joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30017c9c
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x300190b0
call fcn.30017e54
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300200e8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30017a3b
cmp eax, esi
jne 0x30017a2e
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30017a3e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30017a15
xor esi, esi
inc esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017a51
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30017a80
mov eax, dword [0x300200e4]
test eax, eax
jne 0x30017a7a
mov dword [0x300200e4], esi
push 0x30001534
push 0x30001528
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30017a80
jmp 0x30017ba8
mov dword [0x3001fd94], esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017aa4
push 0x30001524
push 0x300014e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300200e4], 2
test ebx, ebx
jne 0x30017ab0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300200f4], 0
je 0x30017ad4
push 0x300200f4
call fcn.30018076
pop ecx
test eax, eax
je 0x30017ad4
push 0
push 2
push 0
call dword [0x300200f4]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30017b30
test al, al
je 0x30017aee
cmp dword [ebp - 0x1c], 0
jne 0x30017b30
mov al, byte [esi]
test al, al
je 0x30017afe
cmp al, 0x20
ja 0x30017afe
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30017aee
test byte [ebp - 0x3c], 1
je 0x30017b0a
movzx eax, word [ebp - 0x38]
jmp 0x30017b0d
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3001fd90], eax
cmp dword [0x3001fd84], 0
jne 0x30017b84
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30017b3f
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30017b52
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30017adb
cmp dword [0x3001fd94], 0
jne 0x30017b93
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3001fd90]
jmp 0x30017bb4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30017e99
ret
call fcn.300178c4
jmp 0x300179db
Function at 0x30018427
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x474], eax
push 0x105
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
cmp eax, esi
jne 0x30018463
xor eax, eax
jmp 0x30018589
add eax, eax
lea ecx, [ebp + eax - 0x260]
cmp word [ecx], 0x5c
je 0x3001847f
mov word [ecx], 0x5c
mov word [ebp + eax - 0x25e], si
push ebx
push edi
push 0x106
lea eax, [ebp - 0x260]
push eax
mov edi, 0x30003538
push edi
call fcn.300183fc
push 8
push esi
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x300184bf
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x30018571
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30003524
push ebx
call edi
push 0x30003504
push ebx
mov dword [ebp - 0x478], eax
call edi
cmp eax, esi
mov dword [ebp - 0x470], eax
je 0x30018571
cmp dword [ebp - 0x474], esi
mov ebx, 0x300034f0
mov edi, 0x300034a0
je 0x30018549
cmp dword [ebp - 0x478], esi
je 0x30018571
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x474]
call dword [ebp - 0x478]
cmp eax, esi
jne 0x30018542
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
cmp eax, esi
je 0x30018575
cmp eax, 0x642
je 0x30018575
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push esi
push ebx
push edi
mov dword [ebp - 0x46c], 0x104
call dword [ebp - 0x470]
test eax, eax
je 0x30018575
xor eax, eax
jmp 0x30018587
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x300200d4], eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.30017978
leave
ret 4

Function at 0x30018626
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
xor ebx, ebx
push 0x300035bc
mov dword [ebp - 0x318], ebx
mov byte [ebp - 0x108], bl
call fcn.300183d3
push esi
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.300183d3
lea eax, [ebp - 0x318]
push eax
push 0x20019
push ebx
push 0x30003568
push 0x80000002
mov dword [ebp - 0x31c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x314]
push eax
push ebx
push ebx
push 0x30003548
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x31c]
pop edi
shr eax, 1
cmp dword [ebp - 0x318], ebx
pop esi
mov word [ebp + eax*2 - 0x314], bx
pop ebx
je 0x300186e1
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.30018598
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30017978
leave
ret 4
Function at 0x30018702
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x30003438
push 0x80000002
mov dword [ebp - 0x214], ebx
xor esi, esi
