joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048c5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100490e
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003828
call fcn.01003610
mov dword [0x100d0c4], eax
xor eax, eax
jmp 0x100491e
push 2
push 2
lea eax, [ebp - 0x108]
push eax
call fcn.0100411a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01006b81
leave
ret

Function at 0x100492f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
push edi
push 0x10013c0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
push 0x14
push eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], edi
call fcn.01001ffa
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
add esp, 0x10
push 0xa
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
cmp eax, edi
je 0x1004a0c
push esi
jmp 0x1004985
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x10049f2
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 4]
lea edi, [esi + 8]
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call dword [ebp - 0x28]
test eax, eax
push esi
je 0x1004a01
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 0x20]
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push 0x10013c0
push 0x14
push eax
call fcn.01001ffa
add esp, 0x10
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0
call ebx
test eax, eax
jne 0x1004983
jmp 0x1004a0b
mov dword [0x100d0c4], 0x80070714
mov dword [ebp - 0x1c], edi
jmp 0x1004a0b
and dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
pop edi
xor ecx, ebp
pop ebx
call fcn.01006b81
leave
ret 4

Function at 0x1004b0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp loc.01052ee0
Function at 0x100502e
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
xor eax, eax
cmp ebx, esi
mov dword [ebp - 0x208], 1
je 0x100515a
push edi
lea edi, [ebp - 0x21c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
push ecx
push esi
push esi
push 0x20
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100510c
push 0xffffffffffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100dee8], esi
mov ecx, dword [ebp - 0x20c]
jne 0x10050db
mov al, byte [0x100daec]
test al, 1
je 0x10050db
test al, 2
jne 0x10050db
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x10050db
mov dword [0x100daec], ecx
push ecx
call fcn.0100302b
push dword [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x21c]
call edi
test word [0x100daf4], 0x400
je 0x1005153
cmp dword [ebp - 0x20c], esi
jge 0x1005153
jmp 0x100514d
call fcn.01003610
push esi
mov dword [0x100d0c4], eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x4c4
push esi
call fcn.01003828
mov dword [ebp - 0x208], esi
mov eax, dword [ebp - 0x208]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b81
leave
ret 8
Function at 0x1005201
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x100531f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x100530c
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x100530c
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x100530c
cmp byte [0x100d0e0], bl
mov esi, 0x100d0e0
jne 0x10052a7
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x10052a7
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x10052a7
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1003086
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10052fa
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100d0e0], bl
je 0x10052f4
push esi
push dword [ebp + 0x14]
push edi
call fcn.01001f7e
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1005333
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1005329
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003828
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100533f
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
jmp loc.01051e78
Function at 0x10056f2
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
je 0x100579f
mov edi, 0x104
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.01003f7a
test eax, eax
je 0x1005808
lea eax, [ebp - 0x108]
push eax
push edi
mov esi, 0x100d2a4
push esi
call fcn.01001f7e
test byte [0x100daf4], 0x20
je 0x1005791
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x12c]
sub eax, ebx
je 0x1005785
dec eax
je 0x100577e
dec eax
je 0x1005777
dec eax
jne 0x1005791
push 0x10014c0
jmp 0x100578a
push 0x10014b8
jmp 0x100578a
push 0x10014b0
jmp 0x100578a
push 0x10014a8
push edi
push esi
call fcn.0100745c
push 0x10012e1
push edi
push esi
call fcn.0100745c
jmp 0x10057b0
push eax
push 0x104
mov esi, 0x100d2a4
push esi
call fcn.01001f7e
push esi
call fcn.0100406d
xor edi, edi
inc edi
test eax, eax
jne 0x10057cf
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10057e7
mov dword [0x100dee0], edi
push ebx
push dword [ebp + 0x10]
push esi
call fcn.0100411a
test eax, eax
je 0x10057f3
mov dword [0x100d0c4], ebx
mov eax, edi
jmp 0x100580a
call fcn.01003610
mov dword [0x100d0c4], eax
jmp 0x1005808
cmp dword [0x100dee0], ebx
je 0x1005808
push esi
mov dword [0x100dee0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b81
leave
ret 0xc
Function at 0x1005820
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x8fc
push ebx
push 0x100d200
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ebx
mov dword [0x100db04], edi
call sub.msvcrt.dll_memset
push 0x32c
push ebx
push 0x100dee0
call sub.msvcrt.dll_memset
push 0x104
push ebx
push 0x100d0e0
call sub.msvcrt.dll_memset
add esp, 0x24
push 0x7f
mov esi, 0x100d214
push esi
push 0x10014ec
mov dword [0x100d4ac], 1
call fcn.01003181
cmp eax, ebx
je 0x1005a7c
cmp eax, 0x80
ja 0x1005a7c
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100cd6c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100daf4
push 0x10014e0
call fcn.01003181
test eax, eax
jne 0x1005900
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003828
mov dword [0x100d0c4], 0x80070714
jmp 0x1005a8c
test byte [0x100daf4], 0xc0
je 0x1005999
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x10014d0
call fcn.01003181
test eax, eax
je 0x10058e1
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100cd70], eax
je 0x1005999
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1005999
test byte [0x100daf4], 0x80
je 0x1005968
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003828
jmp 0x100597e
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003828
cmp eax, 6
je 0x1005999
push dword [0x100cd70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100d0c4], 0x800700b7
jmp 0x1005a8c
push dword [ebp - 0x110]
mov dword [0x100d0c8], ebx
call fcn.01004363
test eax, eax
jne 0x10059bd
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1005a86
cmp byte [0x100defa], bl
je 0x10059d4
push 0x100defa
call fcn.01002475
jmp 0x1005a8c
push 0xa
push 0x10014c4
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10059f4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10c], eax
cmp dword [0x100c2bc], ebx
je 0x1005a02
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100dee4], ebx
je 0x1005a0f
xor eax, eax
inc eax
jmp 0x1005a8e
push dword [ebp - 0x10c]
call fcn.01004c03
test eax, eax
je 0x1005a8c
mov ax, word [0x100d0cc]
cmp ax, 1
je 0x1005a36
cmp ax, 2
je 0x1005a36
cmp ax, 3
jne 0x1005a0a
test word [0x100daf4], 0x100
je 0x1005a0a
test byte [0x100def8], 1
jne 0x1005a0a
call fcn.01001958
test eax, eax
jne 0x1005a0a
push 0x83e
push 0x547
push 0x1001a99
push ebx
push 0x7d6
push dword [0x100db04]
call fcn.01004b90
cmp eax, 0x83d
jne 0x1005a8c
jmp 0x1005a0a
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003828
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b81
leave
ret 0xc
Function at 0x100667f
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp word [0x100def8], di
jne 0x10066ca
cmp dword [0x100dee4], edi
jne 0x10066c1
call fcn.01003db9
test eax, eax
jne 0x10066b8
xor eax, eax
jmp 0x10067e2
cmp word [0x100def8], di
jne 0x10066ca
call fcn.01004f42
test eax, eax
je 0x10066b1
call fcn.01005664
test eax, eax
je 0x10066b1
call fcn.01006394
test eax, eax
je 0x10066b1
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10012d4
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.0100745c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100d2a4
je 0x100672f
push 0x1001548
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x100672f
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100dee4], edi
jne 0x100674f
cmp dword [0x100daf0], edi
jne 0x100674f
call fcn.010048c5
test eax, eax
je 0x10067c3
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006776
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003828
call fcn.01003610
mov dword [0x100d0c4], eax
jmp 0x10067c3
cmp dword [0x100deec], edi
jne 0x1006787
call fcn.01005e72
test eax, eax
je 0x10067c3
test byte [0x100e208], 0xc0
jne 0x10067a4
movzx eax, word [0x100d0cc]
push eax
call fcn.01001e38
mov dword [0x100d1e4], eax
jmp 0x10067aa
mov dword [0x100d1e4], edi
cmp dword [0x100dee4], edi
jne 0x10067c7
cmp dword [0x100daf0], edi
jne 0x10067c7
call fcn.01005ef6
test eax, eax
jne 0x10067c7
xor eax, eax
jmp 0x10067e0
cmp word [0x100def8], di
jne 0x10067dd
cmp dword [0x100dee4], edi
jne 0x10067dd
call fcn.0100516f
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01006b81
leave
ret
Function at 0x1006b72
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x100aaf0
call fcn.01006fc4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x100e254
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1006920
cmp eax, esi
jne 0x1006913
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1006923
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10068fa
xor esi, esi
inc esi
mov eax, dword [0x100e250]
cmp eax, esi
jne 0x1006936
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006965
mov eax, dword [0x100e250]
test eax, eax
jne 0x100695f
mov dword [0x100e250], esi
push 0x1001294
push 0x100128c
call fcn.0100685f
pop ecx
pop ecx
test eax, eax
je 0x1006965
jmp 0x1006a8d
mov dword [0x100cd94], esi
mov eax, dword [0x100e250]
cmp eax, esi
jne 0x1006989
push 0x1001288
push 0x1001280
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100e250], 2
test ebx, ebx
jne 0x1006995
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100e25c], 0
je 0x10069b9
push 0x100e25c
call fcn.01006f3b
pop ecx
test eax, eax
je 0x10069b9
push 0
push 2
push 0
call dword [0x100e25c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1006a15
test al, al
je 0x10069d3
cmp dword [ebp - 0x1c], 0
jne 0x1006a15
mov al, byte [esi]
test al, al
je 0x10069e3
cmp al, 0x20
ja 0x10069e3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10069d3
test byte [ebp - 0x3c], 1
je 0x10069ef
movzx eax, word [ebp - 0x38]
jmp 0x10069f2
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100cd90], eax
cmp dword [0x100cd84], 0
jne 0x1006a69
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1006a24
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1006a37
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10069c0
cmp dword [0x100cd94], 0
jne 0x1006a78
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100cd90]
jmp 0x1006a99
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01007009
ret
call fcn.01007106
jmp 0x10068c0

Function at 0x1006b81
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100c2c4]
jne 0x1006b93
jmp loc.010515e0
jmp fcn.01007183

Function at 0x1006eb0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1006ec3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1006ebf
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x1006ef0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1006f2f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1006f25
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1006f31
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1006f15
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10074b7
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp loc.010539d0

Function at 0x100763c
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa8], 0
cmp dword [0x100c5e8], 0xfffffffe
mov dword [ebp - 0xb0], 0xc
jne 0x1007761
and dword [0x100c5e8], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1007761
cmp dword [ebp - 0x94], 1
jne 0x1007761
cmp dword [ebp - 0xa0], 4
jne 0x1007761
cmp dword [ebp - 0x9c], 0xa
jae 0x1007761
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1007761
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x10015bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007761
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x10012e1
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1007761
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100751a
test eax, eax
je 0x1007761
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x1007757
cmp dword [ebp - 0xa8], 0xd
jne 0x1007761
mov dword [0x100c5e8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100c5e8]
xor ecx, ebp
call fcn.01006b81
leave
ret

Function at 0x1008b13
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x1008b52
push esi
movzx esi, byte [ecx]
xor ebx, ebx
dec eax
inc ecx
mov bh, byte [ecx]
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or esi, ebx
inc ecx
xor edx, esi
test eax, eax
jg 0x1008b2d
pop esi
and edi, 3
xor eax, eax
dec edi
je 0x1008b6e
dec edi
je 0x1008b67
dec edi
jne 0x1008b73
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
xor eax, edx
pop ebx
pop ebp
ret 0xc
Function at 0x4035b2
Capabilities:
Encode data using xor

Disassembly:
call fcn.00403453
xor ecx, ecx
sub ecx, 0xffffff86
call 0x4035b2
rcr byte [esi - 0x7f], 0x76
push cs
xchg esp, eax
lodsd eax, dword [esi]
fcomp dword [edi - 0x1d03117d]
hlt

Function at 0x405890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xchg ebx, ebx
xor edx, edx
test ebp, edx
je 0x4058c7
jb 0x40591b
add eax, dword [ebx - 0x3fcc009d]
and al, 0xae
and al, 0xc2
dec ecx
sbb ebx, edi
idiv byte [ebp + 5]
mov dword [ebp + ebx*4 - 0x24], ecx
inc ebx
jl 0x40593b
add al, 0x83
mov byte [esp + eax*4], 0xd1
test dword [edx + 0x3c85e075], ebp
or byte [edx + 0x52], al
test dword [eax + ecx], edi
inc edx
push edx
push eax
call 0x6f404a60
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
cmp ecx, 6
jge 0x4058fd
mov edx, dword [edi - 0x76be2373]
dec ebp
imul bl
push cs
mov edi, esi
mov ecx, ebx
stc
loope 0x405923
add eax, 0x54
rep movsb byte es:[edi], byte [esi]
mov esi, dword [eax]
mov dword [ebp - 8], eax
xchg esi, esi
jne 0x4058eb
mov ecx, dword [esi]
or ebp, dword [esi + ebx*2 - 0x3a]
add al, byte [eax]
pop ebx
mov esp, dword [0x9090c3f1]
nop
nop
nop
nop
nop

Function at 0x407efb
Capabilities:
Encode data using xor

Disassembly:
mov eax, edi
inc ebp
adc byte [esi + 0x15], cl
add byte [eax], al
fld qword [ebp + 8]
fcomp qword [0xd3df6a]
mov ecx, dword [ebp - 0x58]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov bh, 0xf6
push edi
push 0xfc7589e0
sbb dh, byte [ecx]
test ah, 5
mov edi, ebx
jp 0x407f33
fnstsw word [ecx - 0x221f26f8]
pop ebp
or byte [ebx], bl
mov dword [0xea000043], eax
invalid
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2b0cb04], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x434078]
mov ebx, dword [0x43407c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00401000
mov eax, dword [0x434080]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x434084]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2b0cb04], 0xc
mov dword [ebp - 4], eax
jne 0x4010b2
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2b0cb04]
cmp eax, 0xfa9
jne 0x4010ce
mov dword [0x2b0cb00], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ed
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x2b0c4b4], esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov edx, edi
add eax, edi
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x2b0cafc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shr edx, cl
add edx, ebx
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add dword [ebp - 0x18], 0x61c88647
dec dword [ebp - 0x24]
jne 0x401072
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4