joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0d0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4d0dae
cmp dword [ebx + 0x94], 0
jne 0x4d0da8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4d0c58
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4d0da8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4d0d6e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4d0da8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0043b03c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4d0d7d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4d0fcc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x56c2c0]
cmp dword [eax + 0x170], 0
je 0x4d1131
test bl, bl
jne 0x4d107f
cmp dword [esi + 0x9c], 0
jne 0x4d1074
mov eax, esi
call fcn.004d3ebc
push eax
push 0x4d0ed8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4d1045
mov eax, dword [0x56c2c0]
cmp byte [eax + 0xd3], 0
je 0x4d1045
mov eax, dword [esi + 0xd8]
call fcn.00408884
mov edi, eax
cmp edi, 0
jl 0x4d1045
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4d102e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4d1074
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043b03c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4d1054
inc dword [esi + 0x9c]
jmp 0x4d1131
cmp dword [esi + 0x9c], 0
jle 0x4d1131
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4d1131
cmp dword [esi + 0x44], 0
je 0x4d10dc
mov eax, dword [0x56c2c0]
cmp byte [eax + 0xd3], 0
je 0x4d10dc
mov eax, dword [esi + 0xd8]
call fcn.00408884
mov edi, eax
cmp edi, 0
jl 0x4d10dc
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4d10c5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4d110b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043b03c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4d10eb
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4c4254]
call fcn.00408a44
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4d1d80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4d1deb
cmp byte [ebx + 0xd3], 0
jne 0x4d1deb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004071ac
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4d1dd8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4d1df8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407070
jmp 0x4d1df8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407070
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4d3620
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4d368e
mov eax, esi
call fcn.004aba1c
test al, al
je 0x4d368e
mov eax, dword [ebx + 0x84]
call fcn.004ab670
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4d368e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4d3682
push 0
mov eax, dword [ebx + 0x84]
call fcn.004ab670
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004a25c0
jmp 0x4d368e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004d3458
pop esi
pop ebx
ret

Function at 0x4f52e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebx, eax
test ebx, ebx
je 0x4f53f2
mov ebp, ebx
mov eax, ebp
test eax, eax
je 0x4f5309
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test ebx, ebx
je 0x4f5319
mov eax, ebp
sub eax, 0xa
movzx eax, word [eax]
jmp 0x4f531d
mov ax, 2
cmp ax, 1
jne 0x4f5396
test ebx, ebx
je 0x4f5331
mov eax, ebp
sub eax, 0xc
movzx eax, word [eax]
jmp 0x4f5339
mov eax, dword [0x566c18]
movzx eax, word [eax]
push 0
push 0
push edi
push ebx
push 0
movzx eax, ax
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x100
jle 0x4f5361
mov eax, edi
add eax, eax
call fcn.004044f0
mov esi, eax
jmp 0x4f5363
mov esi, esp
test ebx, ebx
je 0x4f5371
mov eax, ebp
sub eax, 0xc
movzx edx, word [eax]
jmp 0x4f537a
mov edx, dword [0x566c18]
movzx edx, word [edx]
mov eax, ebp
test eax, eax
je 0x4f5385
sub eax, 4
mov eax, dword [eax]
push edi
push esi
push eax
push ebx
push 0
movzx eax, dx
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x4f53ba
cmp edi, 0x100
jle 0x4f53ab
mov eax, edi
add eax, eax
call fcn.004044f0
mov esi, eax
jmp 0x4f53ad
mov esi, esp
mov ecx, edi
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004046a8
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4f53e3
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4f53cd
mov eax, esp
cmp esi, eax
je 0x4f53f4
mov eax, esi
call fcn.0040450c
jmp 0x4f53f4
xor ebx, ebx
mov eax, ebx
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50a794
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x50a7b9
cmp dword [esp + 4], 5
jb 0x50a7b9
mov al, 1
jmp 0x50a7bb
xor eax, eax
add esp, 0x114
ret

Function at 0x52ba68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407058
mov eax, dword [ebp - 8]
call fcn.00407058
xor eax, eax
push ebp
push 0x52bb3c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00413754
cmp dword [ebp - 0x10], 0
je 0x52bb19
mov eax, dword [ebp - 4]
call fcn.004146c0
test al, al
je 0x52bad4
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0052b994
mov eax, dword [ebp - 4]
call fcn.004070fc
push eax
call sub.kernel32.dll_DeleteFileW
cmp byte [ebp - 9], 0
je 0x52baf5
call fcn.0041fabc
push eax
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43399c]
call fcn.0043fa00
mov ebx, eax
jmp 0x52bb06
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43399c]
call fcn.0043f9bc
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043f6a0
mov eax, ebx
call fcn.004050c4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bb43
lea eax, [ebp - 0x10]
call fcn.00407060
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407068
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10019d8c
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10019d8c
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10019d8c
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10019d8c
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10019d8c
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10019d8c
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10019d8c
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10019d8c
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10019d8c
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10019d8c
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10019d8c
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.10019d8c
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.10019d8c
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10019d8c
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019d8c
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.10019d8c
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.10019d8c
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10019d8c
push eax
lea ecx, [ebx + 0x10]
call fcn.10019d8c
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.10019d8c
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10019d8c
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.10019d8c
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10019d8c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10019d8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10019d9b
pop dword [ebp - 0x34]
mov eax, 0x418f0471
add eax, 0xce72992a
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3ed92
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x17dcab74
add ecx, 0xe82393c1
mov edx, eax
mov esi, 0xe7f6b620
sub esi, 0xd7f1fa20
add esi, dword [ebp - 0x34]
mov ebx, 0x6a449b12
xor dword [ebp - 0x1c], ecx
mov edi, dword [esi]
mov dword [ebp - 0x18], 0xf3d67e2e
xor edi, ebx
sub dword [ebp - 0x1c], 0xfc059c18
mov dword [edx], edi
sub dword [ebp - 0x14], 0x76e6c19e
add edx, 0xa0a294eb
add edx, 0x5f5d6b19
add esi, 4
loop 0x10019def
add eax, 0xb534c274
add eax, 0x4acc2d33
xor ebx, ebx
add ebx, eax
add eax, 0xe45e38c2
add eax, 0x1ba1c743
mov ecx, 0x9dd6b40
add ecx, 0x62294c0
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1ac52f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1ac52fa
pushal
call 0x1ac5300
pop ebp
sub ebp, 0x10
sub ebp, 0x16c52f0
jmp 0x1ac5316
mov eax, 0x16c52f0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0x3ce72be6
xor byte [eax], dl
inc eax
dec ecx
jne 0x1ac532d
jmp 0x1ac5340
insd dword es:[edi], dx
sub ebp, dword [ebp + 0x6f]
invalid
Function at 0x1000222c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1000fd72
call fcn.1000f098
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [0x10016a2c]
xor edi, edi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x424], edi
push 2
push edi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x14], ebx
jne 0x10002284
call fcn.100018a2
mov esi, eax
jmp 0x10002334
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x10002307
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
mov dword [ebp + 0xc], eax
je 0x10002307
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + ebx + 2]
push eax
lea esi, [ebp - 0x424]
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 2
call fcn.1000236d
jmp 0x100022d4
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], edi
jne 0x100022ea
mov esi, 0x8007000e
jmp 0x1000232b
call dword [0x10016a2c]
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000230e
call fcn.100018a2
jmp 0x10002329
mov eax, dword [ebp - 0x424]
push dword [ebp + 0x18]
mov word [eax + ebx*2], di
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x1c]
call fcn.100023ae
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x1000234d
lea eax, [ebp - 0x424]
call fcn.10003155
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x100030fd
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10003105
mov eax, dword [esp + 0xc]
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x10003137
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc

Function at 0x10003238
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.100016ac
mov edi, eax
cmp edi, esi
je 0x10003275
cmp dword [ebp - 4], esi
je 0x10003271
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x100032e2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10003293
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 4]
call fcn.10003238
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x100032e9
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], pe_nt_image_headers32
call edi
test eax, eax
je 0x1000327d
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100032c9
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x100032e0
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 4], esi
je 0x100032f7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x100032e2