joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451c04
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45abe4]
cmp dword [eax + 0x30], 0
je 0x451cae
cmp dword [ebx + 0x94], 0
jne 0x451ca8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451b94
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451ca8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451c6e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451ca8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004141b0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451c7d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452810
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452845
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040417c
jmp 0x452852
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040e0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4537b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4537f9
mov eax, esi
call fcn.0043a128
test al, al
je 0x4537f9
mov eax, dword [ebx + 0x84]
call fcn.00439e50
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4537f9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00439e50
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x454ae4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040453c
xor eax, eax
push ebp
push 0x454b62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040454c
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x454b2d
mov eax, dword [ebx + 4]
call fcn.0040454c
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454b69
lea eax, [ebp - 4]
call fcn.0040408c
ret
Function at 0x455b64
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x455d01
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402a54
cmp word [ebx + 0xa2], 0
je 0x455bad
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x455bc1
lea esi, [ebp - 8]
jmp 0x455bc3
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x455bd0
xor edi, edi
jmp 0x455bdd
mov eax, dword [ebx + 0x80]
call fcn.0040454c
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.0040454c
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0045529c
mov eax, dword [ebp - 0x14]
call fcn.0040454c
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.0040454c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040454c
push eax
mov eax, ebx
call fcn.004553d0
push eax
mov eax, ebx
call fcn.004553a4
push eax
mov eax, ebx
call fcn.00455358
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00455168
mov eax, dword [ebp - 0x18]
call fcn.0040454c
push eax
mov eax, dword [ebx + 8]
call fcn.0040454c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x455c66
call fcn.0040cc84
xor edx, edx
push ebp
push 0x455cdf
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x455ca4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x455c9a
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x455cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455ce6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x455d10
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x455d3c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040454c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x455d61
call fcn.0040cc84
xor eax, eax
push ebp
push 0x455d98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x455d81
call fcn.0040cc84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455d9f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x100022f0
Capabilities:
Create service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xfffffffffffffffe
push 0x1000f1e0
push 0x10003d20
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10010030]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000242c
push esi
push esi
push esi
push esi
push esi
push str._SystemRoot_System32_svchost.exe__k_kuaizipupdatesvc
push esi
push 2
push 0x10
push 0xf01ff
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
jne 0x100023be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x100023be
push 0xf01ff
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1000242c
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push edi
push str.SYSTEMCurrentControlSetServices_s
lea edx, [ebp]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [ebp - 0x2c]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100023f0
sub eax, edi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push 0
push str.Description
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1000242c
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10002463
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10002836
add ebp, 0x20c
mov esp, ebp
pop ebp
ret

Function at 0x10002836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10010030]
jne 0x10002840
repz ret
jmp fcn.10003eac
Function at 0x416add
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edx
sbb esi, esi
not esi
and esi, eax
je 0x416b0c
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x416af7
jmp 0x416b0e
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x42a45c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x42a7f6
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x42a80b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42a81d
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.0042ad16
push 0x4790f4
lea eax, [ebp - 0x10]
push eax
call fcn.0043e7a0
int3

Function at 0x433b1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x46138c
call fcn.00428026
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0x80000000
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.004292f3
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x47c0b8], 0x80000000
je 0x433b8b
push dword [0x484334]
call fcn.0042a843
pop ecx
test eax, eax
jne 0x433b90
call fcn.0043000a
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x433bab
cmp eax, 2
je 0x433bab
lock inc dword [eax + 4]
mov ecx, edi
call fcn.004346dc
lea ecx, [edi + 0x3c]
call fcn.00429c1f
cmp byte [ebp + 0xc], 0
je 0x433bec
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x433be6
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x433bd5
jmp 0x433bf4
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.004301f6
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x433c0c
mov ecx, esi
call fcn.00433075
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.00427fef
ret 8
Function at 0x43bcb6
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x48439c], eax
cmp eax, 0xffffffff
je 0x43bcd0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43bce2
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.0042ad16
push 0x4790f4
lea eax, [ebp - 0x10]
push eax
call fcn.0043e7a0
int3

Function at 0x454e3a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00454afa
Function at 0x1003dd6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp byte [0x1016001], bl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xc1c], esi
je 0x10096be
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push ebx
push edi
push eax
mov dword [ebp - 0xc0c], 0x400
call dword [0x1001284]
cmp eax, ebx
je 0x1005786
jle 0x1003e4d
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0xc
lea eax, [ebp - 0xc04]
cmp dword [ebp - 0xc08], ebx
jbe 0x10057f7
cmp dword [ebp - 0xc08], 2
ja 0x10097bf
push 0xffffffffffffffff
push 0x1005810
lea eax, [ebp - 0xc04]
push eax
mov byte [esi], 1
call fcn.01001c30
test eax, eax
je 0x10057f3
push 0xffffffffffffffff
push 0x1005814
lea eax, [ebp - 0xc04]
push eax
call fcn.01001c30
test eax, eax
je 0x10057f3
push 0xffffffffffffffff
push 0x1005804
lea eax, [ebp - 0xc04]
push eax
call fcn.01001c30
test eax, eax
je 0x10057f3
mov byte [esi], 1
xor eax, eax
jmp 0x1003e4d
mov byte [esi], bl
jmp 0x10057ec
mov eax, 0x80040153
jmp 0x1003e4d
cmp edi, ebx
je 0x1009767
mov esi, dword [0x1001134]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0xc18], eax
jne 0x10096ee
call dword [0x1001128]
cmp eax, ebx
jmp 0x1003e41
call fcn.01003e64
mov dword [ebp - 0xc10], esp
push ebx
push ebx
push dword [ebp - 0xc18]
push dword [ebp - 0xc10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x10096e1
mov esi, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc08]
push eax
push ebx
push dword [ebp - 0xc10]
mov edi, 0x400
push dword [ebp - 0xc14]
mov dword [ebp - 0xc0c], edi
call dword [0x10012b0]
cmp eax, ebx
jne 0x1003e41
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
jne 0x100976f
mov eax, 0x80004005
jmp 0x1003e4d
mov dword [ebp - 0xc10], ebx
jmp 0x1009718
cmp dword [ebp - 0xc08], 1
mov byte [ebp + eax - 0x405], bl
je 0x1009793
cmp dword [ebp - 0xc08], 2
je 0x1009793
lea eax, [ebp - 0x404]
jmp 0x100578c
push edi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
call dword [0x100111c]
test eax, eax
je 0x10096e1
mov eax, dword [ebp - 0xc14]
jmp 0x100578c
cmp dword [ebp - 0xc08], 4
jne 0x10057f7
cmp dword [ebp - 0xc0c], 4
jne 0x10057f7
cmp dword [eax], ebx
setne al
mov byte [esi], al
jmp 0x10057ec
Function at 0x1004394
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [eax], ebx
cmp byte [0x1016001], bl
push edi
je 0x1007c61
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.01004607
mov esi, eax
cmp esi, ebx
je 0x100442b
call fcn.01003e64
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.010045fc
test eax, eax
je 0x100442b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1004438
push edi
call fcn.01004a6c
test eax, eax
je 0x100442b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0xc
call dword [0x1001128]
jmp 0x1007c4a
cmp eax, ebx
jle 0x1004417
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004417
mov esi, dword [0x1001134]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x100442b
call fcn.01003e64
cmp esp, ebx
mov dword [ebp - 8], esp
jne 0x1007c94
mov eax, 0x8007000e
jmp 0x1004417
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x100442b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.01013ac0
mov esi, eax
cmp esi, ebx
je 0x100442b
call fcn.01003e64
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.01013ab5
test eax, eax
je 0x100442b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1005b08
push edi
call fcn.01013aaa
jmp 0x10043fe
Function at 0x10044b6
Capabilities:
Access the windows event log
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
je 0x100459c
push esi
push edi
lea eax, [ebp - 0x210]
push eax
mov edi, 0x20019
