joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011780
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3d44
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x100d40f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x100117b7
mov eax, dword [esi]
jmp 0x100117b9
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
push eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001181e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1001180a
cmp dword [esi + 0x14], 8
jb 0x100117ee
mov esi, dword [esi]
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push esi
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001181e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x28]
call fcn.10014d40
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10011905
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
je 0x10011905
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 2
push 0
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x40]
call fcn.10014d50
add esp, 4
mov edi, dword [ebp - 0x40]
test edi, edi
jne 0x1001188b
xor bl, bl
jmp 0x100118f5
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.10014d50
add esp, 4
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x34]
test esi, esi
jne 0x100118c6
xor bl, bl
jmp 0x100118e7
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx + 0x24]
test ecx, ecx
jne 0x100118d8
call fcn.1005c82d
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x14]
push edx
call dword [eax + 8]
mov bl, 1
mov byte [ebp - 4], 6
cmp byte [ebp - 0x2c], 0
je 0x100118f5
push esi
call dword [ebp - 0x30]
mov byte [ebp - 4], 7
cmp byte [ebp - 0x38], 0
je 0x10011907
push edi
call dword [ebp - 0x3c]
jmp 0x10011907
xor bl, bl
cmp byte [ebp - 0x24], 0
je 0x10011916
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3e08
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100781c0
mov eax, dword fs:[0x2c]
add esp, 0xc
mov edx, dword [0x100d9c78]
mov edi, 0x100da758
mov esi, dword [eax + edx*4]
mov eax, dword [0x100da754]
cmp eax, dword [esi + 4]
jle 0x100120be
push 0x100da754
call fcn.1005eeca
add esp, 4
cmp dword [0x100da754], 0xffffffff
jne 0x100120be
push 0x100be924
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10002700
push 0x100ab0f0
call fcn.1005ed81
push 0x100da754
mov dword [ebp - 4], 0xffffffff
call fcn.1005ee8b
add esp, 8
mov eax, dword [0x100da770]
mov edi, 0x100da774
cmp eax, dword [esi + 4]
jle 0x10012117
push 0x100da770
call fcn.1005eeca
add esp, 4
cmp dword [0x100da770], 0xffffffff
jne 0x10012117
push 0x100be924
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.10002700
push 0x100ab090
call fcn.1005ed81
push 0x100da770
mov dword [ebp - 4], 0xffffffff
call fcn.1005ee8b
add esp, 8
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call esi
cmp word [ebp - 0x218], 0
jne 0x1001213a
xor ecx, ecx
jmp 0x10012152
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012143
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, 0x100da758
push eax
call fcn.10005720
push 0
push 0x19
lea eax, [ebp - 0x218]
push eax
push 0
call esi
cmp word [ebp - 0x218], 0
jne 0x10012181
xor ecx, ecx
jmp 0x1001219f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012190
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.10005720
test bl, bl
mov eax, 0x100da758
cmove edi, eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005e9d4
mov esp, ebp
pop ebp
ret
Function at 0x100121e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3e6a
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x818], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x814], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100d9c78]
mov dword [ebp - 0x81c], esi
mov ebx, dword [eax + ecx*4]
mov eax, dword [0x100da78c]
cmp eax, dword [ebx + 4]
jle 0x10012292
push 0x100da78c
call fcn.1005eeca
add esp, 4
cmp dword [0x100da78c], 0xffffffff
jne 0x10012292
push 0x100be924
mov ecx, 0x100da790
mov dword [ebp - 4], 1
call fcn.10002700
push 0x100ab1b0
call fcn.1005ed81
push 0x100da78c
mov byte [ebp - 4], 0
call fcn.1005ee8b
add esp, 8
mov eax, dword [0x100da7a8]
cmp eax, dword [ebx + 4]
jle 0x100122e6
push 0x100da7a8
call fcn.1005eeca
add esp, 4
cmp dword [0x100da7a8], 0xffffffff
jne 0x100122e6
push 0x100be924
mov ecx, 0x100da7ac
mov dword [ebp - 4], 2
call fcn.10002700
push 0x100ab150
call fcn.1005ed81
push 0x100da7a8
mov byte [ebp - 4], 0
call fcn.1005ee8b
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x1001230c
mov eax, dword [esi]
jmp 0x1001230e
mov eax, esi
xor ecx, ecx
push ecx
mov word [eax], cx
mov ecx, esi
push 0x100be924
call fcn.10005720
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x814], 1
call fcn.100781c0
add esp, 0xc
sub edi, 1
je 0x100123a7
sub edi, 1
jne 0x10012419
cmp dword [0x100da7a0], edi
jne 0x10012401
push edi
push 0x1c
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x810], di
jne 0x10012385
xor ecx, ecx
push ecx
mov ecx, 0x100da790
jmp 0x100123f5
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012390
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, 0x100da790
jmp 0x100123f5
cmp dword [0x100da7bc], 0
jne 0x10012401
push 0
push 0x23
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x810], 0
jne 0x100123d1
xor ecx, ecx
jmp 0x100123ef
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100123e0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, 0x100da7ac
lea eax, [ebp - 0x810]
push eax
call fcn.10005720
cmp esi, 0x100da7ac
je 0x10012419
push 0xffffffffffffffff
push 0
push 0x100da7ac
mov ecx, esi
call fcn.10006240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005e9d4
mov esp, ebp
pop ebp
ret
Function at 0x10012440
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c9e48
push 0x100788c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d40f8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
test ebx, ebx
je 0x100125f0
mov dword [ebp - 0x20], 0
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10012490
sub esi, ecx
sar esi, 1
mov dword [ebp - 4], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10087efa
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x100125e9
push ebx
lea edx, [esi + 1]
mov ecx, edi
call fcn.1000f500
mov esi, edi
mov dword [ebp - 0x1c], esi
cmp word [edi], 0x5c
jne 0x10012535
cmp word [edi + 2], 0x5c
jne 0x10012535
lea esi, [edi + 4]
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
nop dword [eax]
movzx eax, word [esi]
test ax, ax
je 0x10012507
cmp eax, 0x5c
je 0x10012507
push esi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x100124f0
cmp word [esi], 0
je 0x10012513
add esi, 2
mov dword [ebp - 0x1c], esi
movzx eax, word [esi]
test ax, ax
je 0x10012527
cmp eax, 0x5c
je 0x10012527
push esi
call ebx
mov esi, eax
jmp 0x10012510
cmp word [esi], 0
je 0x10012560
add esi, 2
mov dword [ebp - 0x1c], esi
jmp 0x10012560
cmp word [edi + 2], 0x3a
jne 0x10012555
lea esi, [edi + 4]
mov dword [ebp - 0x1c], esi
movzx eax, word [esi]
test ax, ax
je 0x10012555
cmp eax, 0x5c
jne 0x10012555
add esi, 2
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
nop dword [eax + eax]
movzx eax, word [esi]
test ax, ax
je 0x100125b1
cmp eax, 0x5c
jne 0x100125a7
xor eax, eax
mov word [esi], ax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001259b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1001259f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001259f
push edi
jmp 0x100125e1
test al, 0x10
je 0x10012598
mov eax, 0x5c
mov word [esi], ax
push esi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x10012560
mov dword [ebp - 4], 0xfffffffe
push edi
call fcn.10080618
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10080618
add esp, 4
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100160e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4323
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x10016206
nop
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.10006240
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x258], 0xffffffff
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
push ebx
push 0xf
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x258], eax
push ecx
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x254], 0x22c
call fcn.1000f030
test eax, eax
je 0x100161bb
push dword [ebp - 0x24c]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100161bb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
mov ecx, dword [ebp - 0x258]
cmp ecx, 0xffffffff
je 0x100161d7
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x258], 0xffffffff
test ebx, ebx
jne 0x10016147
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100161fb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10006390
add esi, 0x18
cmp esi, edi
jne 0x10016120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005e9d4
mov esp, ebp
pop ebp
ret 4
Function at 0x10016230
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4372
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x240], 0
push 0
mov dword [ebp - 0x244], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10017be0
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x240], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10016353
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1001634c
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1001634c
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x224], eax
jne 0x10016330
mov ebx, dword [esi]
lea eax, [ebp - 0x234]
push eax
push dword [ebx + 4]
push ebx
call fcn.10017f90
mov edx, dword [esi + 4]
mov ecx, eax
mov eax, 0x15555554
sub eax, edx
cmp eax, 1
jb 0x10016373
lea eax, [edx + 1]
mov dword [esi + 4], eax
mov dword [ebx + 4], ecx
mov eax, dword [ecx + 4]
mov dword [eax], ecx
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100162f4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005e9d4
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1005c86a
int3

Function at 0x10016380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10016230
mov edi, dword [ebp - 8]
mov esi, dword [edi]
cmp esi, edi
je 0x100163c8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100163be
push 0
push eax
call ebx
mov esi, dword [esi]
cmp esi, edi
jne 0x100163a8
mov edi, dword [ebp - 8]
pop ebx
mov ecx, dword [edi]
mov dword [edi], edi
mov eax, dword [ebp - 8]
mov dword [eax + 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], 0
cmp ecx, eax
je 0x100163f4
mov esi, dword [ecx]
push ecx
call fcn.10055e00
mov eax, dword [ebp - 8]
add esp, 4
mov ecx, esi
cmp esi, eax
jne 0x100163e0
push eax
call fcn.10055e00
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016410
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jbe 0x1001650b
cmp dword [esi + 0x34], 0
jbe 0x1001650b
push ebx
push edi
xor eax, eax
mov dword [ebp - 0x6c], 0
pop edi
mov edx, 0x1b
mov dword [ebp - 0x68], 0x48001b
mov dword [ebp - 0x64], 0x7d0074
mov dword [ebp - 0x60], 0x6c006f
mov dword [ebp - 0x5c], 0x69007a
mov dword [ebp - 0x58], 0x47007e
mov dword [ebp - 0x54], 0x74005f
mov dword [ebp - 0x50], 0x6e005d
mov dword [ebp - 0x4c], 0x470075
mov dword [ebp - 0x48], 0x7a005c
mov dword [ebp - 0x44], 0x7e0076
mov dword [ebp - 0x40], 0x7a004b
mov dword [ebp - 0x3c], 0x73006f
mov word [ebp - 0x38], ax
pop ebx
mov cx, word [ebp + eax*2 - 0x66]
xor cx, dx
mov word [ebp + eax*2 - 0x36], cx
inc eax
cmp eax, 0x17
jae 0x100164ba
mov dx, word [ebp - 0x68]
jmp 0x100164a1
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x36]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1001650b
cmp dword [esi + 0x1c], 8
lea ecx, [esi + 8]
mov eax, dword [esi + 0x18]
jb 0x100164e5
mov ecx, dword [ecx]
add esi, 0x24
cmp dword [esi + 0x14], 8
jb 0x100164f0
mov esi, dword [esi]
add eax, eax
push eax
push ecx
push 1
push 0
push esi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005e9d4
mov esp, ebp
pop ebp
ret

Function at 0x100166e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a43f6
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x100c0970
mov dword [ebp - 0x2a0], 0
jmp 0x100273cb
mov dword [ebp - 0x298], 0
jmp loc.100e0bc0
lea esp, [esp + 4]
test bx, 0x5ecb
cmp dword [esi + 0x34], 0
jmp 0x1001f9aa
Function at 0x10018e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4a0a
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x200], ebx
push 0x100c0a88
mov dword [ebp - 0x204], 0
jmp 0x10019d96
lea esp, [esp + 4]
shr ah, 0x44
mov edx, 0x5b
movzx eax, sp
sbb ah, ch
mov dword [ebp - 0x158], 0x7005b
add ax, bx
mov eax, ebp
cbw
mov dword [ebp - 0x154], 0x2e0009
mov dword [ebp - 0x150], 0x1c0035
setb al
btr eax, ebp
mov dword [ebp - 0x14c], 0x36003a
xchg al, ah
btc ax, bx
mov dword [ebp - 0x148], 0x75003e
mov dword [ebp - 0x144], 0x23003e
mov dword [ebp - 0x140], 0x3e
bsr ax, di
cbw
mov dword [ebp - 4], 0
rol ah, cl
sal ax, cl
btr ax, dx
sub ecx, ecx
bts eax, edi
add ax, bp
btr eax, edi
nop
shl ah, 0xa5
sub al, 0x94
and al, bh
movzx eax, word [ebp + ecx*2 - 0x156]
xor ax, dx
jmp 0x1002dfef
mov word [ebp + ecx*2 - 0x13c], ax
adc ax, 0x6efc
dec al
shr al, cl
movzx eax, word [ebp + ecx*2 - 0x154]
xor ax, word [ebp - 0x158]
stc
mov word [ebp + ecx*2 - 0x13a], ax
cmp edx, esi
movzx eax, bx
rcr ax, 0
movzx eax, word [ebp + ecx*2 - 0x152]
stc
test ch, 0x8e
test ecx, esi
xor ax, word [ebp - 0x158]
cmc
mov word [ebp + ecx*2 - 0x138], ax
xor ax, di
btr eax, 0x23
sub ah, 0xcf
movzx eax, word [ebp + ecx*2 - 0x150]
xor ax, word [ebp - 0x158]
test edi, 0x40560365
stc
cmc
mov word [ebp + ecx*2 - 0x136], ax
clc
movzx eax, word [ebp + ecx*2 - 0x14e]
xor ax, word [ebp - 0x158]
stc
mov word [ebp + ecx*2 - 0x134], ax
sar ax, 0xb1
sal eax, cl
shr eax, 0xc9
movzx eax, word [ebp + ecx*2 - 0x14c]
xor ax, word [ebp - 0x158]
mov word [ebp + ecx*2 - 0x132], ax
cmp ah, al
add ecx, 6
cmp ecx, 0xc
jmp 0x1003380c
jne 0x1003bbfe
sub ecx, edx
neg eax
sar ecx, 1
not ax
movzx ax, bh
xchg ah, al
push ecx
lea eax, [ebp - 0x13c]
bswap cx
push eax
setg ch
lea ecx, [ebp - 0x120]
call fcn.10005720
mov edi, 4
mov dword [ebp - 0x15e], 0x6c0058
sbb dx, 0x72e8
cmp edi, 0x46244000
test di, bx
mov dx, di
test di, 0x336d
cmp cx, 0x4c06
mov dword [ebp - 0x15a], 0x6e0077
cmp bx, bp
cmc
sub eax, eax
cmp ecx, ebp
test ecx, esi
cmp eax, 0x351f10fc
mov word [ebp - 0x160], dx
mov dword [ebp - 0x156], 0x6b0048
mov dword [ebp - 0x152], 0x600065
mov dword [ebp - 0x14e], 0x760061
test edx, edi
mov dword [ebp - 0x14a], 0x61002a
cmc
mov dword [ebp - 0x146], 0x61007c
jmp 0x100eb3c1
jae 0x100f7477
mov dx, word [ebp - 0x158]
jmp 0x1003e78e
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 2]
add ah, 0x1f
mov ax, word [ecx]
lea ecx, [ecx + 2]
clc
test ax, ax
jmp 0x1002f0a7
jmp 0x10019e29
jne 0x1003bbf2
xor ecx, ecx
jmp 0x100f03de
jmp 0x1002f0bc
sub eax, eax
cmc
cmp sp, 0x6a22
cmp edx, ecx
mov dword [ebp - 0x10c], 7
mov word [ebp - 0x124], ax
mov dword [ebp - 0x110], eax
mov word [ebp - 0x120], ax
cmc
stc
cmp word [ebp - 0x13c], ax
jmp 0x100e683a
Function at 0x1001a3d0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4b4b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x134], ebx
push 0x100c0b40
jmp loc.100eece1

Function at 0x1001b000
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4fdd
mov eax, dword fs:[0]
push eax
sub esp, 0x7f4
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
push 0x100c0b74
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x108], 0
jmp 0x100268ed
lea esp, [esp + 4]
mov eax, dword [edi]
movzx ecx, di
mov ecx, edi
call dword [eax + 0xc]
push 0x3e8
jmp 0x1002e3bf
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi]
movzx ecx, ax
bswap cx
jmp loc.100f0388
Function at 0x1001c6f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5075
mov eax, dword fs:[0]
push eax
sub esp, 0x5f4
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5fc], ecx
xor ebx, ebx
push 0x100c0b8c
mov dword [ebp - 0x5f8], ebx
jmp 0x1002c10e
lea esp, [esp + 4]
sub edi, edi
mov edx, ebx
rcl ax, cl
mov dword [ebp - 0x5f4], ebx
mov si, dx
bsr edx, edi
btr edx, 0x8c
mov dword [ebp - 0x5f0], ebx
lea edx, [ebx + 0x52]
mov dword [ebp - 0x5e8], 0x10052
xor si, 0x27fe
bts si, dx
lea esi, [ebx + 0x3e]
mov dword [ebp - 0x5e4], 0x14001d
movzx eax, ax
rcr ax, 0x7d
mov dword [ebp - 0x5e0], 0x50006
bt ax, 0xe8
lahf
mov dword [ebp - 0x5dc], 0x13
and ax, bp
mov dword [ebp - 0x5d8], 0xe0017
clc
mov dword [ebp - 0x5d4], 0x3b001f
mov dword [ebp - 0x5d0], 0x200031
mov dword [ebp - 0x5cc], 0x21003d
movzx eax, bp
rcl ah, cl
test ebx, esi
mov dword [ebp - 0x5c8], 0x34003d
bsf eax, ebp
mov dword [ebp - 0x5c4], 0xe0026
mov dword [ebp - 0x5c0], 0x3b0005
and ax, 0x348d
mov dword [ebp - 0x5bc], 0x36003c
movsx eax, si
inc al
mov dword [ebp - 0x5b8], 0x25003d
cmp dx, bp
mov dword [ebp - 0x5b4], 0xe0021
sub al, 0xc5
mov dword [ebp - 0x5b0], 0x270011
rcl ah, 0x74
mov dword [ebp - 0x5ac], 0x200020
xor ax, 0x736b
bswap ax
clc
mov dword [ebp - 0x5a8], 0x3c0037
mov dword [ebp - 0x5a4], 0x40026
rcl ah, cl
clc
mov dword [ebp - 0x5a0], 0x200037
btc eax, esi
bts ax, dx
mov dword [ebp - 0x59c], 0x3b0021
bt eax, 0x1d
mov dword [ebp - 0x598], 0x3c003d
xor ax, 0x29e8
cbw
cmovg ax, sp
mov dword [ebp - 0x594], 0x7000e
xor eax, eax
cbw
sal al, cl
mov dword [ebp - 0x590], 0x3b003c
mov dword [ebp - 0x58c], 0x21003c
add eax, ecx
mov dword [ebp - 0x588], 0x330026
mov dword [ebp - 0x584], 0x3e003e
cmc
rcl ah, 0x9a
adc eax, ebp
mov dword [ebp - 0x580], 0x82a3000e
cmp bp, 0x349f
shl al, 8
rcr ax, cl
mov dword [ebp - 0x57c], 0x80069696
rcr ah, 0xab
xor ax, di
shrd eax, ecx, 0x86
mov dword [ebp - 0x578], 0x768d
sal ax, cl
mov dword [ebp - 4], edi
xor ecx, ecx
xchg ah, al
movzx eax, word [ebp + ecx*2 - 0x5e6]
xor ax, dx
jmp loc.100e2c63

Function at 0x1001d020
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a50fa
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x100d40f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
push 0x100c0bb0
mov dword [ebp - 0x320], ebx
jmp loc.100e9b7c