mov dword [ebp - 0x218], 0x208
mov word [ebp - 0x210], bx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 0x30002ab0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x214], ebx
je 0x3001878d
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x300187b8
cmp eax, 0x208
ja 0x300187b8
shr eax, 1
mov esi, eax
je 0x300187b8
lea eax, [ebp + esi*2 - 0x212]
cmp word [eax], 0x5c
je 0x300187b8
dec esi
dec eax
dec eax
cmp esi, ebx
jne 0x300187ab
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
mov word [ebp + esi*2 - 0x210], bx
call fcn.30018598
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.30017978
leave
ret 4

Function at 0x3001883c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor esi, esi
push esi
push 0x30003568
push 0x80000002
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x30003548
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x218]
shr eax, 1
cmp dword [ebp - 0x214], esi
mov word [ebp + eax*2 - 0x210], si
je 0x300188c4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x300035f0
call fcn.300183fc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
pop esi
jne 0x300188f6
push 0x300035e8
call fcn.30018702
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30017978
leave
ret
Function at 0x4010a5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edi, eax
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ecx + ecx - 1]
mov dword [esp], ecx
call sub.cygwin1.dll_malloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4010ef
mov dword [esp], str.out_of_memory__n
call fcn.00401050
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov ebx, 0
mov edi, dword [ebp - 0x14]
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
mov esi, 0
cmp ecx, 0xfffffffe
je 0x401150
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x40112d
mov edx, dword [ebp - 0x10]
mov byte [ebx + edx], 0x5c
inc ebx
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + esi]
mov edx, dword [ebp - 0x10]
mov byte [ebx + edx], al
inc ebx
inc esi
mov edi, dword [ebp - 0x14]
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x40110b
mov edx, dword [ebp - 0x10]
mov byte [edx + ebx], 0
cmp esi, ebx
je 0x4011af
mov edi, edx
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp], eax
call sub.cygwin1.dll_realloc
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
test eax, eax
jne 0x40119b
mov dword [esp], str.out_of_memory__n
call fcn.00401050
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp], eax
call sub.cygwin1.dll_strcpy
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40126b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
shl eax, 2
mov dword [esp], eax
call sub.cygwin1.dll_malloc
mov esi, eax
test eax, eax
jne 0x4012a0
mov dword [esp], str.out_of_memory__n
call fcn.00401050
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov ebx, 0
cmp ebx, dword [ebp + 8]
jge 0x401306
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + ebx*4]
cld
mov al, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov dword [esp], ecx
call sub.cygwin1.dll_malloc
mov dword [esi + ebx*4], eax
test eax, eax
jne 0x4012eb
mov dword [esp], esi
call sub.cygwin1.dll_free
mov dword [esp], str.out_of_memory__n
call fcn.00401050
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ebx*4]
mov dword [esp + 4], eax
mov eax, dword [esi + ebx*4]
mov dword [esp], eax
call sub.cygwin1.dll_strcpy
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x4012aa
mov eax, esi
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401731
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.00403533
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004011b7
mov ebx, eax
mov esi, edx
mov edx, dword [ebp + 0xc]
or edx, dword [ebp + 0x10]
setne al
movzx eax, al
mov edx, 1
cmp esi, dword [ebp + 0x10]
jg 0x401779
jl 0x401774
cmp ebx, dword [ebp + 0xc]
ja 0x401779
mov edx, 0
test edx, eax
je 0x401783
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 4], 0x405050
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call sub.cygwin1.dll__fopen64
mov edi, eax
test eax, eax
jne 0x4017de
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.error_opening_file__s_n
call fcn.00401050
mov eax, 0
jmp 0x401928
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], str.error_reading_from_file__s_n
call fcn.00401050
mov dword [esp], edi
call sub.cygwin1.dll_fclose
mov eax, 0
jmp 0x401928
test esi, esi
js 0x4018c8
test esi, esi
jg 0x4017f3
cmp ebx, 0
jbe 0x4018c8
mov eax, ebx
and eax, 0x1fff
mov edx, 0
mov dword [ebp - 0x90], 0x2000
mov dword [ebp - 0x8c], 0
mov ecx, edx
or ecx, eax
je 0x40185f
mov eax, ebx
mov edx, esi
test esi, esi
jns 0x401829
add eax, 0x1fff
adc edx, 0
shrd eax, edx, 0xd
sar edx, 0xd
shld edx, eax, 0xd
shl eax, 0xd
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
mov eax, ebx
mov edx, esi
sub eax, dword [ebp - 0xa0]
sbb edx, dword [ebp - 0x9c]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov edx, dword [ebp - 0x90]
mov dword [esp + 4], edx
mov dword [esp], 0x406028
call sub.cygwin1.dll_fread
cmp eax, 1
jne 0x4017b9
mov ecx, dword [ebp - 0x90]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x406028
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.00403564
sub ebx, dword [ebp - 0x90]
sbb esi, dword [ebp - 0x8c]
test esi, esi
js 0x4018c8
test esi, esi
jg 0x4017f3
cmp ebx, 0
ja 0x4017f3
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.00403653
mov esi, 0x408028
mov ebx, 0
movzx eax, byte [ebp + ebx - 0x88]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02x
mov dword [esp], esi
call sub.cygwin1.dll_sprintf
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.cygwin1.dll_strchr
mov esi, eax
inc ebx
cmp ebx, 0xf
jle 0x4018e7
mov dword [esp], edi
call sub.cygwin1.dll_fclose
mov eax, 0x408028
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401d9e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.cygwin1.dll_fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.cygwin1.dll_fseek
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0xd]
mov dword [esp], eax
call sub.cygwin1.dll_fread
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0xe]
mov dword [esp], eax
call sub.cygwin1.dll_fread
mov ecx, eax
movzx eax, byte [ebp - 0xd]
cmp al, byte [ebp - 0xe]
jne 0x401e4c
test ebx, ebx
setne al
test ecx, ecx
setne dl
movzx eax, al
test edx, eax
jne 0x401de5
mov eax, 0
cmp ebx, ecx
jne 0x401e58
jmp 0x401e53
mov eax, 0
jmp 0x401e58
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403533
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x403027
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403047
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x403056
mov ebx, 0x40fec0
mov eax, dword [ebp + 8]
test eax, eax
jl 0x40306b
mov ecx, dword [0x429278]
add ecx, eax
push ecx
call fcn.00403222
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.0040320c
test eax, eax
je 0x4031c3
test byte [ebp + 0x17], 0x80
je 0x4031ac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40be30
mov dword [ebp - 0xc], eax
call fcn.00406514
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403202
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4030bb
mov esi, dword [ebp + 0x14]
mov edi, 0x40bec0
push esi
push edi
call fcn.0040320c
test eax, eax
je 0x4031c3
sub dword [ebp + 0x14], esi
mov dword [0x40be48], edi
mov dword [0x40be4c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40be30
mov dword [0x40be50], ebx
mov dword [0x40be54], eax
call fcn.00406534
test eax, eax
mov dword [ebp - 0x10], eax
jl 0x4031a4
mov esi, dword [0x40be50]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4292d4], 1
mov edi, eax
je 0x403163
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x40312a
cmp dword [ebp + 0x14], 0
jne 0x403163
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x90]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
push 0
call fcn.0040517e
mov dword [ebp - 0xc], edi
test esi, esi
je 0x403198
cmp dword [ebp + 0x10], 0
jne 0x403180
push esi
push ebx
push dword [ebp + 0xc]
call fcn.00405ca6
test eax, eax
je 0x4031a8
add dword [ebp - 4], esi
jmp 0x40318c
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40be50]
cmp dword [ebp - 0x10], 1
jne 0x4030de
jmp 0x403202
cmp dword [ebp + 0x14], 0
jg 0x4030ae
jmp 0x403202
push 0xfffffffffffffffc
jmp 0x4031c5
push 0xfffffffffffffffe
jmp 0x4031c5
test edi, edi
je 0x4031f7
cmp dword [ebp + 0x14], esi
jge 0x4031b8
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040320c
test eax, eax
jne 0x4031ff
push 0xfffffffffffffffd
pop eax
jmp 0x403205
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x4031d3
mov esi, dword [ebp + 0x14]
mov edi, 0x40bec0
push esi
push edi
call fcn.0040320c
test eax, eax
je 0x4031c3
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405ca6
test eax, eax
je 0x4031a8
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x4031c8
jmp 0x403202
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1006d71
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x1001538
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x101031c], eax
test eax, eax
jne 0x1006d92
xor eax, eax
jmp 0x1006dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1006db4
push dword [0x101031c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x101031c], 0
jmp 0x1006d8e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.PlaySndSrv.DLL_PlaySoundServerInitialize
test eax, eax
jl 0x1006d9f
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10079a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10079fe
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10079f0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x10079ec
cmp esi, eax
jae 0x10079f0
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10079de
cmp esi, eax
jb 0x10079f4
xor eax, eax
jmp 0x10079fd
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x1008071
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
call fcn.01006cd0
test eax, eax
je 0x10080f1
mov eax, dword [edi + 0xa8]
dec eax
push esi
push 0
pop esi
je 0x10080d1
dec eax
je 0x10080ba
dec eax
je 0x10080b0
dec eax
je 0x10080a6
dec eax
jne 0x10080db
push 5
push esi
push 0x1001b98
jmp 0x10080c2
push 5
push esi
push 0x1001ac8
jmp 0x10080c2
push 5
push esi
push 0x10019f0
jmp 0x10080c2
push 5
push esi
push 0x1001918
push 0x1001904
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10080de
push 5
push esi
push 0x1001830
jmp 0x10080c2
mov eax, dword [ebp - 4]
cmp eax, 0x20
jg 0x10080f0
push esi
push 0xc8
mov ecx, edi
call fcn.01007fc1
pop esi
pop edi
leave
ret

Function at 0x1008384
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, eax
test edi, edi
je 0x1008402
lea eax, [ebp - 0x210]
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x10083fb
lea eax, [ebp - 0x20c]
push eax
push 0x100832a
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
test eax, eax
je 0x10083f4
xor esi, esi
jmp 0x10083fb
call fcn.010081c4
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01009ae9
leave
ret
Function at 0x1008787
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c8
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
push 0xffffffffffffffff
push 0x1001e44
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x7b4], eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x1008831
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x1001e14
mov ebx, 0x1001cb8
push ebx
mov edi, 0x80000001
push edi
call fcn.0100d05d
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1001de4
push ebx
push edi
call fcn.0100d05d
push 0x71
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x7b4]
call dword [sym.imp.UxTheme.dll_Ordinal_65]
push 0
push 0x2a
push 0x1a
push 0xffff
mov edi, eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
jmp 0x1008991
call dword [sym.imp.UxTheme.dll_IsThemeActive]
xor esi, esi
test eax, eax
je 0x1008846
push esi
push esi
push esi
call dword [sym.imp.UxTheme.dll_Ordinal_4]
lea eax, [ebp - 0x7bc]
push eax
push 0x20019
push esi
push 0x1001d70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jle 0x1008871
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, esi
jl 0x1008991
push 3
mov dword [ebp - 0x7b8], esi
mov esi, 0x104
pop ebx
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x7c0]
push eax
push 0
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x7b8]
mov dword [ebp - 0x7c0], ebx
push dword [ebp - 0x7bc]
mov dword [ebp - 0x7c4], 0x2d0
mov dword [ebp - 0x7c8], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jle 0x10088e4
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x100893d
cmp dword [ebp - 0x7c0], ebx
jne 0x100893d
cmp word [ebp - 0x4dc], 2
jne 0x100893d
mov eax, dword [ebp - 0x7b4]
cmp word [eax], 0x40
je 0x100891b
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
mov edi, eax
test edi, edi
jl 0x100893d
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x7b4]
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x100894d
inc dword [ebp - 0x7b8]
test edi, edi
jge 0x1008889
jmp 0x100897a
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.01008417
lea eax, [ebp - 0x7b0]
push eax
call fcn.01008616
lea eax, [ebp - 0x7b0]
push eax
call fcn.01008639
mov edi, eax
push dword [ebp - 0x7bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jl 0x1008991
call fcn.01008384
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01009ae9
leave
ret 4