eb
sub ebx, 0x599d22e7
add esi, 0xccc999b1
add esi, 0x33366653
loop 0x10013b4a
add eax, 0x1edce6ed
add eax, 0xe124021e
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000149c
pop dword [ebp - 0x28]
mov eax, 0x60c27e4e
add eax, 0xaf3d964e
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x232d5201
sub dword [ebp - 0x38], 0xd4db0cb6
mov dword [ebp - 0x34], 0x80f866f8
add dword [ebp - 0x34], 0xb13ae54d
mov dword [ebp - 0x30], 0x198970ef
sub dword [ebp - 0x30], 0xcd3d2cc1
mov dword [ebp - 0x2c], 0x2999df32
add dword [ebp - 0x2c], 0xd66620ce
lea eax, [ebp - 0x38]
push eax
mov eax, 0xb6af3011
add eax, 0x5950e03f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xaadd2cae
sub dword [ebp - 0x38], 0x366ac358
mov dword [ebp - 0x34], 0x7360cb71
add dword [ebp - 0x34], 0xce0b9604
mov dword [ebp - 0x30], 0x3bebc328
add dword [ebp - 0x30], 0x2783a944
mov dword [ebp - 0x2c], 0x325dfc8e
add dword [ebp - 0x2c], 0xcda20372
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3618b
push 0
call eax
mov ecx, 0x1ad90612
sub ecx, 0x1ad8bf9a
xor edx, edx
add edx, eax
mov edi, 0x630769d5
add edi, 0xacf8e82b
add edi, dword [ebp - 0x28]
mov esi, 0x4b21703d
add esi, 0x96b5338f
xor dword [ebp - 0xc], esi
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0x24d26a98
sub ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x20], esi
add edx, 0xc9c4b411
sub edx, 0xc9c4b40d
add edi, 0x6816f8bc
sub edi, 0x6816f8b8
loop 0x100015bb
add eax, 0xf5120304
add eax, 0xaef09af
xor ebx, ebx
add ebx, eax
add eax, 0x437a7a43
add eax, 0xbc8585c2
mov ecx, 0x4f97eaed
sub ecx, 0x3f97eaed
add ecx, dword [ebp - 0x28]
call ebx
leave
ret