joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010eb1
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10489a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
jmp 0x1019e54
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
pop edi
mov dword [esi + 0x510], eax
pop esi
test eax, eax
je 0x1019ec0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1019e75
push 0x1010f40
call fcn.0100164a
xor eax, eax
inc eax
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001b23
leave
ret 4
push edi
push 0x101a0a8
push 0x101a098
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01007913
jmp 0x1010eed
cmp eax, 0x80
jne 0x1019e86
push 0x101a030
jmp 0x1010f27
cmp eax, 0x102
jne 0x1019e9e
push 0x1019fe8
call fcn.0100164a
xor eax, eax
jmp 0x1010f2f
cmp eax, 0xffffffff
jne 0x1019eaa
push 0x1019fa8
jmp 0x1019ec5
push eax
push 0x1019f30
call fcn.0100164a
pop ecx
mov eax, 0x8000ffff
jmp 0x1010f2f
push 0x1019ed8
call fcn.0100164a
mov eax, 0x80004005
jmp 0x1010f2f
Function at 0x101ad44
Capabilities:
Set registry value

Disassembly:
push 0xa
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x118]
push dword [eax + 0x3c]
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
push esi
push ebx
push esi
push esi
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
mov dword [ebp - 0x108], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100a5f9
cmp dword [ebp - 0x108], esi
je 0x100a5f9
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x1009e88
push dword [ebp - 0x108]
call edi
mov eax, dword [ebp - 0x114]
cmp eax, esi
je 0x100a5f1
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x100a5c8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x114]
push 1
push esi
push 0x100cd1c
push dword [ebp - 0x108]
call edi
push dword [ebp - 0x108]
call ebx
push dword [ebp - 0x10c]
call ebx
jmp 0x100a63d
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
mov ebx, 0x20006
push ebx
push esi
push esi
push esi
push 0x100a650
push 0x80000001
call edi
test eax, eax
jne 0x100a63d
cmp dword [ebp - 0x10c], esi
jne 0x101ad8b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001b23
leave
ret 0xc
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10489a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], esi
cmp eax, esi
je 0x100a603
mov dword [eax], esi
jmp 0x100a603
mov eax, dword [ebp - 0x108]
cmp eax, esi
je 0x100a54a
mov ecx, dword [ebp - 0x110]
mov dword [eax], ecx
jmp 0x100a54a
Function at 0x101d291
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x1042460
call fcn.0100798e
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x1c]
xor esi, esi
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x224], 0x104
mov dword [ebp - 0x21c], esi
cmp dword [ebp - 0x220], esi
jl 0x101d389
mov eax, dword [edi]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 0x104
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x101d389
mov eax, dword [ebp - 0x224]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x101d37d
cmp word [ebp + eax*2 - 0x218], si
jne 0x101d37d
mov eax, dword [edi]
push esi
push 0x20019
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0100fbef
cmp eax, esi
jne 0x101d37d
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x228]
call fcn.01010152
mov dword [ebp - 0x220], eax
add dword [ebp - 0x21c], 2
jmp 0x101d2df
lea ecx, [ebp - 0x234]
call fcn.01010bf2
mov eax, dword [ebp - 0x220]
call fcn.010079cb
ret 0x18
Function at 0x10211cb
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x10489a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
or dword [ebp - 0x834], 0xffffffff
push esi
push dword [ebp + 8]
mov dword [ebp - 0x83c], eax
push 0x100a650
push 0x100caf0
lea eax, [ebp - 0x81c]
xor esi, esi
push 0x104
push eax
mov dword [ebp - 0x820], esi
mov dword [ebp - 0x824], esi
call fcn.01007913
add esp, 0x14
cmp eax, esi
mov dword [ebp - 0x830], eax
jl 0x10213be
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x824]
push eax
mov ebx, 0x20019
push ebx
push esi
lea eax, [ebp - 0x81c]
push eax
push 0x80000001
call edi
test eax, eax
je 0x1021265
mov dword [ebp - 0x830], 1
jmp 0x10213bc
mov dword [ebp - 0x828], esi
cmp dword [ebp + 0x14], esi
jbe 0x10213b0
push 0x105
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x828]
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10213b0
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x210]
push 0x100af28
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x102139b
lea eax, [ebp - 0x82c]
push eax
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x824]
mov dword [ebp - 0x82c], esi
call edi
test eax, eax
jne 0x102139b
push 0x3fe
mov word [ebp - 0x610], ax
lea eax, [ebp - 0x60e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push 0x100ac94
push dword [ebp - 0x82c]
mov dword [ebp - 0x838], 0x400
mov dword [ebp - 0x840], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102138f
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x610]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x102136b
cmp dx, si
je 0x1021367
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x102136b
add ecx, 4
add eax, 4
cmp dx, si
jne 0x1021345
xor eax, eax
jmp 0x1021370
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x102138f
mov edx, dword [ebp - 0x820]
mov eax, dword [ebp - 0x834]
mov ecx, dword [ebp - 0x83c]
inc dword [ebp - 0x820]
mov dword [ecx + edx*4], eax
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
inc dword [ebp - 0x828]
cmp dword [ebp - 0x820], eax
jb 0x1021274
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x830]
xor ecx, ebp
pop esi
call fcn.01001b23
leave
ret 0x10
Function at 0x1021534
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x47c
mov eax, 0x1042d64
call fcn.0100798e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x43c], eax
mov dword [eax], ebx
lea eax, [ebp - 0x428]
push eax
push 0x20019
push ebx
push 0x100a650
push 0x80000001
mov dword [ebp - 0x428], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10216e5
cmp dword [ebp - 0x428], ebx
je 0x10216e5
lea eax, [ebp - 0x488]
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x444], 0x10
mov dword [ebp - 0x448], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x434], ebx
push ebx
jmp 0x1021687
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021673
cmp dword [ebp - 0x42c], ebx
je 0x1021673
push 0x105
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 0x430], ebx
push ebx
jmp 0x102165b
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x424]
push 0x100af28
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x1021643
push eax
push dword [ebp - 0x438]
lea ecx, [ebp - 0x488]
call fcn.01012c84
inc dword [ebp - 0x430]
push 0x105
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x430]
push dword [ebp - 0x42c]
call esi
test eax, eax
je 0x1021610
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x434]
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x428]
call esi
cmp eax, ebx
je 0x10215c5
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x448]
push 2
pop eax
xor ecx, ecx
cmp dword [ebp - 0x440], ebx
jbe 0x10216c4
cmp dword [edx + ecx*4], eax
je 0x10216ed
inc ecx
cmp ecx, dword [ebp - 0x440]
jb 0x10216b6
mov ecx, dword [ebp - 0x43c]
or dword [ebp - 4], 0xffffffff
mov dword [ecx], eax
cmp edx, ebx
je 0x10216e5
lea eax, [ebp - 0x488]
cmp edx, eax
je 0x10216e5
push edx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.010079cb
ret 4
inc eax
jmp 0x10216ac
Function at 0x1028bc9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
lea esi, [ecx + 0x2b4]
cmp dword [esi], eax
je 0x1028c32
push edi
xor edi, edi
push edi
mov dword [esi], eax
lea eax, [ebp + 8]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1004d2c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jl 0x1028c31
cmp dword [ebp + 8], edi
je 0x1028c31
push 4
push esi
push 4
push edi
push 0x10067c4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.010015fd
mov ecx, eax
call fcn.0102c871
pop edi
pop esi
pop ebp
ret 4

Function at 0x1028c3c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push edi
xor edi, edi
cmp dword [ecx + 0x2ac], edi
mov dword [ebp - 8], ecx
sete al
mov dword [ebp - 4], edi
mov dword [ecx + 0x2bc], eax
cmp eax, edi
jne 0x1028d2a
push ebx
push esi
xor ebx, ebx
inc ebx
push ebx
push ebx
push edi
lea eax, [ebp - 4]
push eax
mov esi, 0x1028d64
push esi
push dword [ebp + 8]
call fcn.010054ac
test eax, eax
jge 0x1028ce2
cmp dword [ebp + 0xc], 0x80000001
jne 0x1028ce2
lea eax, [ebp + 0xc]
push eax
push ebx
push edi
push esi
push 0x80000002
mov dword [ebp + 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jge 0x1028caa
mov dword [ebp + 0xc], edi
jmp 0x1028cbe
push ebx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
call fcn.010054ac
test eax, eax
jge 0x1028cc1
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp + 0xc], edi
je 0x1028ce2
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
sete al
mov dword [ebx + 0x2bc], eax
cmp eax, edi
je 0x1028d21
mov eax, dword [0x10489ac]
cmp eax, 0x10489ac
je 0x1028d21
test byte [eax + 0x1c], 0x10
je 0x1028d21
push esi
push 0x1028d34
push 0x101cb98
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028317
mov ecx, ebx
call fcn.010170f1
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 8
Function at 0x102cf07
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x104]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
cmp dword [edi + 0x100], esi
jne 0x102cfb3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push esi
push esi
call ebx
push esi
push esi
push esi
push esi
mov dword [edi + 0x11c], eax
call ebx
push esi
push esi
push esi
push esi
mov dword [edi + 0x120], eax
call ebx
lea ebx, [edi + 0x11c]
mov dword [edi + 0x124], eax
cmp dword [ebx], esi
je 0x102cfb2
cmp dword [edi + 0x120], esi
je 0x102cfb2
cmp eax, esi
je 0x102cfb2
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x102c739
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x100], eax
cmp eax, esi
jne 0x102cfb2
push ebx
call fcn.01001b72
lea eax, [edi + 0x120]
push eax
call fcn.01001b72
lea eax, [edi + 0x124]
push eax
call fcn.01001b72
pop ebx
push dword [ebp - 8]
xor eax, eax
cmp dword [edi + 0x100], esi
setne al
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x102d609
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x16c], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x170], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x174], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x178], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x17c], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x180], eax
call ebx
mov dword [esi + 0x184], eax
cmp dword [esi + 0x16c], edi
je 0x102d6e0
cmp dword [esi + 0x170], edi
je 0x102d6e0
cmp dword [esi + 0x174], edi
je 0x102d6e0
cmp dword [esi + 0x178], edi
je 0x102d6e0
cmp dword [esi + 0x17c], edi
je 0x102d6e0
cmp dword [esi + 0x180], edi
je 0x102d6e0
cmp eax, edi
je 0x102d6e0
lea eax, [esi + 0x168]
push eax
push edi
push esi
push 0x1001cdb
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x164], eax
cmp eax, edi
je 0x102d6d9
push 0xffffffffffffffff
push dword [esi + 0x16c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x1d0], edi
jne 0x102d6e0
mov ecx, esi
call fcn.0101476c
xor eax, eax
cmp dword [esi + 0x164], edi
pop edi
pop esi
setne al
pop ebx
ret
Function at 0x102d7bf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10489a8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x410]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x102d9c0
push 0x80000002
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x410], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x102d810
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
jl 0x102d9ae
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push esi
mov dword [ebp - 0x414], edi
xor eax, eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x414]
mov dword [ebp - 0x424], 0x101
push dword [ebp - 0x410]
mov dword [ebp - 0x41c], 0x201
mov dword [ebp - 0x420], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
jle 0x102d88b
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
mov dword [ebp - 0x418], eax
jl 0x102d98e
cmp dword [ebp - 0x420], 1
jne 0x102d98e
mov eax, dword [ebp - 0x41c]
cmp eax, edi
jbe 0x102d98e
mov ecx, dword [ebp - 0x424]
cmp ecx, edi
jbe 0x102d98e
test al, 1
jne 0x102d98e
xor edx, edx
cmp dx, word [ebp + ecx*2 - 0x40c]
jne 0x102d98e
shr eax, 1
dec eax
mov esi, eax
xor eax, eax
cmp ax, word [ebp + esi*2 - 0x208]
jne 0x102d98e
