joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414805
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41484a
call fcn.004059cb
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41484a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x414866
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004288e9
mov ebx, eax
test edi, edi
je 0x414864
test esi, esi
je 0x414864
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4159da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x415a98
cmp dword [esi + 0x20], 0
je 0x415a98
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415a98
cmp dword [ebp + 8], 0
je 0x415a98
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004059cb
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x415a69
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x415a98
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042b249
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x415a89
test edi, edi
je 0x415a89
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x415a94
mov ecx, esi
call fcn.0041567b
mov eax, ebx
jmp 0x415a9a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41dd76
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x41ddbc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41ddcb
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41ddcb
push dword [esi]
mov ecx, edi
push 2
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005cf801
call edi
jmp 0x41ddcd
cmp dword [esi + 4], ebx
je 0x41ddcb
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42c7f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x42c81d
cmp dword [ebx + 0x80], 0
jne 0x42c81d
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004059cb
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0042caab
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42c857
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004059cb
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42c88e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0042c8af
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42f257
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x42f271
mov edi, dword [esi + 0xc]
jmp 0x42f2b1
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42f28a
call fcn.004218ba
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x42f29f
call fcn.004218ba
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x42f2b1
call fcn.004218ba
call fcn.004059cb
cmp dword [eax + 0x3c], 0
je 0x42f2c6
push edi
mov ecx, ebx
call fcn.0042e88b
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0042f599
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42f2ef
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42f2fb
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432def
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x432e2f
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x432e3e
push str.SetFileAttributesTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x432e3e
push dword [esi]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005cf801
call edi
jmp 0x432e40
cmp dword [esi + 4], 0
je 0x432e3e
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x46c053
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x46c06c
call fcn.004059cb
mov esi, dword [eax + 0xc]
push 0x64e234
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x46c0c2
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46c0c1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x46c0a2
xor esi, esi
jmp 0x46c0b8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0046c0ca
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5b3ab3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x5b3ac4
xor eax, eax
jmp 0x5b3b41
cmp dword [ebp + 0xc], 0
je 0x5b3ac0
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x5b3add
call fcn.004059cb
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5b3ac0
push esi
push dword [ebp + 0xc]
mov dword [edi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5b3b05
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x5b3b09
xor eax, eax
jmp 0x5b3b40
push ebx
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5b3b3f
push dword [ebp - 4]
mov esi, dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esi + 4]
push eax
call fcn.005cf801
mov ecx, edi
call dword [esi + 4]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5c69be
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005d3450
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x617651
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00617256

Function at 0x61765c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006173d7

Function at 0x619d6d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00619547
Function at 0x619d78
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00619782

Function at 0x61aa41
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061a7c8
Function at 0x100d39a0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d17ca

Function at 0x100d39c0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d1c18

Function at 0x100d39e0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d206f

Function at 0x100d3a00
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d24cf

Function at 0x100d3a20
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d2919

Function at 0x100d3a40
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d2d6f

Function at 0x100d3a60
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d31ce

Function at 0x100d88ae
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x1000fd64
push esi
call sym.ucrtbase.dll_wcspbrk
pop ecx
pop ecx
test eax, eax
jne 0x100d88dd
xor al, al
jmp 0x100d8944
lea eax, [ebp - 0x214]
xor ebx, ebx
push eax
push ecx
mov edx, esi
mov dword [ebp - 0x214], ebx
lea ecx, [ebp - 0x210]
call fcn.100d8275
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x100d8936
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100d8907
sub ecx, edi
sar ecx, 1
cmp ecx, 3
je 0x100d8926
mov ecx, edx
call fcn.100d87f4
test al, al
je 0x100d8936
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
xor ebx, ebx
inc ebx
cmp eax, ebx
ja 0x100d8936
xor ebx, ebx
push dword [ebp - 0x214]
call sym.ucrtbase.dll_free
pop ecx
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
Function at 0x100f79f0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1010e2b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
call fcn.1005d1a0
mov eax, esp
lea ecx, [ebp - 0x30]
push 0x1c
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualQuery]
test eax, eax
je 0x100f7aaa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x50]
lea ecx, [ebp - 8]
xor esi, esi
mov dword [ebp - 8], esi
call fcn.1009e376
test eax, eax
je 0x100f7a53
cmp dword [ebp - 8], esi
jbe 0x100f7a53
mov esi, dword [ebp - 8]
dec esi
lea eax, [ebx - 1]
add esi, ebx
not eax
and esi, eax
je 0x100f7a61
add esi, ebx
lea eax, [ebx + ebx]
cmp esi, eax
jae 0x100f7a6a
mov esi, eax
mov eax, dword [ebp - 0x10]
lea edi, [ebx - 1]
not edi
add eax, ebx
and edi, dword [ebp - 0xc]
sub edi, esi
cmp edi, eax
jb 0x100f7aaa
push 4
push 0x1000
push esi
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
test eax, eax
je 0x100f7aaa
lea eax, [ebp - 0x14]
push eax
push 0x104
push esi
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
test eax, eax
je 0x100f7aaa
xor eax, eax
inc eax
jmp 0x100f7aac
xor eax, eax
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret

Function at 0x100f8233
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, ecx
test esi, esi
jns 0x100f824d
mov edx, esi
call fcn.100f7f23
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.100f8270
pop ecx
test esi, esi
jle 0x100f826b
mov ecx, edi
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.100f7f23
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xe2c818
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe2c822
pushal
call 0xe2c828
pop ebp
sub ebp, 0x10
sub ebp, 0xa2c818
jmp 0xe2c83e
mov eax, 0xa2c818
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0x18937836
xor byte [eax], dl
inc eax
dec ecx
jne 0xe2c855
jmp 0xe2c868
mov ebp, 0xabfbdfb
mov bh, 0xf7
into
xor eax, 0x36308efb
mov word ss:[esi], ds
rcl esp, 0x35
invalid
Function at 0x10019c3
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
jne 0x10019f1
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001a46
lea eax, [ebp - 0x10]
push eax
push 0x1001274
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001a30
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001a46
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001a50
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003ebe
xor eax, eax
jmp 0x1001a53
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x1001a5b
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [0x100b2e0], 0
je 0x1001aa0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001aa0
push 0x100b2e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x1001e53
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b2d0]
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1001ecc
push 0x10012a4
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010066cf
lea eax, [ebp - 0x108]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x40
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001ecc
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.010064de
leave
ret

Function at 0x1001edf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f2a
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001f21
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x10022ac
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100b2d0]
and dword [ebp - 0x10c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov byte [esi], 0
cmp byte [edi], 0x23
mov dword [ebp - 4], eax
jne 0x10023dc
inc edi
movsx eax, byte [edi]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push edi
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call edi
push eax
call edi
cmp bl, 0x53
mov edi, eax
je 0x10023dc
cmp bl, 0x57
je 0x10023d0
push 0x10012b4
lea eax, [ebp - 0x108]
mov ebx, 0x104
push eax
mov dword [ebp - 0x118], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.010066cf
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10023ef
lea eax, [ebp - 0x118]
push eax
push esi
lea eax, [ebp - 0x114]
push eax
push 0
push 0x1001271
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10023c2
cmp dword [ebp - 0x114], 2
jne 0x10023af
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10023af
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push esi
call fcn.010021c4
jmp 0x10023b8
cmp dword [ebp - 0x114], 1
jne 0x10023c2
mov dword [ebp - 0x10c], 1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023e6
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10023ef
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x10c], 0
jne 0x10023f9
push edi
push dword [ebp + 0xc]
push esi
call fcn.010066cf
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.010064de
leave
ret 0xc

Function at 0x1002e55
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0xa
push dword [ebp + 8]
xor edi, edi
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
ja 0x1002ec0
cmp dword [ebp + 0xc], edi
je 0x1002ec0
cmp ebx, edi
je 0x1002ea0
push 0xa
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
jne 0x1002ea4
xor eax, eax
jmp 0x1002ec2
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003346
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b2d0]
push ebx
push esi
mov esi, dword [0x100bc40]
test esi, esi
mov dword [ebp - 4], eax
mov ebx, esi
je 0x10033a6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100c884], 0
jne 0x1003395
cmp dword [0x100c490], 0
jne 0x1003395
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebx]
mov esi, dword [esi + 4]
call edi
push ebx
call edi
test esi, esi
mov ebx, esi
jne 0x100336e
pop edi
xor eax, eax
cmp dword [0x100c880], eax
pop esi
pop ebx
je 0x1003400
cmp dword [0x100c884], eax
jne 0x1003400
cmp dword [0x100c490], eax
jne 0x1003400
push 0x100bc44
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100c494], 0x20
je 0x10033e9
lea eax, [ebp - 0x108]
push eax
call fcn.01006666
push 0x1001344
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
call fcn.01002a96
cmp word [0x100ba64], 1
je 0x1003418
cmp dword [0x100c880], 0
je 0x1003418
call fcn.01001a5b
mov ecx, dword [ebp - 4]
and dword [0x100c880], 0
call fcn.010064de
leave
ret

Function at 0x100435e
Capabilities:
Inspect section memory permissions

Disassembly:
inc eax
add al, 0xeb
test eax, 0xeb0c5d89
push es
Function at 0x10043ec
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1004385
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10043a3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1004401
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10043e8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10043f1
invalid
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10043fb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10043dd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1004367
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100444e
dec eax
je 0x1004445
sub eax, 3
je 0x100443c
mov dword [ebp - 4], 0x40
jmp 0x100446b
mov dword [ebp - 4], 4
jmp 0x1004451
mov dword [ebp - 4], 0x20
jmp 0x1004451
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100449d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100441d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.01003cae
push cs
sbb bl, byte [edx + 0x1475ff54]
push 1
push esi
call edi
mov eax, esi
jmp 0x10044a9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret