joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102b218
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b24e
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x102b369
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x102b364
mov esi, dword [ebp + 0x14]
cmp esi, ecx
je 0x102b364
mov ebx, dword [ebp + 0x24]
cmp ebx, ecx
jne 0x102b274
cmp dword [ebp + 0x20], ecx
jne 0x102b364
cmp dword [ebp + 0x1c], ecx
mov dword [ebp - 8], ecx
jne 0x102b282
lea eax, [ebp - 8]
mov dword [ebp + 0x1c], eax
cmp ebx, ecx
mov eax, dword [esi]
mov dword [ebp - 4], eax
je 0x102b28d
mov ecx, dword [ebx]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp + 0x24], ecx
call fcn.01016610
mov edi, esp
push ebx
push dword [ebp + 0x20]
lea eax, [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x102b35f
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
inc eax
cmp ecx, eax
jae 0x102b2cf
mov eax, ecx
push 0xffffffffffffffff
push eax
push edi
push dword [ebp + 0x10]
call fcn.01028b22
dec eax
cmp dword [ebp + 0x20], 0
mov dword [esi], eax
je 0x102b346
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x102b35f
cmp eax, 2
jbe 0x102b300
cmp eax, 7
jne 0x102b35f
mov dword [ebp + 0x14], 0x80004005
jmp 0x102b35f
mov esi, dword [ebx]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edx, esp
mov ecx, esi
mov esi, dword [ebp + 0x20]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx]
shr eax, 1
push eax
push edx
push dword [ebp + 0x20]
call fcn.01028b22
shl eax, 1
mov dword [ebx], eax
jne 0x102b35f
mov dword [ebp + 0x14], 0xea
jmp 0x102b35f
test ebx, ebx
je 0x102b35f
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
test eax, eax
jbe 0x102b35f
cmp eax, 2
jbe 0x102b35d
cmp eax, 7
jne 0x102b35f
shl dword [ebx], 1
mov eax, dword [ebp + 0x14]
jmp 0x102b369
mov eax, 0x80004003
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x20

Function at 0x102b378
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b396
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x102b3dc
cmp dword [ebp + 0xc], 0
jne 0x102b3a3
mov eax, 0x3f2
jmp 0x102b3dc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01028afc
neg eax
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8
Function at 0x102b3ea
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b408
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x102b448
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x102b43e
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01028afc
neg eax
sbb eax, eax
and eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x102b4d4
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.0102a3d1
test al, al
je 0x102b4e9
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp + 0xc], 0
je 0x102b509
cmp dword [ebp + 0x10], 0
je 0x102b504
push 4
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x102b509
push 0x57
pop eax
jmp 0x102b53a
push esi
push dword [ebp + 0x34]
mov esi, dword [ebp + 0x2c]
push dword [ebp + 0x30]
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test esi, esi
je 0x102b539
shl dword [esi], 1
pop esi
pop ebp
ret 0x30
Function at 0x102b543
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b571
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x102b665
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x102b5ab
push dword [ebp + 0xc]
call edi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push ebx
call fcn.01028afc
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x102b61d
cmp eax, 2
je 0x102b61d
cmp eax, 7
jne 0x102b614
mov ebx, dword [ebp + 0x18]
xor eax, eax
test ebx, ebx
jne 0x102b5ca
xor ecx, ecx
jmp 0x102b60e
push ebx
call fcn.01028b8b
cmp eax, 0xffffffff
push ebx
jne 0x102b5db
call edi
inc eax
jmp 0x102b5e0
call fcn.01028b8b
lea edi, [eax + eax]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0x18], esp
push ebx
call fcn.01028b8b
push eax
push edi
push ebx
push dword [ebp + 0x18]
call fcn.01028afc
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 0x18]
push eax
push ecx
push 7
jmp 0x102b658
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
jmp 0x102b658
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 0x18], ecx
je 0x102b653
push dword [ebp + 0x18]
call edi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x18]
push ebx
call fcn.01028afc
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, ebx
push eax
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x102b674
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b6a4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x102b7f2
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x102b6af
xor esi, esi
jmp 0x102b6e0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push edi
call fcn.01028afc
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x102b7f2
cmp dword [ebp + 0x18], ebx
mov ecx, dword [ebp - 4]
jne 0x102b73e
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x102b72c
cmp ecx, ebx
jbe 0x102b727
cmp ecx, 2
jbe 0x102b720
cmp ecx, 7
jne 0x102b727
mov edx, dword [ebp - 8]
add edx, edx
jmp 0x102b72a
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x102b7ef
mov dword [eax], ecx
jmp 0x102b7ef
cmp ecx, ebx
jbe 0x102b753
cmp ecx, 2
jbe 0x102b74c
cmp ecx, 7
jne 0x102b753
mov eax, dword [ebp - 8]
add eax, eax
jmp 0x102b756
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x1c]
cmp dword [ebx], eax
jae 0x102b771
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x102b768
mov dword [eax], ecx
mov dword [ebp + 0xc], 0xea
jmp 0x102b7ef
test ecx, ecx
jbe 0x102b7dc
cmp ecx, 2
jbe 0x102b77f
cmp ecx, 7
jne 0x102b7dc
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0x1c], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x102b7ef
cmp dword [ebp - 4], eax
jbe 0x102b7ef
cmp dword [ebp - 4], 2
jbe 0x102b7b9
cmp dword [ebp - 4], 7
jne 0x102b7ef
push dword [ebp - 8]
push dword [ebx]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.01028b22
shl eax, 1
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x102b7ef
mov ecx, dword [ebp - 4]
jmp 0x102b737
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x102b801
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102b81f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x102b862
cmp dword [ebp + 8], 0
jne 0x102b829
xor eax, eax
jmp 0x102b862
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01028afc
push dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x102bab3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102bae9
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x102bba9
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp esi, ebx
je 0x102bb0e
mov eax, dword [esi]
shl eax, 1
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], eax
je 0x102bb11
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0x14], esp
jmp 0x102bb14
mov dword [ebp - 4], ebx
mov dword [ebp + 0x14], ebx
mov edi, dword [ebp + 0x20]
cmp edi, ebx
je 0x102bb37
mov eax, dword [edi]
shl eax, 1
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 8], eax
je 0x102bb3a
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0x20], esp
jmp 0x102bb3d
mov dword [ebp - 8], ebx
mov dword [ebp + 0x20], ebx
push dword [ebp + 0x24]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 4]
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x102bba9
cmp esi, ebx
je 0x102bb7f
push 0xffffffffffffffff
push dword [esi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.01028b22
cmp dword [ebp - 4], ebx
je 0x102bb7d
cmp eax, ebx
je 0x102bba0
mov dword [esi], eax
cmp edi, ebx
je 0x102bba7
cmp dword [ebp + 0x1c], ebx
je 0x102bba7
push 0xffffffffffffffff
push dword [edi]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.01028b22
cmp dword [ebp - 8], ebx
je 0x102bba5
cmp eax, ebx
jne 0x102bba5
push 0x6f
pop eax
jmp 0x102bba9
mov dword [edi], eax
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x102bcd1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102bcf2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x102bd67
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x102bd0d
cmp dword [ebp + 0xc], esi
je 0x102bd0d
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x102bd67
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x102bd64
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x102bd64
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x102bd4c
mov dword [ebp - 4], eax
jmp 0x102bd64
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01028b22
cmp eax, esi
mov dword [ebp - 4], eax
je 0x102bd64
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x102be9a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x1006054
push 0x1005ecc
call fcn.0102aacf
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x102bebc
pop ebp
jmp eax
pop ebp
jmp fcn.0102bcd1
Function at 0x102bec7
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102bf01
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x102bfc7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
cmp dword [ebp + 8], edi
je 0x102bf3b
push dword [ebp + 8]
call ebx
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov esi, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 8]
push esi
call fcn.01028afc
mov edi, eax
neg edi
sbb edi, edi
and edi, esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x102bf73
push dword [ebp + 0xc]
call ebx
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01028afc
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x24], eax
je 0x102bfa9
push dword [ebp + 0x24]
call ebx
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 8], esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x24]
push dword [ebp + 8]
call fcn.01028afc
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x28

Function at 0x102c0fe
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c11f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x102c194
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x102c13a
cmp dword [ebp + 0xc], esi
je 0x102c13a
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x102c194
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push esi
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x102c191
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x102c191
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, dword [ebp + 0xc]
jbe 0x102c179
mov dword [ebp - 4], eax
jmp 0x102c191
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.01028b22
cmp eax, esi
mov dword [ebp - 4], eax
je 0x102c191
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x102c1a3
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c1be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x102c1fe
cmp dword [ebp + 8], 0
jne 0x102c1c8
xor eax, eax
jmp 0x102c1fe
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01028afc
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4

Function at 0x102c20c
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c227
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x102c267
cmp dword [ebp + 8], 0
jne 0x102c231
xor eax, eax
jmp 0x102c267
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01028afc
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4
Function at 0x102c275
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c2a4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x102c398
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x102c2b6
and dword [ebp - 4], 0
jmp 0x102c2e4
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01028afc
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x102c318
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.01028afc
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x102c350
push dword [ebp + 0x14]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.01028afc
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x102c386
push dword [ebp + 0x18]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.01028afc
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
push dword [ebp + 0x1c]
push eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x43cda1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43cdcf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43cded
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043cd0b
jmp 0x43cded
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43cded
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043cd0b
test edi, edi
mov eax, edi
jne 0x43cdd7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x566af4]
test ecx, ecx
je 0x43cea0
jmp 0x43cda0
ret 8

Function at 0x45a02a
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
je 0x45a097
cmp byte [ebx], 0
je 0x45a097
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45a04d
push esi
call fcn.0045b048
pop ecx
mov edi, eax
jmp 0x45a04f
xor edi, edi
push ebx
call fcn.0045b048
pop ecx
lea eax, [eax + edi + 1]
test esi, esi
push eax
je 0x45a074
push esi
call fcn.0045b279
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x45a087
push 1
call fcn.0045b186
call fcn.0045aab5
mov esi, eax
pop ecx
test esi, esi
jne 0x45a087
push 1
call fcn.0045b186
lea eax, [esi + edi]
push ebx
push eax
call fcn.0045af58
pop ecx
mov eax, esi
pop ecx
jmp 0x45a09b
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret

Function at 0x45a34a
Capabilities:
Terminate process

Disassembly:
sub esp, 0x190
push 1
push 0x100
call dword [fcn.0040702c]
call dword [fcn.00407028]
lea eax, [esp]
push eax
push 2
call fcn.0045a96a
test eax, eax
push 1
je 0x45a37a
call fcn.0045b186
push 0x401a15
call dword [fcn.00407024]
add esp, 0x190
ret

Function at 0x45a868
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0045a34a
cmp dword [ebp + 8], 1
jle 0x45a889
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call fcn.0045b14e
pop ecx
mov dword [0x408eb0], eax
jmp 0x45a88e
mov eax, dword [0x408eb0]
cmp eax, 0x270f
jg 0x45a89c
cmp eax, 0x1f40
jge 0x45a8a6
mov eax, 0x2000
mov dword [0x408eb0], eax
push esi
push edi
push eax
push 0
call fcn.00459a6c
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
jge 0x45a8c2
push 1
call fcn.0045b186
pop edi
pop esi
call fcn.0045a2e6
push dword [ebp + 8]
call fcn.00459b17
mov edi, eax
pop ecx
test edi, edi
jl 0x45a8c2
push 0x48
call fcn.0045aab5
mov esi, eax
pop ecx
test esi, esi
jne 0x45a8ed
push edi
call fcn.0045a3aa
pop ecx
jmp 0x45a8c2
push 0x48
push 0
push esi
call fcn.0045a9d8
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi], edi
mov eax, dword [0x409244]
push esi
push 0x10000
mov dword [esi + 0x44], eax
push 0x401f18
mov dword [0x409244], esi
call fcn.0045b53d
add esp, 0x18
jmp 0x45a8c2