joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002068
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push esi
push 0
lea eax, [ebp - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x100778d
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002091
push ebx
sub eax, ecx
push edi
lea edi, [eax + esi + 2]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10077aa
inc esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10077b4
sub edi, eax
push 0x1002020
lea esi, [eax + ebx]
push edi
push esi
call fcn.01002111
push dword [ebp + 8]
dec edi
push edi
inc esi
push esi
call fcn.01002111
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10077b4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor esi, esi
test ebx, ebx
je 0x1002103
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100779e
mov esi, eax
jmp 0x1002105
and eax, 0xffff
or eax, 0x80070000
jmp 0x1007797
mov esi, 0x8007000e
jmp 0x10020f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10077c8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10020f8

Function at 0x100220f
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xffffffff
je 0x10083de
push edi
xor edi, edi
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x10083e8
cmp eax, edi
je 0x1008405
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, edi
je 0x1008419
push 2
pop ecx
cmp ebx, ecx
jne 0x1002289
push 4
pop ecx
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
je 0x1008419
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 8
cmp ebx, 4
jne 0x100840c
jmp 0x100226a
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.01007ab0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01007a65
add esp, 0xc
cld
invalid
invalid
invalid
cld
invalid
Function at 0x100300d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x9c4
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.01005350
test eax, eax
je 0x1006253
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x100625b
push esi
push edi
mov dword [ebp - 0xc], ebx
cmp byte [0x1019001], bl
je 0x100626e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1006262
push edi
push esi
push eax
call fcn.0100502d
add esp, 0xc
push ebx
push dword [ebp - 8]
call fcn.010041bb
xor ecx, ecx
push 4
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
je 0x10062b4
push edi
push dword [ebp - 8]
call fcn.010041bb
mov dword [ebp - 0x10], eax
mov dword [edi + eax*4], ebx
cmp eax, 2
jne 0x10030ef
mov esi, dword [edi + 4]
movzx eax, word [esi]
push 0x2d
pop ecx
cmp cx, ax
je 0x10062c0
push 0x2f
pop ecx
cmp cx, ax
je 0x10062c0
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.01003134
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x1003108
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.010056db
cmp dword [ebp - 4], ebx
pop edi
pop esi
jl 0x1006317
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret 0x10
xor eax, eax
inc eax
jmp 0x100312a
call fcn.010056db
jmp 0x1006253
mov dword [ebp - 4], 0x8007000e
jmp 0x1003111
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
mov edi, eax
push edi
push ebx
push ebx
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1006262
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
jmp 0x1003094
mov dword [ebp - 4], 0x8007000e
jmp 0x10030fd
push 0xffffffffffffffff
inc esi
push 0x1006350
inc esi
push esi
call fcn.01001b8c
test eax, eax
jne 0x10062da
call fcn.0100d191
jmp 0x100630f
push 0xffffffffffffffff
push 0x1006338
push esi
call fcn.01001b8c
test eax, eax
jne 0x10062f2
call fcn.0100d87f
jmp 0x100630f
push 0xffffffffffffffff
push 0x1006324
push esi
call fcn.01001b8c
test eax, eax
jne 0x10030ef
push dword [ebp + 8]
call fcn.0100d04c
mov dword [ebp - 4], eax
jmp 0x10030fd
mov dword [ebp - 0xc], 1
jmp 0x1003127
Function at 0x10038b5
Capabilities:
Inspect section memory permissions
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1019001], bl
je 0x1008181
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x14]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0100394f
test eax, eax
jl 0x1008156
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1008160
cmp dword [ebp - 0xc], 1
jne 0x1008175
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x1008156
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0x10
or al, 0xeb
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x1008177
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1008195
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10081f3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10081da
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10081e3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10081ed
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10081cf
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1008159
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1008240
dec eax
je 0x1008237
sub eax, 3
je 0x100822e
mov dword [ebp - 4], 0x40
jmp 0x100825d
mov dword [ebp - 4], 4
jmp 0x1008243
mov dword [ebp - 4], 0x20
jmp 0x1008243
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100828f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100820f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.01007aa0
insb byte es:[edi], dx
ret
Function at 0x10040d0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push ebx
cmp byte [0x1019001], bl
je 0x10080fd
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10080e8
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0x10
cmp dword [eax], ebx
je 0x1008154
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100814f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1008139
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1008141
cmp edx, ebx
jne 0x100828f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1008110
add eax, dword [eax + 4]
jmp 0x10080fd
mov dword [ebp + 0xc], ebx
jmp 0x100815f

Function at 0x1004369
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0xc04]
cmp dword [ebp - 0xc08], ebx
jbe 0x1004349
cmp dword [ebp - 0xc08], 2
ja 0x10083b8
push 0xffffffffffffffff
push 0x1004360
lea eax, [ebp - 0xc04]
push eax
mov byte [esi], 1
call fcn.01001b8c
test eax, eax
je 0x1004345
push 0xffffffffffffffff
push 0x1003d68
lea eax, [ebp - 0xc04]
push eax
call fcn.01001b8c
test eax, eax
je 0x1004345
push 0xffffffffffffffff
push 0x1004354
lea eax, [ebp - 0xc04]
push eax
call fcn.01001b8c
test eax, eax
je 0x1004345
mov byte [esi], 1
xor eax, eax
jmp 0x10043e0
mov byte [esi], bl
jmp 0x100433e
mov eax, 0x80040153
jmp 0x10043e0
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xc1c], esi
cmp byte [0x1019001], bl
je 0x10082b7
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push ebx
push edi
push eax
mov dword [ebp - 0xc0c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10042d8
jle 0x10043e0
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0xc
invalid
invalid
Function at 0x1004951
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], 4
cmp byte [0x1019001], bl
je 0x1008232
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x100829a
jle 0x10049a7
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0xc
add byte [eax], al
add bl, ch
or al, 0xc7
inc ebp
cld
and byte [eax], al
add byte [eax], al
rcr byte [edi + 0x5e], 0x5b

Function at 0x1004b39
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [eax], ebx
push edi
cmp byte [0x1019001], bl
je 0x100642d
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x1004bd0
call fcn.010043f7
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1004bd0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1004bdc
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1004bd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006416
cmp eax, ebx
jle 0x1004bbc
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004bbc
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x1004bd0
call fcn.010043f7
mov dword [ebp - 8], esp
cmp esp, ebx
jne 0x1006460
mov eax, 0x8007000e
jmp 0x1004bbc
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x1004bd0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x1004bd0
call fcn.010043f7
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1004bd0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1002020
push edi
call sub.VERSION.dll_VerQueryValueA
jmp 0x1004ba3
Function at 0x1005127
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x10051a3
mov ecx, eax
call fcn.010051b3
mov esi, eax
cmp esi, ebx
je 0x1007b98
xor eax, eax
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
jg 0x1007ba2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0xc
mov dword [ebp - 0xc], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x10051a7
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jg 0x1007bbf
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor esi, esi
xor edi, edi
test esi, esi
jne 0x1007c26
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
xor esi, esi
jmp 0x1005149
mov edi, 0x8007000e
jmp 0x1005192
jbe 0x1007c12
test esi, esi
je 0x1007c33
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
inc ebp
in al, dx
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x1007c42
and dword [ebp - 4], 0
daa
retf 0x468b
xor ebx, ebx
mov dword [ebp - 0x10], edi

Function at 0x1005350
Capabilities:
Check os version

Disassembly:
push 0xa0
push 0x1005420
call fcn.0100413d
mov esi, dword [ebp + 0xc]
mov dword [0x1019024], esi
mov eax, dword [ebp + 8]
mov dword [0x1019018], eax
xor edi, edi
mov dword [ebp - 4], edi
push 0x101902c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1005418
cmp dword [ebp - 0xac], 6
sbb al, al
inc al
mov byte [section..data], al
call fcn.01003fd5
mov dword [0x101901c], eax
cmp dword [ebp - 0xa0], 2
jne 0x10053fa
mov byte [0x1019001], 1
cmp dword [ebp - 0xac], 5
jb 0x10053de
mov byte [0x1019002], 1
je 0x100540d
cmp dword [ebp - 0xac], 6
jb 0x10053fa
cmp esi, 0x7d0
je 0x1007f51
mov byte [0x1019020], 1
xor eax, eax
cmp dword [0x1019018], edi
setne al
call fcn.0100543c
ret 8
cmp dword [ebp - 0xa8], 1
jb 0x10053de
jmp 0x10053e7
xor eax, eax
jmp 0x1005405
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x1007ae0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1007b1b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1007b02
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1007b13
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1007b1d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1007af8
xor eax, eax
pop edi
pop esi
ret
Function at 0x101575f
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1019004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1019001], bl
je 0x101579b
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1015915
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10157d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1015917
and eax, 0xffff
or eax, 0x80070000
jmp 0x1015917
call fcn.010043f7
mov dword [ebp - 0x18], esp
cmp esp, ebx
jne 0x10157ea
mov eax, 0x8007000e
jmp 0x1015917
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10157b7
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10157b7
call fcn.010043f7
mov dword [ebp - 0x14], esp
cmp esp, ebx
je 0x10157e0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x14]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10157b7
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10157b7
call fcn.010043f7
mov dword [ebp - 0x10], esp
cmp esp, ebx
je 0x10157e0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x10157b7
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10158ba
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10157b7
call fcn.010043f7
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x10157e0
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x1c]
push ebx
push ebx
call esi
test eax, eax
je 0x10157b7
jmp 0x10158d1
push 4
pop eax
call fcn.0100440a
mov eax, esp
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10157e0
mov byte [eax], bl
mov esi, dword [ebp + 0x18]
lea eax, [esi + 1]
call fcn.010043f7
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x10157e0
push dword [ebp - 0x18]
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10157b7
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001375
leave
ret 0x18
Function at 0x4016bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push str.LocalService
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40172a
cmp dword [ebp - 4], 1
je 0x4016ff
cmp dword [ebp - 4], 2
jne 0x40171a
mov ecx, dword [ebp - 8]
test esi, esi
je 0x401724
test ecx, ecx
je 0x40171f
test cl, 1
jne 0x40171a
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x401724
push 0xd
pop eax
jmp 0x40172a
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x403053
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40308b
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
test byte [0xfffffc6c], al
test byte [0xfffffc6c], al
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x403035
call fcn.00401c35
inc esi
jno 0x4030d9
add byte [eax - 0x72b5b], 0xff
add byte [eax - 0x72a5b], al
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00401c35
stosd dword es:[edi], eax
mov edi, 0x858de60d
aam 0xf8
invalid

Function at 0x403940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00401c45
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00401ba6
add esp, 0xc
jmp 0x403bad