joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x75ec541b
mov edi, 0x75ac859b
xor edi, edx
mov eax, edi
sub eax, 0x1a
mov ebx, dword [eax + 0x1a]
mov edi, dword [ebx]
mov ebx, 0xd1a39b54
xor edi, ebx
xor edi, 0x56c3ef57
mov esi, edi
add esp, 0xfffffffc
mov dword [esp], esi
and al, 0x59
mov eax, 0
mov ebx, 0
xor eax, ebx
xor eax, edx
xor edx, edx
add edx, eax
jmp 0x403fba

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret
Function at 0x401106
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.00401119

Function at 0x401159
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
xor al, al
cld
repne scasb al, byte es:[edi]
mov ecx, edi
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
add esi, dword [esi + 0x3c]
mov esi, dword [esi + 0x78]
add esi, dword [ebp + 8]
mov ebx, dword [esi + 0x20]
add ebx, dword [ebp + 8]
xor edx, edx
push esi
mov edi, dword [ebx]
add edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
repe cmpsb byte [esi], byte es:[edi]
jne 0x40119c
pop esi
jmp 0x4011a6
pop esi
add ebx, 4
inc edx
cmp edx, dword [esi + 0x18]
jb 0x401189
sub ebx, dword [esi + 0x20]
sub ebx, dword [ebp + 8]
shr ebx, 1
add ebx, dword [esi + 0x24]
add ebx, dword [ebp + 8]
movzx eax, word [ebx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
popal
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x4013fe
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
push edi
call fcn.0040134b
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [0x403460]
call sub.psapi.dll_EnumProcessModules
push 0x3e8
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 4]
push dword [0x403460]
call sub.psapi.dll_GetModuleFileNameExA
lea edi, [ebp - 0x3f0]
push edi
call sub.kernel32.dll_lstrlenA
add edi, eax
mov ecx, eax
jmp 0x40146d
mov al, byte [edi]
cmp al, 0x5c
jne 0x40146b
mov byte [edi + 1], 0
push dword [ebp + 8]
lea eax, [ebp - 0x3f0]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x401471
dec ecx
dec edi
or ecx, ecx
jne 0x401450
lea eax, [ebp - 0x3f0]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40165b
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
pushal
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
push 0x403238
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 8]
push eax
push 0x403238
call sub.advapi32.dll_GetUserNameA
mov edi, dword [ebp + 8]
mov dword [0x403438], 0xf
lea esi, [edi + 0x24]
push esi
call sub.kernel32.dll_lstrlenA
mov dword [0x40343c], ecx
mov dword [0x40344c], esi
mov dword [0x403440], 0
mov dword [0x403450], eax
mov dword [0x40343c], 0x78
push 0x403438
push 0
push 0x1007
push dword [0x403110]
call sub.user32.dll_SendMessageA
mov dword [0x40343c], eax
mov dword [0x403438], 0xb
mov ebx, 0
mov dword [0x403450], eax
lea esi, [0x403138]
push dword [edi + 8]
push 0x40216b
push esi
call sub.user32.dll_wsprintfA
add esp, 0xc
push esi
call sub.kernel32.dll_lstrlenA
mov dword [0x403440], 1
mov dword [0x40344c], esi
lea esi, [eax + esi + 1]
mov dword [0x403450], eax
push 0x403438
push 0
push 0x1006
push dword [0x403110]
call sub.user32.dll_SendMessageA
inc ebx
mov dword [ebp - 0xc], 0x100
mov edx, dword [0x403468]
add edx, dword [0x40346c]
push 0x403470
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x403338
push dword [edx + 0xc]
push 0
call sub.advapi32.dll_LookupAccountSidA
add dword [0x40346c], 0x10
mov dword [0x403440], 2
mov dword [0x40344c], 0x403338
push 0x403438
push 0
push 0x1006
push dword [0x403110]
call sub.user32.dll_SendMessageA
popal
leave
ret 4

Function at 0x4017a6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
jmp 0x4017bf
call sub.kernel32.dll_GetCurrentProcess
mov ecx, eax
lea eax, [ebp - 4]
push eax
push 0xf01ff
push ecx
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x10]
push eax
push 0x4017ae
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
call sub.advapi32.dll_AdjustTokenPrivileges
leave
ret

Function at 0x401809
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [0x403478], eax
mov dword [0x40347c], 0x128
push 0x40347c
push dword [0x403478]
call sub.kernel32.dll_Process32First
jmp 0x401853
push 0x40347c
call fcn.0040165b
push 0x40347c
push dword [0x403478]
call sub.kernel32.dll_Process32Next
or eax, eax
jne 0x401839
mov dword [ebp - 4], 0
push dword [0x403478]
call sub.kernel32.dll_CloseHandle
leave
ret
Function at 0x401a42
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 0x30
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push dword [section..data]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40186b
mov dword [ebp - 0x10], 6
mov dword [ebp - 8], str.TrayShowDesktopButtonWClass
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [section..data]
push 0
push 0
push 0x190
push 0x258
push 0x64
push 0x64
push 0xcf0000
push 0
push str.TrayShowDesktopButtonWClass
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x403004], eax
push 1
push dword [0x403004]
call sub.user32.dll_ShowWindow
push dword [0x403004]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401b17
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401af0
leave
ret
Function at 0x403160
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x839080], 0x594
mov dword [ebp - 0xc], eax
jne 0x403195
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [0x419ef8]
mov edx, dword [0x419efc]
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], edx
call fcn.00403150
mov ebx, dword [ebp - 8]
mov eax, dword [0x419f00]
mov ecx, dword [0x419f04]
add ebx, 0x23f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0x20
jmp 0x4031e2
xor esi, esi
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov ecx, dword [0x839080]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x403244
push esi
lea edx, [ebp - 0x42c]
push edx
push 0x4025c0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], cx
mov edx, dword [ebp - 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x839080]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x40325e
mov dword [0x83861c], 0xedeb2e40
jmp 0x40326c
cmp ecx, 0x3eb
jne 0x40326c
mov dword [0x837fd0], esi
mov ecx, dword [ebp - 8]
mov edx, edi
shr edx, cl
lea eax, [ebx + edi]
mov dword [ebp - 0x10], eax
mov dword [0x838618], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x839080], 0xc
jne 0x4032bf
lea ecx, [ebp - 0x10]
push ecx
push esi
push esi
lea edx, [ebp - 0x2c]
push edx
push esi
push esi
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
lea esi, [ebx + edx]
add ebx, 0x61c88647
add eax, dword [ebp - 0x20]
xor eax, esi
xor ecx, eax
sub edi, ecx
sub dword [ebp - 0x18], 1
mov dword [ebp - 4], ecx
jne 0x4031e0
cmp dword [0x839080], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
pop ebx
jne 0x403327
push 0
push 0x4025f4
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov dword [esi + 4], edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403340
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x839080]
mov ecx, dword [0x837fd4]
shr eax, 3
sub esp, 0x408
test eax, eax
jbe 0x40341a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x839080], 0x959
jne 0x403400
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x402628
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00403160
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x403380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4045a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4190c8]
jne 0x4045aa
repz ret
jmp fcn.00406d0e

Function at 0x40692f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404621
and dword [ebp - 4], 0
cmp dword [0x41aa10], 0
mov ebx, eax
jne 0x4069e0
push 0x4019f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406a91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019ec
push edi
call esi
test eax, eax
je 0x406a91
push eax
call fcn.004045af
mov dword [esp], 0x4019dc
push edi
mov dword [0x41aa10], eax
call esi
push eax
call fcn.004045af
mov dword [esp], 0x4019c8
push edi
mov dword [0x41aa14], eax
call esi
push eax
call fcn.004045af
mov dword [esp], 0x4019ac
push edi
mov dword [0x41aa18], eax
call esi
push eax
call fcn.004045af
pop ecx
mov dword [0x41aa20], eax
test eax, eax
je 0x4069e0
push 0x401994
push edi
call esi
push eax
call fcn.004045af
pop ecx
mov dword [0x41aa1c], eax
mov eax, dword [0x41aa1c]
cmp eax, ebx
je 0x406a38
cmp dword [0x41aa20], ebx
je 0x406a38
push eax
call fcn.0040462a
push dword [0x41aa20]
mov esi, eax
call fcn.0040462a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406a38
test edi, edi
je 0x406a38
call esi
test eax, eax
je 0x406a2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406a2f
test byte [ebp - 0xc], 1
jne 0x406a38
or dword [ebp + 0x10], 0x200000
jmp 0x406a71
mov eax, dword [0x41aa14]
cmp eax, ebx
je 0x406a71
push eax
call fcn.0040462a
pop ecx
test eax, eax
je 0x406a71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a71
mov eax, dword [0x41aa18]
cmp eax, ebx
je 0x406a71
push eax
call fcn.0040462a
pop ecx
test eax, eax
je 0x406a71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41aa10]
call fcn.0040462a
pop ecx
test eax, eax
je 0x406a91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406a93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100727f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007281c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1007284d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1007284b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1005812b
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1007284d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076450
leave
ret 8

Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401054
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40104c
lea ecx, [ecx]
cmp al, 0x22
je 0x401051
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401040
cmp byte [esi], 0x22
jne 0x40105e
inc esi
jmp 0x40105e
cmp al, 0x20
jbe 0x40105e
inc esi
cmp byte [esi], 0x20
ja 0x401058
mov al, byte [esi]
test al, al
je 0x401070
cmp al, 0x20
ja 0x401070
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401064
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
jne 0x401090
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x1d3f64f3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..didat
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6a180e53
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001420
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10013050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
push 0x10014c84
mov dword [esi], vtable.FileContextMenuExt.1.0
mov dword [esi + 4], vtable.FileContextMenuExt.0
mov dword [esi + 8], 1
mov dword [esi + 0x214], 0x100116ec
mov dword [esi + 0x21c], 0x10011714
mov dword [esi + 0x220], str.cppdisplay
mov dword [esi + 0x224], 0x10011738
mov dword [esi + 0x228], str.CppDisplayFileName
mov dword [esi + 0x22c], 0x10011774
mov dword [esi + 0x230], str.Display_File_Name__C_
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.10006ae0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jbe 0x100014f2
push 0
push 0x10
push 0x10
push 1
push 0x66
push dword [0x10014c88]
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
push edi
call fcn.10001550
jmp 0x10001526
push ebx
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0x10
push 0x10
push 0
push 0x65
push dword [0x10014c88]
mov ebx, eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
test edi, edi
je 0x10001523
push ebx
mov ecx, edi
call fcn.10001610
jmp 0x10001525
xor eax, eax
pop ebx
mov dword [esi + 0x218], eax
test edi, edi
je 0x10001537
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000208e
mov esp, ebp
pop ebp
ret

Function at 0x100017f0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10013050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov ebx, ecx
call fcn.10006ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.InstaWorksInstaWorks.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10001894
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10006ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x2a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.InstaWorksInstaWorks.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.10006ae0
lea eax, [ebx + 0xc]
push eax
push str.__s_
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.100021c3
add esp, 0x1c
lea eax, [ebp - 0x414]
push 1
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000208e
mov esp, ebp
pop ebp
ret 4
Function at 0x10001cc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000000
mov ebx, edx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0x10001cff
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10001d3b
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10001d31
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x10001d31
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001e40
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10013050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x100116dc
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x414]
push eax
push str.CLSID_sInprocServer32
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10001c60
add esp, 0x10
test eax, eax
js 0x10001ea0
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x414]
push eax
push str.CLSID_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10001c60
add esp, 0x10
test eax, eax
js 0x10001ee2
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x10001ee2
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000208e
mov esp, ebp
pop ebp
ret

Function at 0x10001fc0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10013050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x10001fee
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000208e
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x100116dc
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x414]
push eax
push esi
push str._s_shellexContextMenuHandlers_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10001c60
add esp, 0x14
test eax, eax
js 0x1000203c
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x414]
push eax
push esi
push str.SystemFileAssociations_s_shellexContextMenuHandlers_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10001c60
add esp, 0x14
test eax, eax
js 0x1000207f
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x1000207f
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000208e
mov esp, ebp
pop ebp
ret