push edi
mov esi, 0x1003c78
push esi
push 0x80000001
mov dword [ebp - 0x230], 0x100
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
call fcn.01003d7e
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push 0x80000002
call fcn.01003d7e
cmp byte [ebp + 8], bl
jne 0x1007f54
push ebx
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push 0x10045ac
call fcn.01003f41
test al, al
jne 0x1007f8a
push dword [ebp - 0x220]
call dword [fcn.01001210]
cmp dword [ebp - 0x214], ebx
mov esi, dword [fcn.010012c4]
je 0x100458a
push dword [ebp - 0x214]
call esi
cmp dword [ebp - 0x210], ebx
je 0x100459a
push dword [ebp - 0x210]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01001339
leave
ret 8
push 1
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push 0x1008104
call fcn.01003f41
test al, al
je 0x1004568
mov dword [ebp - 0x22c], 0xc0ff03e8
mov dword [ebp - 0x228], 0x10
jmp 0x1007f9e
mov dword [ebp - 0x22c], 0xff03e9
mov dword [ebp - 0x228], 8
push 0x100812c
push ebx
call dword [0x100129c]
mov edi, eax
cmp edi, ebx
je 0x1004568
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [0x10012a0]
test eax, eax
je 0x1008076
mov esi, dword [0x10012a4]
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
call esi
cmp dword [ebp - 0x218], ebx
jbe 0x1008076
cmp dword [ebp - 0x21c], ebx
jbe 0x1008076
push dword [ebp - 0x218]
call fcn.01001be8
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001be8
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push eax
push ebx
call esi
test eax, eax
jne 0x1008076
push dword [ebp - 0x20c]
call fcn.01001bc3
pop ecx
mov dword [ebp - 0x20c], ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.01004929
mov eax, dword [ebp - 0x220]
cmp eax, ebx
jne 0x1008099
mov dword [ebp - 0x238], ebx
xor eax, eax
jmp 0x10080a8
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x234], ebx
inc eax
push ebx
lea ecx, [ebp - 0x238]
push ecx
push ebx
push eax
push dword [ebp - 0x20c]
push dword [ebp - 0x22c]
push ebx
push dword [ebp - 0x228]
push edi
call dword [0x10012a8]
push edi
call dword [0x10012ac]
cmp dword [ebp - 0x20c], ebx
je 0x10080e7
push dword [ebp - 0x20c]
call fcn.01001bc3
pop ecx
cmp dword [ebp - 0x224], ebx
je 0x1004568
push dword [ebp - 0x224]
call fcn.01001bc3
pop ecx
jmp 0x1004568
Function at 0x100506d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
push esi
push edi
mov dword [ebp - 8], 4
je 0x1009639
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x1001284]
cmp eax, ebx
je 0x10096a1
jle 0x10050c3
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x1009681
mov esi, dword [0x1001134]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x1009664
call dword [0x1001128]
cmp eax, ebx
jmp 0x10050b7
call fcn.01003e64
mov dword [ebp - 0xc], esp
push ebx
push ebx
push edi
push dword [ebp - 0xc]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x1009657
jmp 0x1009684
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [0x10012b0]
jmp 0x10050af
cmp dword [ebp - 0x10], 4
jne 0x10096b4
cmp dword [ebp - 8], 4
jne 0x10096b4
xor eax, eax
jmp 0x10050c3
mov eax, 0x80040153
jmp 0x10050c3
Function at 0x10051e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1016008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x1016001], bl
push esi
push edi
je 0x1009588
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x14]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0100527f
test eax, eax
jl 0x100955d
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x1001284]
cmp eax, ebx
jne 0x1009567
cmp dword [ebp - 0xc], 1
jne 0x100957c
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x100955d
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001339
leave
ret 0x10
mov eax, 0x80040153
jmp 0x1005266
jle 0x1005266
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005266
cmp dword [ebp - 0xc], 2
je 0x1005254
jmp 0x100955d
cmp dword [ebp + 0xc], ebx
je 0x10095cd
mov esi, dword [0x1001134]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x10095b0
call dword [0x1001128]
cmp eax, ebx
jmp 0x1009567
call fcn.01003e64
mov dword [ebp - 0x10], esp
push ebx
push ebx
push edi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10095a6
jmp 0x10095d0
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x14]
inc esi
mov eax, esi
call fcn.01003e64
mov edi, esp
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [0x10012b0]
cmp eax, ebx
jne 0x1009567
cmp dword [ebp - 0xc], 1
je 0x100960e
cmp dword [ebp - 0xc], 2
jne 0x100955d
mov eax, dword [ebp - 8]
cmp byte [edi + eax - 1], bl
jne 0x100955d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [0x100111c]
test eax, eax
jne 0x1005264
jmp 0x10095a6

Function at 0x100e723
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100e736
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100e732
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100e757
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100e796
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100e78c
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100e798
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100e77c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret