joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417596
Capabilities:
Delete registry value
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push 0x439088
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x4175bd
xor eax, eax
leave
ret
push esi
mov esi, dword [sym.imp.advapi32.dll_RegDeleteValueA]
push 0x4390b0
push dword [ebp - 4]
call esi
push str.InstallOptions
push dword [ebp - 4]
call esi
push str.UpdateDescription
push dword [ebp - 4]
call esi
push str.UpdateTitle1
push dword [ebp - 4]
call esi
push str.UpdateTitle2
push dword [ebp - 4]
call esi
push str.UpdateMoreInfoUrl
push dword [ebp - 4]
call esi
push str.BalloonTitle
push dword [ebp - 4]
call esi
push str.BalloonTip
push dword [ebp - 4]
call esi
push str.DlgCaption
push dword [ebp - 4]
call esi
push str.MoreInfoTxt
push dword [ebp - 4]
call esi
push str.PreDownld
push dword [ebp - 4]
call esi
push str.UrlInfo
push dword [ebp - 4]
call esi
push str.NumTries
push dword [ebp - 4]
call esi
push str.LastUDCheckTime
push dword [ebp - 4]
call esi
push str.VersionXmlChecksum
push dword [ebp - 4]
call esi
push 0x439190
push dword [ebp - 4]
call esi
call fcn.0041d31d
test eax, eax
je 0x417677
push str.TransferJobID
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x41974f
Capabilities:
Delete file
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, 0x400
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.0041d31d
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x419782
lea eax, [ebp - 0x41c]
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0041d31d
pop ecx
test eax, eax
je 0x4197ab
lea eax, [ebp - 0x41c]
push eax
push eax
call fcn.0041d31d
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
call esi
call fcn.0041d31d
xor esi, esi
push esi
push str.PreDownldStatus
push esi
call fcn.0041d31d
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyA]
add esp, 0xc
push edi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 4], esi
push esi
mov esi, SysStringLen
jmp 0x41984c
inc dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 0x41c]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0041d31d
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x419834
push 0x2001f
push 0x439050
push dword [ebp - 0x1c]
call fcn.0041d31d
test eax, eax
jne 0x419831
push str.VersionXmlURL
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x10]
call fcn.0040a137
lea ecx, [ebp - 0x1c]
call fcn.0040a137
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 4]
push esi
call ebx
test eax, eax
je 0x4197da
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a6a5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4470e0], 0
push esi
push edi
jne 0x41a61b
call fcn.0041a587
test eax, eax
je 0x41a660
mov eax, dword [0x4470e0]
cmp eax, 1
jne 0x41a63c
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x41a660
jmp 0x41a6a2
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41a6a2
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41a664
xor eax, eax
jmp 0x41a6a2
mov eax, dword [esi]
push dword [0x4470e0]
call edi
mov edi, eax
test edi, edi
je 0x41a686
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x41a6a2
lea edi, [esi + 0xff0]
push esi
push dword [0x4470e0]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41a68c
mov eax, esi
pop edi
pop esi
ret
jmp 0x41a607
Function at 0x41d31d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x41d32c
pop dword [ebp - 0x24]
mov eax, 0x90dac515
sub eax, 0x9098f1e9
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x43154
push 0
mov eax, 0x2a0d3855
add eax, 0xd63608eb
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x91a381f2
sub ecx, 0x91a33805
mov edx, eax
mov ebx, 0x73fa0426
sub ebx, 0x73b20e26
add ebx, dword [ebp - 0x24]
mov edi, 0x794864c8
add edi, 0x897ce064
sub dword [ebp - 0xc], 0x6e08eb11
mov esi, dword [ebx]
xor dword [ebp - 0x14], edx
xor esi, edi
xor dword [ebp - 4], 0xfa96e34f
mov dword [edx], esi
add edx, 4
add ebx, 4
loop 0x41d38b
add eax, 0x66eb080
add eax, 0xf9926a07
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x42208d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445e00]
jne 0x422097
repz ret
jmp fcn.004281f4
Function at 0x1000f505
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f514
pop dword [ebp - 0x28]
mov eax, 0x92483d8b
sub eax, 0x82474877
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3a4e9
push 0
mov eax, 0x48e493d9
add eax, 0xc71ccd67
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xabafed60
add ecx, 0x54505b2f
xor edx, edx
add edx, eax
mov esi, 0x8d08919c
sub esi, 0x7d064d9c
add esi, dword [ebp - 0x28]
mov ebx, 0x81547733
sub ebx, 0xdd0f8daf
mov dword [ebp - 4], 0x1e1ddd7
mov edi, dword [esi]
xor dword [ebp - 0x14], eax
xor edi, ebx
mov dword [edx], edi
sub dword [ebp - 0x18], ecx
add edx, 0x126fdc3a
add edx, 0xed9023ca
add esi, 0xa89039dc
sub esi, 0xa89039d8
loop 0x1000f575
add eax, 0x81c428ca
add eax, 0x7e3cec45
mov ebx, eax
add eax, 5
mov ecx, 0x9038b474
sub ecx, 0x8038b474
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0xf77201bd
sub eax, 0xf731e557
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x86e56546
sub dword [ebp - 0x44], 0x38931ffb
mov dword [ebp - 0x40], 0x562f2adb
sub dword [ebp - 0x40], 0x23fbde96
mov dword [ebp - 0x3c], 0xc0bede70
sub dword [ebp - 0x3c], 0x74729a42
mov dword [ebp - 0x38], 0x66ded31d
sub dword [ebp - 0x38], 0x66ded31d
lea eax, [ebp - 0x44]
push eax
mov eax, 0x68cddd61
add eax, 0x977252f3
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x834c6865
sub dword [ebp - 0x44], 0xed9ff0f
mov dword [ebp - 0x40], 0x7cd10872
sub dword [ebp - 0x40], 0x3b64a6fd
mov dword [ebp - 0x3c], 0x6f7c66c7
add dword [ebp - 0x3c], 0xf3f305a5
mov dword [ebp - 0x38], 0xe75362bc
add dword [ebp - 0x38], 0x18ac9d44
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x4cb5ac60
add eax, 0xb38a83cc
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36e86
push 0
call eax
mov ecx, 0xb3df1e1f
sub ecx, 0xb3ded46a
mov ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x34]
mov edi, 0xa2a66c80
xor dword [ebp - 0x10], ebx
mov edx, dword [esi]
add dword [ebp - 0xc], eax
add edx, edi
add dword [ebp - 0x18], ecx
mov dword [ebx], edx
mov dword [ebp - 0x1c], 0x2c4eac65
add ebx, 0x1070b768
sub ebx, 0x1070b764
add esi, 4
loop 0x401d7c
add eax, 0x119a7
xor ebx, ebx
add ebx, eax
add eax, 0x773b17e
sub eax, 0x773b179
mov ecx, 0xa03279f4
sub ecx, 0x9ff279f4
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4034c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4034d2
pop dword [ebp - 0x50]
mov eax, 0xf2c35aff
add eax, 0xd7cd9d3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd3494b1e
sub dword [ebp - 0x60], 0x84f705d3
mov dword [ebp - 0x5c], 0xb93d94e6
add dword [ebp - 0x5c], 0x78f5b75f
mov dword [ebp - 0x58], 0x71a914aa
add dword [ebp - 0x58], 0xdaa32f84
mov dword [ebp - 0x54], 0x9871ab80
sub dword [ebp - 0x54], 0x9871ab80
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xab384c14
sub dword [ebp - 0x60], 0x36c5e2be
mov dword [ebp - 0x5c], 0x35af6ef5
sub dword [ebp - 0x5c], 0xf4430d80
mov dword [ebp - 0x58], 0xdc42fd0f
sub dword [ebp - 0x58], 0x78d390a3
mov dword [ebp - 0x54], 0xe93e01c
add dword [ebp - 0x54], 0xf16c1fe4
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x510e0b27
sub eax, 0x50cdcad7
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x34cb0
push 0
call eax
mov ecx, 0x3f9a
mov edx, eax
mov esi, 0x33b3b401
add esi, 0xcc8ccfff
add esi, dword [ebp - 0x50]
mov ebx, 0xe9ecf072
sub dword [ebp - 0x48], ebx
mov edi, dword [esi]
sub dword [ebp - 0x1c], ebx
sub edi, ebx
xor dword [ebp - 0x1c], edx
mov dword [edx], edi
add dword [ebp - 4], ebx
add edx, 4
add esi, 0xc08d835a
sub esi, 0xc08d8356
loop 0x4035e3
add eax, 0xf13b
xor ebx, ebx
add ebx, eax
add eax, 0x1ac58ba0
add eax, 0xe53a7465
mov ecx, 0x77eaf08e
sub ecx, 0x77aaf08e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4104eb
pop dword [ebp - 0x3c]
mov eax, 0x88038707
sub eax, 0x87c2821c
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x400de
push 0
mov eax, 0xfbc275be
add eax, 0x47fdc5a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x74677316
sub ecx, 0x746721eb
xor ebx, ebx
add ebx, eax
mov esi, 0xf73ac417
sub esi, 0xf6f77017
add esi, dword [ebp - 0x3c]
mov edx, 0x63e141df
sub dword [ebp - 0x28], ecx
mov edi, dword [esi]
add dword [ebp - 0x10], esi
xor edi, edx
sub dword [ebp - 0xc], edi
mov dword [ebx], edi
xor dword [ebp - 0x20], ecx
add ebx, 4
add esi, 4
loop 0x410546
add eax, 0x1377f
mov ebx, eax
add eax, 0x882d5cbe
sub eax, 0x882d5cb9
mov ecx, 0x6cffd15a
add ecx, 0x93402ea6
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x1004cb78
test esi, esi
rep stosd dword es:[edi], eax
jne 0x1000102b
pop edi
pop esi
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xf6
jbe 0x10001042
pop edi
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10001053
pop edi
xor eax, eax
pop esi
ret
test al, 1
je 0x1000105c
pop edi
xor eax, eax
pop esi
ret
test al, 0x10
jne 0x10001065
pop edi
xor eax, eax
pop esi
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1004cb78
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x100018d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100018f9
test al, 0x10
je 0x100018f9
push esi
call fcn.1001bbb0
add esp, 4
neg eax
sbb eax, eax
pop esi
and al, 0xa9
add eax, 0x57
ret
mov eax, 0x57
pop esi
ret
Function at 0x10002c10
Capabilities:
Check os version
Create process on windows

Disassembly:
jmp 0x1000da40
sub esp, 0x314
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x44], ebx
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [0x1004c334]
cmp eax, ebx
jne 0x1000da89
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x314
ret
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.1000bd40
add esp, 8
call fcn.1000c760
test eax, eax
je 0x1000db0a
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push edx
rep stosd dword es:[edi], eax
call fcn.1000c7b0
mov eax, dword [esp + 0x20]
add esp, 4
and eax, 0xffff
cmp eax, 6
je 0x1000daf7
cmp eax, 9
je 0x1000dae4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x314
ret
mov ecx, 6
mov esi, str.LibifX64.exe_eFlashStart
lea edi, [esp + 0x118]
jmp 0x1000db6a
mov ecx, 6
mov esi, str.LibifI64.exe_eFlashStart
lea edi, [esp + 0x118]
jmp 0x1000db6a
mov ecx, 0x23
xor eax, eax
lea edi, [esp + 0x8c]
mov dword [esp + 0x84], 0x94
mov dword [esp + 0x88], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x88], 6
jb 0x1000db59
mov ecx, 6
mov esi, str.Libif32.exe_eFlashStart
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
jmp 0x1000db6d
mov ecx, 9
mov esi, str.rundll32.exe_Flash32.dll_eFlashStart
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x220]
push edx
push eax
push ebx
push 0x200
push ebx
push ebx
lea ecx, [esp + 0x134]
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x1000dbbe
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x314
ret

Function at 0x100033a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100033c6
test al, 0x10
je 0x100033c6
test al, 1
jne 0x100033c6
push esi
call fcn.1001d350
add esp, 4
xor eax, eax
pop esi
ret
mov eax, 0x57
pop esi
ret
Function at 0x10003900
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x23
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 4], 0x94
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
push eax
call fcn.1000c6f0
add esp, 4
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x1000398a
cmp dword [esp + 8], 5
jb 0x1000398a
mov eax, dword [0x1004c32c]
test eax, eax
je 0x1000398a
mov ecx, dword [eax]
xor edi, edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
test ecx, ecx
jbe 0x1000397c
push esi
xor esi, esi
mov ecx, dword [esi + eax + 8]
test ecx, ecx
je 0x10003971
push ecx
call ebx
mov eax, dword [0x1004c32c]
mov ecx, dword [eax]
inc edi
add esi, 0x10
cmp edi, ecx
jb 0x10003961
pop esi
push eax
call ebx
mov dword [0x1004c32c], 0
pop ebx
pop edi
add esp, 0x94
ret

Function at 0x10003c10
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1001dcd0
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push 0x10043284
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001dd2b
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.MinimizeDownload
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001dd2b
mov esi, 1
jmp 0x1001dd2d
xor esi, esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
je 0x1001dd4e
mov eax, dword [esp + 4]
test eax, eax
je 0x1001dd4e
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x10003f80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
pop edi
test byte [eax + 4], 2
jne 0x10003fb5
mov eax, 1
add esp, 0x3c
ret
mov ecx, dword [eax]
lea edx, [eax + 0x408]
add eax, 0x52c
push esi
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esi, eax
test esi, esi
je 0x10004008
mov ecx, dword [esp + 0x3c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x3c
ret
Function at 0x10004010
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x44]
mov eax, 1
pop edi
test byte [ecx + 4], al
jne 0x1000404a
mov ecx, dword [esp + 0x44]
mov dword [ecx], eax
add esp, 0x3c
ret
mov edx, dword [ecx]
mov dword [esp + 0x1c], eax
mov dword [esp + 8], edx
lea edx, [ecx + 0x408]
lea eax, [esp]
push esi
add ecx, 0x50c
push eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esi, eax
test esi, esi
je 0x100040aa
mov ecx, dword [esp + 0x3c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x3c
ret
Function at 0x100040c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x4b4
push ebx
push esi
mov esi, dword [esp + 0x4c0]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0xc], 0x94
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x14]
mov dword [esp + 0x10], eax
lea ebx, [ecx + esi + 1]
mov ecx, 0x23
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp byte [esi], 0
jne 0x10004113
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4b4
ret
mov ecx, 0x107
xor eax, eax
lea edi, [esp + 0xa0]
lea edx, [esp + 0x3bc]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0xa0], 0x41d
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x4d4]
not ecx
cmp eax, 5
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
jb 0x100041df
test esi, esi
je 0x100041df
mov ecx, dword [esp + 0x4d8]
mov edx, dword [esp + 0x4c8]
push ecx
push esi
lea eax, [esp + 0xa8]
push edx
push eax
call fcn.10018620
add esp, 0x10
test eax, eax
jne 0x100041b5
pop edi
pop esi
pop ebx
add esp, 0x4b4
ret
mov ecx, dword [esp + 0x4d0]
mov edx, dword [esp + 0x4cc]
push ecx
lea eax, [esp + 0x1bc]
push edx
push eax
call fcn.10017ce0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x4b4
ret
mov ecx, dword [esp + 0x4c8]
lea edx, [esp + 0xa0]
push ecx
push edx
call fcn.10017fd0
add esp, 8
test eax, eax
jne 0x10004205
pop edi
pop esi
pop ebx
add esp, 0x4b4
ret
mov eax, dword [esp + 0x4d0]
mov edi, dword [esp + 0x4cc]
push eax
lea ecx, [esp + 0x1bc]
push edi
push ecx
call fcn.10017ce0
add esp, 0xc
test eax, eax
jne 0x10004233
pop edi
pop esi
pop ebx
add esp, 0x4b4
ret
test esi, esi
je 0x10004255
mov edx, dword [esp + 0x4d8]
mov eax, dword [edx]
push eax
push esi
push edi
call fcn.10015790
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x4b4
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x4b4
ret