joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d35
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ab20]
jne 0x418d3f
repz ret
jmp fcn.0041ca8c

Function at 0x41e310
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041c487
and dword [ebp - 0x14], 0
cmp dword [0x42c558], 0
mov dword [ebp - 0x18], eax
jne 0x41e3c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41e46b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x424724
push ebx
call edi
test eax, eax
je 0x41e46b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c560], eax
call edi
push eax
call esi
mov dword [0x42c568], eax
test eax, eax
je 0x41e3c3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c564], eax
mov eax, dword [0x42c564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41e41c
cmp dword [0x42c568], ecx
je 0x41e41c
push eax
call esi
push dword [0x42c568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41e41c
test ebx, ebx
je 0x41e41c
call edi
test eax, eax
je 0x41e413
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41e413
test byte [ebp - 8], 1
jne 0x41e41c
or dword [ebp + 0x10], 0x200000
jmp 0x41e44f
mov eax, dword [0x42c55c]
cmp eax, dword [ebp - 0x18]
je 0x41e44f
push eax
call esi
test eax, eax
je 0x41e44f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41e44f
mov eax, dword [0x42c560]
cmp eax, dword [ebp - 0x18]
je 0x41e44f
push eax
call esi
test eax, eax
je 0x41e44f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c558]
call esi
test eax, eax
je 0x41e46b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41e46d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418d35
leave
ret

Function at 0x480428
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x480447
cmp eax, dword [esp + 0x28]
je 0x48045e
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48043e
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x445260
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4452f2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4452e4
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4452dc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4452a5
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x445300
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x44536a
push esi
lea edi, [eax + 0x400]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x44533a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x445386
push ecx
push esi
call fcn.00447830
add esp, 8
mov ebx, eax
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4453e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4453fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4453f3
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..data
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x34212154
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4c7a660e
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40ef98
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f035
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f035
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f035
push 4
push 0xffffffffffffffff
push esi
push 0x40f74f
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f035
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f000
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f035
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f03b
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f037

Function at 0x41143a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x411449
pop dword [ebp - 0x30]
mov eax, 0x71dbc9fe
sub eax, 0x719ab5b5
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x45a42
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xcec310d1
add ecx, 0x313d428a
mov esi, eax
mov edx, 0x449800
add edx, dword [ebp - 0x30]
mov edi, 0x61f71df8
sub dword [ebp - 8], 0x4ef7403f
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x2a22b421
xor ebx, edi
sub dword [ebp - 0x14], 0xb57940d5
mov dword [esi], ebx
add dword [ebp - 4], 0x7b0036ff
add esi, 0xcca25fa1
sub esi, 0xcca25f9d
add edx, 0xbd4353fc
sub edx, 0xbd4353f8
loop 0x411497
add eax, 0x81f369d4
sub eax, 0x81f22995
xor ebx, ebx
add ebx, eax
add eax, 0x4bd08b7f
add eax, 0xb42f7486
mov ecx, 0x9776796f
add ecx, 0x68c98691
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x413985
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413995
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x41399b
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x4139c3
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x4139aa
mov esi, ecx
jmp 0x4139c6
movzx esi, si
pop edi
cmp cx, si
je 0x4139e3
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x4139c7
mov eax, 0x437348
jmp 0x4139eb
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10014e50
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10014e50
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10014e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10014e5f
pop dword [ebp - 0x24]
mov eax, 0x10014e5f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5960ecf8
add dword [ebp - 0x34], 0xf4f15853
mov dword [ebp - 0x30], 0xa3362a89
sub dword [ebp - 0x30], 0x7102de44
mov dword [ebp - 0x2c], 0x273e5823
sub dword [ebp - 0x2c], 0xdaf213f5
mov dword [ebp - 0x28], 0xd29910e2
sub dword [ebp - 0x28], 0xd29910e2
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2ad132c2
add eax, 0xe5313eca
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2d09cefb
add dword [ebp - 0x34], 0x47689a5b
mov dword [ebp - 0x30], 0xb5533140
add dword [ebp - 0x30], 0x8c193035
mov dword [ebp - 0x2c], 0x3375ae34
sub dword [ebp - 0x2c], 0xd00641c8
mov dword [ebp - 0x28], 0xcc3f64c3
sub dword [ebp - 0x28], 0xcc3f64c3
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x4d83be9
add eax, 0xb2a3597
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3eb49
push 0
call eax
mov ecx, 0x4097
mov esi, eax
mov edx, 0x10039800
add edx, dword [ebp - 0x24]
mov edi, 0xe897d43
add edi, 0x53bae161
mov dword [ebp - 0x14], 0x2254d14e
mov ebx, dword [edx]
xor ebx, edi
add dword [ebp - 0x18], 0xdfc287ea
mov dword [esi], ebx
mov dword [ebp - 8], 0x64ecee1a
add esi, 4
add edx, 0x5a4ddf81
add edx, 0xa5b22083
loop 0x10014f70
add eax, 0x441da2f2
sub eax, 0x441cadc3
mov ebx, eax
add eax, 0x4e9e5aaf
add eax, 0xb161a556
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1001cacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10025ac4
call fcn.100233e2
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
mov eax, edi
call fcn.10014e50
pop ecx
test eax, eax
jne 0x1001cba6
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
inc dword [eax + 0x38]
mov dword [ebp - 0x58], edi
inc dword [edi + 0x14]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x54], eax
xor eax, eax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x3c], ax
push 4
add edi, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], edi
pop edi
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x52535048
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], ebx
call fcn.10014e50
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 8
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x20], 0x55524544
call fcn.10014e50
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1001bc6e
mov eax, esi
call fcn.10023465
ret
Function at 0x1001e1a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10025ae9
call fcn.100233ac
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
call edi
test eax, eax
jne 0x1001e2e2
cmp dword [ebp - 0x1c], 1
jne 0x1001e2e2
mov eax, dword [ebp - 0x14]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10014e50
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001e2d4
push dword [ebp - 0x14]
push esi
push eax
call fcn.10014e50
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10014e50
pop ecx
mov dword [ebx], eax
cmp eax, esi
je 0x1001e2d4
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push esi
push eax
call fcn.10014e50
lea eax, [ebp - 0x20]
push eax
push 0x1002ac24
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, esi
je 0x1001e2ba
push edi
call fcn.10014e50
pop ecx
test al, al
je 0x1001e2ba
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [ebx]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e2d4
push dword [ebx]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], esi
jmp 0x1001e2d4
cmp dword [ebp - 0x18], esi
je 0x1001e2e2
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023451
ret
Function at 0x1001e2e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x10025b04
call fcn.10023418
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push 0x80000002
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e531
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x1001e402
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x1001e3e2
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x1001e3e2
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e3e4
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x1001e39a
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x1001e531
mov ebx, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call ebx
mov edi, str.SoftwareMicrosoftSoftGrid_
push edi
mov dword [ebp - 0x430], eax
call ebx
mov ecx, dword [ebp - 0x430]
lea ebx, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10014e50
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1001e531
push ebx
push esi
push eax
call fcn.10014e50
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call edi
push str.ClientUserInterface
push ebx
push dword [ebp - 0x428]
call edi
add esp, 0x30
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e525
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x43c]
push 0x1002ac28
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023474
ret
Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89

Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret