joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a0f0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000a280
mov eax, dword [esi]
test eax, eax
je 0x1000a268
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000a28c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000a258
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000a21c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000a156
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000a282
Function at 0x1001f4b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001f68
push 0
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x1001f6b
and eax, 0x10
ret 4

Function at 0x100263f
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
jne 0x1002650
call fcn.01002613
cmp eax, 2
jne 0x100268e
test byte [esp + 4], 4
jne 0x1002673
push 4
push 0x40
push 0
push 0x1001251
push 0x522
push 0
call fcn.01005636
cmp eax, 6
jne 0x100268e
cmp word [0x100aa64], 0
jne 0x1002689
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x100268e
call fcn.01005636
ret 4

Function at 0x1002b34
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
mov cl, byte [edi]
test cl, cl
je 0x1002b99
push ebx
push esi
lea esi, [edi + 1]
mov al, byte [esi]
xor ebx, ebx
cmp al, 0x3a
jne 0x1002b57
cmp byte [edi + 2], 0x5c
jne 0x1002b57
lea esi, [edi + 3]
jmp 0x1002b92
cmp cl, 0x5c
jne 0x1002b92
cmp al, cl
jne 0x1002b92
push 2
lea esi, [edi + 2]
pop ebx
jmp 0x1002b92
cmp byte [esi], 0x5c
jne 0x1002b89
cmp byte [esi - 1], 0x3a
je 0x1002b89
test ebx, ebx
je 0x1002b7a
dec ebx
jmp 0x1002b89
and byte [esi], 0
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0
jne 0x1002b68
pop esi
pop ebx
pop edi
ret 4

Function at 0x1002eaf
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
sub esp, 0x104
push ebp
push esi
mov esi, dword [0x100ac40]
xor ebp, ebp
cmp esi, ebp
push edi
mov edi, esi
je 0x1002f03
push ebx
mov ebx, dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [0x100b884], ebp
jne 0x1002ef2
cmp dword [0x100b490], ebp
jne 0x1002ef2
push 0x80
push dword [esi]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x1002ecd
pop ebx
cmp dword [0x100b880], ebp
je 0x1002f53
cmp dword [0x100b884], ebp
jne 0x1002f53
cmp dword [0x100b490], ebp
jne 0x1002f53
push 0x100ac44
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1002f3e
lea eax, [esp + 0xc]
push eax
call fcn.01005b71
push 0x1001284
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
call fcn.01005636
cmp word [0x100aa64], 1
je 0x1002f6a
cmp dword [0x100b880], ebp
je 0x1002f6a
call fcn.01005636
pop edi
pop esi
mov dword [0x100b880], ebp
pop ebp
add esp, 0x104
ret
Function at 0x1002f7a
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
push edi
lea eax, [esp + 0x14]
push 0x1001348
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
inc edi
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005b32
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryA]
je 0x1003015
cmp edi, 0x190
jl 0x1002f8f
push esi
push 0
push 0x1001344
push dword [esp + 0x124]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x1003006
xor ebp, ebp
push esi
inc ebp
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 8
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1002fde
xor eax, eax
inc eax
mov dword [0x100b880], eax
mov ebp, eax
jmp 0x1003006

Function at 0x1003e60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
call dword [sym.imp.kernel32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1003ea0
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01005636
call fcn.01003547
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x1003f07
push edi
push ebx
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push 0x10013c4
push esi
call fcn.01005b32
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1003efa
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003efa
test al, 0x10
je 0x1003efa
xor eax, eax
mov dword [0x100aa5c], ebp
inc eax
jmp 0x1003f06
call fcn.01003547
mov dword [0x100aa5c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1003f0d
Capabilities:
Get common file path
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
jne 0x1003f29
xor eax, eax
inc eax
jmp 0x100410d
push esi
push edi
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
call esi
test eax, eax
jne 0x1003f6d
push ebx
push 0x10
push ebx
push ebx
push 0x4bc
push ebx
call fcn.01005636
call fcn.01003547
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x100410b
lea eax, [ebp - 4]
push eax
push ebx
call fcn.01005636
mov edi, eax
cmp edi, ebx
jne 0x1003fd2
push 0x7f
mov byte [ebp - 0x318], bl
xor eax, eax
pop ecx
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01003547
push ebx
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageA]
push ebx
push 0x10
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 8]
push 0x4b0
jmp 0x100403b
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
test eax, eax
jne 0x100404f
push 0x7f
mov byte [ebp - 0x318], bl
pop ecx
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01003547
push ebx
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageA]
push ebx
push 0x10
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 8]
push 0x4f9
push ebx
call fcn.01005636
lea eax, [ebp - 0x118]
push eax
call esi
jmp 0x1003f66
lea eax, [ebp - 0x118]
push eax
call esi
push 3
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrcpynA]
mov ecx, 0x200
xor eax, eax
cmp dword [ebp - 4], ecx
je 0x100407c
shl ecx, 1
inc eax
cmp ax, 8
jb 0x100406e
cmp ax, 8
jne 0x1004097
push ebx
push 0x10
push ebx
push ebx
push 0x4c5
push ebx
call fcn.01005636
jmp 0x1003f66
test byte [0x100b494], 8
je 0x10040c1
test byte [ebp - 0xf], 0x80
je 0x10040c1
mov edx, dword [0x100b498]
movzx eax, ax
mov eax, dword [eax*4 + 0x100bbc0]
mov ecx, edx
shr ecx, 2
shl eax, 1
add ecx, edx
jmp 0x10040d1
mov ecx, dword [0x100b498]
movzx eax, ax
mov eax, dword [eax*4 + 0x100bbc0]
mov esi, dword [ebp + 0xc]
and esi, 1
je 0x10040f6
test byte [ebp + 0xc], 2
je 0x10040f6
lea edx, [ecx + eax]
cmp edx, edi
jbe 0x1004102
lea edx, [ebp - 0xc]
push edx
push ecx
push eax
push dword [ebp + 0x10]
call fcn.01005636
jmp 0x100410b
cmp esi, ebx
je 0x10040fe
cmp eax, edi
jmp 0x10040e4
cmp ecx, edi
jmp 0x10040e4
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004809
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005bca
test eax, eax
jne 0x1004823
mov eax, ebx
jmp 0x100487e
cmp dword [0x100ac3c], 0
jne 0x1004870
test byte [0x100b898], bl
jne 0x1004870
push 6
push 0
push 0x100383d
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01005636
sub eax, 6
je 0x100486e
dec eax
je 0x1004884
sub eax, 0x832
jne 0x1004870
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x100487c

Function at 0x1004b1a
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004ba7
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.01002f7a
test eax, eax
je 0x1004c10
lea eax, [ebp - 0x128]
push eax
mov esi, 0x100ac44
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1004b9a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004b8f
dec eax
je 0x1004b88
dec eax
je 0x1004b81
dec eax
jne 0x1004b9a
push 0x1001400
jmp 0x1004b94
push 0x10013f8
jmp 0x1004b94
push 0x10013f0
jmp 0x1004b94
push 0x10013e8
push esi
call fcn.01005b32
push 0x1001251
push esi
call fcn.01005b32
jmp 0x1004bb6
push dword [ebp + 8]
mov esi, 0x100ac44
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push esi
call fcn.01003e60
test eax, eax
jne 0x1004bd6
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x1004bef
mov dword [0x100b880], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01005636
test eax, eax
je 0x1004bfb
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
jmp 0x1004c12
call fcn.01003547
mov dword [0x100aa5c], eax
jmp 0x1004c10
cmp dword [0x100b880], ebx
je 0x1004c10
push esi
mov dword [0x100b880], ebx
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x1005636
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1005645
pop dword [ebp - 0x50]
mov eax, 0x936b6a0
sub eax, 0x836605b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa80d3d7
add dword [ebp - 0x60], 0x43d17174
mov dword [ebp - 0x5c], 0xad18eea
sub dword [ebp - 0x5c], 0xd89e42a5
mov dword [ebp - 0x58], 0x21016a0d
sub dword [ebp - 0x58], 0xd4b525df
mov dword [ebp - 0x54], 0xbd58657e
sub dword [ebp - 0x54], 0xbd58657e
lea eax, [ebp - 0x60]
push eax
mov eax, 0x451a97c5
add eax, 0xbbe5798f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xfee8841b
add dword [ebp - 0x60], 0x7589e53b
mov dword [ebp - 0x5c], 0xd9f79a61
sub dword [ebp - 0x5c], 0x988b38ec
mov dword [ebp - 0x58], 0x7183b096
sub dword [ebp - 0x58], 0xe14442a
mov dword [ebp - 0x54], 0x1f476d52
add dword [ebp - 0x54], 0xe0b892ae
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xd7108e48
add eax, 0x29ef8278
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7cb
push 0
call eax
mov ecx, 0xfacbe94d
add ecx, 0x5346b6f
mov ebx, eax
mov esi, 0x4b6787da
sub esi, 0x4a62f7da
add esi, dword [ebp - 0x50]
mov edi, 0x1bdab07c
sub edi, 0x8f8db4d9
sub dword [ebp - 4], ecx
mov edx, dword [esi]
mov dword [ebp - 0x48], 0x675c776e
add edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x38], 0x4b7488e
add ebx, 0x9b06e52b
add ebx, 0x64f91ad9
add esi, 0x7fbc6e46
sub esi, 0x7fbc6e42
loop 0x1005767
add eax, 0x145c3
xor ebx, ebx
add ebx, eax
add eax, 0xaaa5f4cf
add eax, 0x555a0b36
mov ecx, 0x99c048fc
add ecx, 0x673fb704
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1005a5e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005a85
inc esi
mov al, byte [esi]
test al, al
je 0x1005a7e
cmp al, 0x22
jne 0x1005a73
cmp byte [esi], 0x22
jne 0x1005a96
jmp 0x1005a95
cmp al, 0x20
jle 0x1005a96
inc esi
cmp byte [esi], 0x20
jg 0x1005a89
jmp 0x1005a96
cmp al, 0x20
jg 0x1005a9c
inc esi
mov al, byte [esi]
test al, al
jne 0x1005a91
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005ab6
movzx eax, word [ebp - 0x14]
jmp 0x1005ab9
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1005bca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005bdd
xor eax, eax
jmp 0x1005be5
shr eax, 4
not eax
and eax, 1
ret 4
Function at 0x1005d22
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
and dword [ebp + 0x74], 0
cmp dword [0x100a2cc], 0xfffffffe
mov dword [ebp + 0x6c], 0xc
jne 0x1005e09
and dword [0x100a2cc], 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x1005e09
cmp dword [ebp - 0x28], 1
jne 0x1005e09
cmp dword [ebp - 0x34], 4
jne 0x1005e09
cmp dword [ebp - 0x30], 0xa
jae 0x1005e09
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1005e09
lea eax, [ebp + 0x70]
push eax
push 0x20019
push 0
push 0x1001488
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e09
push edi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x1001251
push dword [ebp + 0x70]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp + 0x70]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005e09
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.01005c1c
test eax, eax
je 0x1005e09
and dword [ebp + 0x74], 0x3ff
cmp dword [ebp + 0x74], 1
je 0x1005dff
cmp dword [ebp + 0x74], 0xd
jne 0x1005e09
mov dword [0x100a2cc], 1
mov eax, dword [0x100a2cc]
add ebp, 0x78
leave
ret

Function at 0x1005e13
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1005e49
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005e4d
xor eax, eax
jmp 0x1005e63
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
leave
ret 4

Function at 0x1007083
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x10070be
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x100709b
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10070da
dec esi
je 0x10070d3
dec esi
jne 0x10070df
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x402127
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x18]
add eax, 0x2570
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2ff0
push ecx
push str.m_szLangRegKey___s__m_szLangRegValue___s
call fcn.00401000
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x2ff0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4021cd
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x2570
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4021c3
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x2670
push eax
call fcn.00419a10
add esp, 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4021cf
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40273e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439fdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov dword [ebp - 0x120], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x110], 0xff
lea eax, [ebp - 0x114]
push eax
push 0x20019
push 0
lea ecx, [ebp + 8]
call fcn.004039b0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40281f
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.004039b0
push eax
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402812
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0042c4a6
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x118], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0042c31d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0042c31d
mov eax, dword [ebp - 0x118]
jmp 0x40284a
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x11c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0042c31d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0042c31d
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406df1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.CommonSM_received_WM_USER_THREAD_FINISHED_from_IOManager
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x15a8], 1
push 0
push 0x12
push 0
push 0
call fcn.0041185e
push str.All_HTML_help_is_closed
call fcn.00401000
add esp, 4
mov ecx, dword [ebp - 4]
call fcn.004075a0
push str.Send_End_Messages
call fcn.00401000
add esp, 4
call sub.SMBalloon.dll_HidePanel
push str.Hide_Panel
call fcn.00401000
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1584], 0
je 0x406e6f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1584]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push str.Close_bitmap_Image
call fcn.00401000
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc0], 0
je 0x406e97
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc0]
call dword [sym.imp.spiomgr.dll_public:_void___thiscall_IOEventManager::DeleteAll_void_]
push str.IOEveMgr_is_deleted
call fcn.00401000
add esp, 4
call fcn.00405472
test eax, eax
je 0x406eb5
mov ecx, dword [ebp - 4]
call fcn.00408dcd
call sub.SMBalloon.dll_DestroyPanel
mov ecx, dword [ebp - 4]
call fcn.00408aca
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
call dword [edx + 0x58]
push str.Destroy_Window___function_is_called
call fcn.00401000
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x407c4c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x407c7a
xor eax, eax
jmp 0x407cc0
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x9c], ecx
cmp dword [ebp - 0x9c], 1
je 0x407c9a
cmp dword [ebp - 0x9c], 2
je 0x407c9e
jmp 0x407cbe
xor eax, eax
jmp 0x407cc0
cmp dword [ebp - 0x90], 4
jne 0x407cae
mov eax, 1
jmp 0x407cc0
cmp dword [ebp - 0x90], 5
jb 0x407cbe
mov eax, 1
jmp 0x407cc0
xor eax, eax
mov esp, ebp
pop ebp
ret