joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002426
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1002453
xor eax, eax
push eax
push 0x10
push eax
push eax
push 0x4f5
push eax
jmp 0x10024b3
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x100135c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push esi
push esi
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1002494
push esi
push 0x10
push esi
push esi
push 0x4f6
jmp 0x10024b2
xor esi, esi
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
mov eax, 1
jne 0x10024ba
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003e4b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10024bf
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
push esi
mov esi, 2
jne 0x10024d3
call fcn.010023f8
mov esi, eax
cmp esi, 2
jne 0x1002520
test byte [esp + 8], 4
mov eax, 6
jne 0x10024fb
push 4
push 0x40
push 0
push 0x1001338
push 0x522
push 0
call fcn.01003e4b
cmp eax, 6
jne 0x1002520
cmp esi, 2
jne 0x1002520
cmp word [0x1016704], 0
jne 0x100251b
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1002520
call fcn.01002426
pop esi
ret 4

Function at 0x1002524
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 4
cmp byte [0x10102a0], 0
je 0x1002569
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002569
push 0x10102a0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
ret
Function at 0x100256d
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
lea eax, [ebp - 8]
push edi
lea ecx, [ebp - 4]
push eax
xor esi, esi
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10026ac
mov edi, 0x10102a0
push esi
push str.wextract_cleanup_d
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10025d9
inc esi
cmp esi, 0xc8
jl 0x10025a8
cmp esi, 0xc8
jne 0x10025f6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x10102a0], 0
jmp 0x10026ac
push 0x104
lea eax, [ebp - 0x110]
push eax
push dword [0x1016700]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002620
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10026ac
lea eax, [ebp - 0x110]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call edi
mov esi, eax
push 0x1015774
call edi
add esi, eax
add esi, 0x30
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor eax, eax
test esi, esi
jne 0x1002669
push eax
push 0x10
push eax
push eax
push 0x4b5
push eax
call fcn.01003e4b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10026ac
push 0x1015774
lea eax, [ebp - 0x110]
push eax
push str._s__D:_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call edi
inc eax
push eax
push esi
push 1
push 0
push 0x10102a0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026b2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10027d8
cmp byte [esi], 0
je 0x10027d8
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001378
lea eax, [ebp - 0x104]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea ecx, [ebp - 0x244]
lea eax, [ebp - 0x104]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x10027d8
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [ebp - 0x244], 0x10
je 0x1002785
push 0x1001374
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10027b4
push 0x1001370
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10027b4
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x104]
push eax
push ecx
call edi
push 0x1001338
lea ecx, [ebp - 0x104]
push ecx
call fcn.010027e1
lea ecx, [ebp - 0x104]
push ecx
call fcn.010026b2
jmp 0x10027b4
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x104]
push eax
push ecx
call edi
push pe_nt_image_headers32
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002713
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100285a
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push edi
xor esi, esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10028ae
lea eax, [esp + 8]
push 0x100137c
push eax
call fcn.010027e1
lea eax, [esp + 8]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov edi, eax
je 0x10028ae
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x10028b9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push dword [ebp + 8]
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10028fe
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10028f5
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002908
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push dword [ebp + 8]
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1002951
push esi
lea eax, [ebp - 4]
push esi
push esi
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1002948
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10029ad
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10029ca
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x10029cd
and eax, 0x10
ret 4

Function at 0x10029d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10029fc
xor eax, eax
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003e4b
mov eax, dword [esp + 0x108]
mov al, byte [eax]
sub al, byte [esp]
cmp al, 1
sbb eax, eax
add esp, 0x104
neg eax
ret 4

Function at 0x1002e34
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x1004b89
push esi
push edi
mov esi, dword [0x1015770]
mov edi, esi
test esi, esi
je 0x1004bd6
cmp dword [0x1015fe4], 0
jne 0x1004bbe
cmp dword [0x1015fc0], 0
jne 0x1004bbe
push pe_nt_image_headers32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, esi
test esi, esi
jne 0x1004b97
cmp word [0x1016704], 1
je 0x1004bee
cmp dword [0x1015fe0], 0
je 0x1004bee
call fcn.01002524
xor eax, eax
cmp dword [0x1015fe0], eax
je 0x1004c22
cmp dword [0x1015fe4], eax
jne 0x1004c22
cmp dword [0x1015fc0], eax
jne 0x1004c22
push 0x1001370
mov dword [0x1015fe0], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x1015774
call fcn.010026b2
pop edi
pop esi
ret
Function at 0x1003ae2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ecx, dword [esp + 8]
mov ebp, esp
sub esp, 0x14
test ecx, ecx
push esi
push edi
je 0x1003b91
lea edi, [ebp - 0x14]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1003b87
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x1015fe8], esi
jne 0x1003b64
test byte [0x1015fbc], 1
je 0x1003b64
test byte [0x1015fbc], 2
jne 0x1003b64
mov eax, dword [ebp - 4]
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1003b64
mov eax, dword [ebp - 4]
mov dword [0x1015fbc], eax
push 0
push dword [ebp - 4]
call fcn.01005a57
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1003b93
call fcn.01005aa0
mov dword [0x1015fcc], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1003f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xa
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 0x10], eax
mov ebx, eax
jb 0x1003ffe
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1003ffe
test ebx, ebx
jne 0x1003fc2
xor eax, eax
jmp 0x1004000
push 0xa
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x1003fe7
xor eax, eax
jmp 0x1004000
mov esi, eax
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1004856
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
call fcn.010049da
test eax, eax
jne 0x1004869
xor eax, eax
jmp 0x10049d6
mov eax, dword [0x1010468]
test eax, eax
je 0x10048a1
push 0
push 0x842
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov eax, dword [0x1010468]
push 0x841
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x10156d0]
push eax
call fcn.0100479b
test eax, eax
jne 0x10048cc
xor esi, esi
mov eax, dword [0x1010468]
push esi
push 0x10
push esi
push esi
push 0x4ba
push eax
call fcn.01003e4b
jmp 0x1004974
push 0x10156d8
push 1
push 0x100446d
push fcn.01004419
push 0x1004389
push 0x1004306
push fcn.01004231
xor esi, esi
push 0x1004596
push 0x1004589
call fcn.0100a970
add esp, 0x24
mov ebx, eax
test ebx, ebx
jne 0x1004923
push esi
mov eax, dword [0x10156d8]
push 0x10
add eax, 0x514
push esi
push esi
push eax
push dword [0x1010468]
call fcn.01003e4b
jmp 0x1004974
push 0x10156d0
xor edi, edi
push edi
push 0x10045a7
push edi
push 0x1001338
push str.MEMCAB
push ebx
call fcn.0100ab40
add esp, 0x1c
mov esi, eax
test esi, esi
je 0x1004974
push ebx
call fcn.0100aa10
add esp, 4
test eax, eax
jne 0x1004974
push edi
mov eax, dword [0x10156d8]
push 0x10
add eax, 0x514
push edi
xor esi, esi
push edi
push eax
push dword [0x1010468]
call fcn.01003e4b
xor edi, edi
cmp dword [0x10156d0], edi
je 0x1004990
mov eax, dword [0x10156d0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [0x10156d0], edi
xor eax, eax
test esi, esi
jne 0x10049ae
cmp dword [0x1015768], eax
jne 0x10049ae
push eax
push 0x10
push eax
push eax
push 0x4f8
push eax
call fcn.01003e4b
test byte [0x1015ff4], 1
jne 0x10049d4
test byte [0x1015fc4], 1
jne 0x10049d4
push 0
mov eax, dword [0x1010468]
push esi
push 0xfa1
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x1004c25
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov esi, dword [ebp + 0xc]
cmp ebx, 0x190
jge 0x1004c99
push ebx
mov eax, ebx
inc ebx
push 0x10013a4
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x104]
push ecx
push esi
call fcn.010027e1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1004c38
push 0
mov edi, 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004c99
mov edi, 1
mov dword [0x1015fe0], edi
test edi, edi
jne 0x1004cbe
push esi
push 0
push 0x10013a0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004cbe
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004cc9
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [ebp + 0xc], 0
push esi
je 0x1004d10
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.01004c25
test eax, eax
je 0x1004d8b
lea eax, [ebp - 0x104]
mov esi, 0x1015774
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001338
push esi
call fcn.010027e1
jmp 0x1004d1e
push dword [ebp + 8]
push 0x1015774
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 0x1015774
push esi
call fcn.010050dd
test eax, eax
jne 0x1004d44
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004d65
mov dword [0x1015fe0], 1
xor esi, esi
push esi
push dword [ebp + 0x10]
push 0x1015774
call fcn.010051cf
test eax, eax
je 0x1004d71
mov eax, 1
mov dword [0x1015fcc], esi
jmp 0x1004d8d
call fcn.01005aa0
mov dword [0x1015fcc], eax
jmp 0x1004d8b
xor eax, eax
cmp dword [0x1015fe0], eax
je 0x1004d8b
push 0x1015774
mov dword [0x1015fe0], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10050dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ecx, 0xffffffff
mov ebp, esp
sub eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x13
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor eax, eax
test ebx, ebx
jne 0x100511a
push eax
push 0x10
push eax
push eax
push 0x4b5
push eax
call fcn.01003e4b
jmp 0x10051bc
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10013c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, ebx
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
push eax
push 0x4000080
push 1
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0xffffffff
je 0x10051bc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10051bc
test al, 0x10
je 0x10051bc
mov dword [0x1015fcc], 0
mov eax, 1
jmp 0x10051c8
call fcn.01005aa0
mov dword [0x1015fcc], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1005a08
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1005a42
xor eax, eax
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003e4b
call fcn.01005aa0
mov dword [0x1015fcc], eax
xor eax, eax
jmp 0x1005a50
lea eax, [esp]
push 2
push 2
push eax
call fcn.010051cf
add esp, 0x104
ret

Function at 0x1005ac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, 1
push dword [ebp - 4]
push 0x1001388
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x20]
push 0xa
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1005b5d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1005b46
mov eax, dword [edi]
mov ecx, dword [edi + 4]
lea ebx, [edi + 8]
mov dword [ebp - 8], eax
push ebx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebx + eax + 1]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [ebp + 8]
test eax, eax
je 0x1005b54
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
jmp 0x1005ad5
mov dword [0x1015fcc], 0x80070714
xor esi, esi
jmp 0x1005b5d
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005c49
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x1015774
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea ecx, [ebp - 0x104]
push ecx
call fcn.010027e1
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1005c9c
test al, 0x10
jne 0x1005c9c
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x1005ca5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret 4
Function at 0x1005cab
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013e0
push 0x1006ff0
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x10106ac], eax
xor eax, eax
mov al, byte [0x10106ad]
mov dword [0x10106b8], eax
mov eax, dword [0x10106ac]
shr dword [0x10106ac], 0x10
and eax, 0xff
mov dword [0x10106b4], eax
shl eax, 8
add eax, dword [0x10106b8]
mov dword [0x10106b0], eax
call fcn.01006fc4
call fcn.01006ee6
test eax, eax
jne 0x1005d24
push 0x10
call fcn.01005e3c
add esp, 4
xor esi, esi
mov dword [ebp - 4], esi
call fcn.01006d16
call fcn.01006d0b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x101783c], eax
call fcn.01006923
mov dword [0x1010474], eax
cmp eax, esi
je 0x1005d54
cmp dword [0x101783c], esi
jne 0x1005d5e
push 0xffffffffffffffff
call fcn.01006220
add esp, 4
call fcn.010066bf
call fcn.010065d0
call fcn.010061f0
mov esi, dword [0x101783c]
mov al, byte [esi]
cmp al, 0x22
je 0x1005d85
cmp al, 0x20
jbe 0x1005dad
inc esi
cmp byte [esi], 0x20
ja 0x1005d7d
jmp 0x1005dad
inc esi
cmp byte [esi], 0x22
je 0x1005dac
cmp byte [esi], 0
je 0x1005da7
movzx eax, byte [esi]
push eax
call fcn.01006588
add esp, 4
test eax, eax
je 0x1005da1
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x1005d8b
cmp byte [esi], 0x22
jne 0x1005dad
inc esi
cmp byte [esi], 0
je 0x1005dbd
cmp byte [esi], 0x20
ja 0x1005dbd
inc esi
cmp byte [esi], 0
jne 0x1005db2
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x40], 1
je 0x1005ddd
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x24], eax
jmp 0x1005de4
mov dword [ebp - 0x24], 0xa
push dword [ebp - 0x24]
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.01006220
jmp 0x1005e22
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1006242
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.010062f1
cmp dword [0x10106e8], 1
jne 0x1006265
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10106e4], 1
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 0x10]
mov byte [0x10106e0], bl
jne 0x10062bd
cmp dword [0x1017838], 0
je 0x10062ab
mov esi, dword [0x1017830]
sub esi, 4
cmp dword [0x1017838], esi
ja 0x10062ab
mov eax, dword [esi]
test eax, eax
je 0x10062a0
call eax
sub esi, 4
cmp dword [0x1017838], esi
jbe 0x1006298
push 0x100101c
push 0x1001014
call fcn.01006307
add esp, 8
push 0x1001024
push 0x1001020
call fcn.01006307
add esp, 8
test ebx, ebx
je 0x10062da
call fcn.010062fc
jmp 0x10062ed
push dword [ebp + 8]
mov dword [0x10106e8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
pop ebp
ret