joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f390
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8fd1f0]
test eax, eax
jne 0x51f3b0
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x8fd1f0], eax
je 0x51f3d4
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51f3d4
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ecx
call eax
neg al
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x51f410
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push str.main
push edi
mov byte [ebx], 0
call fcn.0051f580
add esp, 8
test eax, eax
jne 0x51f439
pop edi
mov byte [ebx], 3
pop esi
pop ebx
pop ebp
ret
mov eax, dword [edi + 0x1f8]
test eax, eax
jne 0x51f44d
pop edi
mov byte [ebx], 1
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
push edi
call fcn.0051f4f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x51f46f
pop edi
pop esi
mov eax, 7
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1f0]
mov edx, dword [edi + 0x1f4]
push 0
push ecx
push edx
push 1
push esi
call fcn.00485780
mov eax, dword [edi + 0x1f8]
push 0
push 0xffffffffffffffff
push eax
push 2
push esi
call fcn.00485b30
push esi
call fcn.00484290
add esp, 0x2c
cmp eax, 0x64
jne 0x51f4d4
push 0
push esi
call fcn.00485490
add esp, 8
test eax, eax
je 0x51f4d4
push 1
push esi
call fcn.00485490
add esp, 8
add al, 2
mov byte [ebx], al
push esi
call fcn.00480cf0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
mov byte [ebx], 1
call fcn.00480cf0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5202b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, 1
cmp dword [esi + 0x1c], ecx
jbe 0x5203bf
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor edx, edx
mov bl, byte [eax - 1]
mov dl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x8de6f8]
mov edx, dword [edx*4 + 0x8deef8]
xor ebx, ebx
xor edx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x8deaf8]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de2f8]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0x12], edx
mov bl, byte [eax - 0xc]
xor edx, edx
mov dl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x8deaf8]
xor ebx, ebx
mov edx, dword [edx*4 + 0x8deef8]
mov bl, byte [eax - 0xd]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de6f8]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de2f8]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0xe], edx
mov bl, byte [eax - 8]
xor edx, edx
mov dl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x8deaf8]
xor ebx, ebx
mov edx, dword [edx*4 + 0x8deef8]
mov bl, byte [eax - 9]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de6f8]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de2f8]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0xa], edx
mov bl, byte [eax - 4]
xor edx, edx
mov dl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x8deaf8]
xor ebx, ebx
mov edx, dword [edx*4 + 0x8deef8]
mov bl, byte [eax - 5]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de6f8]
xor ebx, ebx
mov bl, byte [eax - 6]
xor edx, edi
mov edi, dword [ebx*4 + 0x8de2f8]
xor edx, edi
inc ecx
mov dword [eax - 6], edx
mov edx, dword [esi + 0x1c]
cmp ecx, edx
jb 0x5202ca
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x520f90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
pop ebp
ret
Function at 0x521e00
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
xor eax, eax
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jl 0x521e16
xor edi, edi
mov eax, esi
mov ebx, dword [ebp + 8]
cdq
idiv dword [ebp + 0xc]
xor ecx, ecx
xor eax, eax
mov cl, byte [ebp + esi - 0x108]
mov al, byte [edx + ebx]
add eax, ecx
add edi, eax
and edi, 0x800000ff
jns 0x521e52
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], dl
inc esi
cmp esi, 0x100
mov byte [ebp + edi - 0x108], cl
jl 0x521e27
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x521f05
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
sub edx, ecx
mov dword [ebp + 0xc], eax
inc esi
and esi, 0x800000ff
jns 0x521e9d
dec esi
or esi, 0xffffff00
inc esi
xor eax, eax
mov al, byte [ebp + esi - 0x108]
add edi, eax
and edi, 0x800000ff
jns 0x521eb8
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], bl
xor ebx, ebx
mov byte [ebp + edi - 0x108], al
mov bl, byte [ebp + esi - 0x108]
and eax, 0xff
add ebx, eax
and ebx, 0x800000ff
jns 0x521eed
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov bl, byte [edx + ecx]
xor al, bl
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
inc ecx
dec eax
mov dword [ebp + 0xc], eax
jne 0x521e8c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52d3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x52d545
cmp di, 0x801
ja 0x52d545
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x52d545
cmp bx, 0xc
ja 0x52d545
mov al, byte [esp + 0x30]
test al, al
je 0x52d444
push edi
call fcn.0052d980
add esp, 4
cmp ax, bx
je 0x52d444
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.0052d550
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.0052d370
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x52d545
test ebx, ebx
jne 0x52d4d9
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x52d53b
test al, al
je 0x52d4cc
push 0xffffffffffffffe1
jmp 0x52d4ce
push 0x1f
push ebp
push edi
push esi
call fcn.0052d320
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.0052d320
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.0052d550
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.0052d370
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x52d4a6
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x52ec30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5680e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x8fd280
lea ecx, [esp + 4]
call fcn.0055a0eb
push 0x8e63bc
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.0055a0eb
push 0x8e63b8
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.0055a0eb
push 0x8e63b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.0055a0eb
push 0x8e63b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.0055a0eb
push 0x8e63ac
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.0055a0eb
push 0x8e63a8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.0055a0eb
push 0x8e63a4
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.0055a0eb
push 0x8e63a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.0055a0eb
push 0x8e639c
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.0055a0eb
push 0x8e6398
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.0055a0eb
push 0x8e6394
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.0055a0eb
push 0x8e6390
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.0055a0eb
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x52ed60
cmp eax, 0xc
jle 0x52ed60
mov ecx, dword [esp + 0x48]
push 0x8fd280
call fcn.0055a1ba
jmp 0x52ed6e
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.0055a16a
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.0055a07d
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.0055a07d
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.0055a07d
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.0055a07d
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.0055a07d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.0055a07d
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.0055a07d
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.0055a07d
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.0055a07d
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.0055a07d
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.0055a07d
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.0055a07d
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0055a07d
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x533380
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8fd39c]
xor edx, edx
cmp eax, edx
jne 0x5333a6
xor eax, eax
mov byte [eax + 0x8fd29c], al
inc eax
cmp eax, 0x100
jl 0x53338e
mov dword [0x8fd39c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8fd29c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x533437
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x53340a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5333d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5334b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x533503
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5334ea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x539eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56845e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0053a7d0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8bd6b4
call fcn.00559dbe
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x539f43
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00559dbe
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x539f3c
push 0
mov ecx, eax
call fcn.00530fb0
mov dword [esi + 0xc], eax
jmp 0x539f45
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x539f45
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x55c431
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x55c469
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0055a4d8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0055a4b0
jmp 0x55c475
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55db28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x55db6a
call fcn.005634a9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x55db6a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55db61
xor eax, eax
jmp 0x55db72
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055db78
pop edi
pop esi
pop ebx
ret 4

Function at 0x5639d9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x563a07
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x563a25
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0056393f
jmp 0x563a25
mov eax, dword [esi + 0x14]
test eax, eax
je 0x563a25
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0056393f
test edi, edi
mov eax, edi
jne 0x563a0f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x10024da0
Capabilities:
Query or enumerate registry value

Disassembly:
cmp ecx, dword [0x1000e000]
jne 0x10024daa
repz ret
jmp fcn.10025801

Function at 0x1002dab9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x40000000
push 0x1000c944
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [0x1000ee90], eax
ret
Function at 0x4223f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x422578
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
or ebp, 0xffffffff
jmp 0x42241a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x422421
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x422410
mov eax, 1
add ebx, ebx
jne 0x422433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x422428
jne 0x422444
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422428
xor ecx, ecx
sub eax, 3
jb 0x422458
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4224ca
mov ebp, eax
add ebx, ebx
jne 0x422463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422470
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x422494
inc ecx
add ebx, ebx
jne 0x422480
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x422475
jne 0x422491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422475
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4224b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4224a5
jmp 0x422416
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4224b4
add edi, ecx
jmp 0x422416
pop esi
mov edi, esi
mov ecx, 0x301
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4224d2
cmp byte [edi], 1
jne 0x4224d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4224d7
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x422546
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22218]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2227c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x422504
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22280]
or eax, eax
je 0x422540
mov dword [ebx], eax
add ebx, 4
jmp 0x422521
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x422577
cmp al, 0xef
ja 0x42256a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42254c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x422559
popal
jmp 0x4085e8
Function at 0x40b120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427a4b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4322c8]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push edi
mov eax, dword [0x4322c8]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
xor eax, eax
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov byte [esp + 0x78], al
lea ebx, [eax + 0x10]
push ecx
lea eax, [esp + 0x78]
mov dword [esp + 0x90], 0xf
call fcn.0040c270
push 1
push 0
push 0xfffffffffffffff0
mov dword [esp + 0xac], 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40b1ce
cmp dword [esp + 0x8c], 0x10
jb 0x40b1c7
mov edx, dword [esp + 0x78]
push edx
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40b34f
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x40b1e0
lea eax, [esp + 0x78]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b1b0
push 1
push 0
push 0xffffffffffffffec
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40b221
cmp dword [esp + 0x8c], 0x10
jb 0x40b1c7
mov eax, dword [esp + 0x78]
push eax
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40b34f
push 0
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b203
push 1
mov ecx, 0xfffffffc
sub ecx, dword [esp + 0x18]
push 0
push ecx
push esi
call ebx
cmp eax, 0xffffffff
je 0x40b1b0
mov eax, dword [esp + 0x14]
push 0
push eax
mov ecx, edi
call fcn.0040a04a
cmp dword [edi + 0x18], 0x10
jb 0x40b26d
mov eax, dword [edi + 4]
jmp 0x40b270
lea eax, [edi + 4]
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b203
push edi
lea ecx, [esp + 0x40]
push ecx
call fcn.004232d6
lea edx, [esp + 0x20]
mov ecx, eax
mov byte [esp + 0xa0], 1
call fcn.0042332c
mov ecx, eax
lea eax, [esp + 0x74]
mov byte [esp + 0xa0], 2
call fcn.0040c230
mov edi, 0x10
mov byte [esp + 0x13], al
cmp dword [esp + 0x38], edi
jb 0x40b2d9
mov edx, dword [esp + 0x24]
push edx
call fcn.0040f964
add esp, 4
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.004230bc
cmp byte [esp + 0x13], 0
je 0x40b323
mov eax, dword [esp + 0x18]
mov byte [eax], 0
cmp dword [esp + 0x8c], edi
jb 0x40b1c7
mov ecx, dword [esp + 0x78]
push ecx
call fcn.0040f964
add esp, 4
xor al, al
jmp 0x40b34f
mov edx, dword [esp + 0x14]
push 1
push 0
neg edx
push edx
push esi
call ebx
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x8c], edi
jb 0x40b34d
mov eax, dword [esp + 0x78]
push eax
call fcn.0040f964
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0040fca4
mov esp, ebp
pop ebp
ret