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x102d8f8
sub eax, edx
sar eax, 1
cmp eax, esi
jne 0x102d98e
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, edi
je 0x102d923
mov ecx, eax
call fcn.0102b790
mov edi, eax
test edi, edi
je 0x102d98c
lea eax, [ebp - 0x208]
push 0x7c
push eax
call ebx
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x102d953
xor eax, eax
mov word [esi], ax
inc esi
inc esi
push 0x7c
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x102d958
xor ecx, ecx
mov word [eax], cx
jmp 0x102d958
mov esi, 0x102d9bc
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x40c]
push eax
mov ecx, edi
call fcn.0102cb55
mov ecx, dword [ebp - 0x428]
push 1
push edi
add ecx, 0x20
call fcn.0102d52e
test eax, eax
jge 0x102d98c
push 1
mov ecx, edi
call fcn.0102d2db
xor edi, edi
inc dword [ebp - 0x414]
cmp dword [ebp - 0x418], edi
jge 0x102d824
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01001b23
leave
ret
Function at 0x10311c6
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10489a8]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x10492b0], 1
push ebx
push esi
push edi
jne 0x10311f5
or dword [0x10492b0], 1
call fcn.01031165
mov dword [0x10492ac], eax
push 4
pop eax
call fcn.010154b7
mov esi, esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1031217
xor eax, eax
jmp 0x10312d4
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x1049260]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x1031210
cmp eax, 1
je 0x10312b5
mov dword [ebp - 8], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1031210
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
test dword [ebp - 0x1c], ebx
je 0x103125e
test dword [ebp - 0x18], 0x100
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
je 0x1031290
xor eax, eax
inc eax
jmp 0x10312d4
cmp edi, eax
jb 0x1031210
cmp eax, esi
jae 0x103129f
mov dword [ebp - 8], esi
push 4
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1049260]
jmp 0x10312b8
mov dword [ebp - 8], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0x10]
push ecx
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001b23
leave
ret

Function at 0x103143f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
xor eax, eax
lea esi, [ecx + 0x2c0]
cmp dword [esi], edi
push edi
sete al
mov dword [ebp - 4], edi
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1004d2c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jl 0x103149f
cmp dword [ebp - 4], edi
je 0x103149f
push 4
push esi
push 4
push edi
push 0x1004d9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x1031ad3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
je 0x1031b5e
cmp word [eax], 0
push ebx
push esi
push edi
je 0x1031b59
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
jmp 0x1031b3f
movzx eax, word [edi]
test ax, ax
je 0x1031b62
movzx ecx, word [esi]
movzx eax, ax
sub ecx, eax
jne 0x1031b45
push esi
call ebx
push edi
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [ebp - 4]
sub eax, edi
sub ecx, esi
xor eax, ecx
test eax, 0xfffffffe
je 0x1031b3a
jmp 0x1031b45
inc esi
inc esi
movzx ecx, word [esi]
inc edi
inc edi
movzx eax, word [edi]
sub ecx, eax
je 0x1031b3f
cmp esi, dword [ebp - 4]
jb 0x1031b2c
cmp word [esi], 0
jne 0x1031aff
cmp word [edi], 0
je 0x1031b62
push dword [ebp + 8]
call ebx
cmp word [eax], 0
mov dword [ebp + 8], eax
jne 0x1031af7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
jmp 0x1031b5b
Function at 0x10333b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x104400c
call fcn.0100798e
xor edi, edi
mov dword [ebp - 0x14], edi
push 2
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, edi
jne 0x10333fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jg 0x10333f0
mov esi, eax
jmp 0x10334f0
and eax, 0xffff
or eax, 0x80070000
jmp 0x10333e9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x103342c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10334e5
and eax, 0xffff
or eax, 0x80070000
jmp 0x10334e5
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x103340f
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp byte [esi + ebx], 0
mov edi, ebx
je 0x1033496
lea edi, [esi + 1]
cmp edi, 0x400
ja 0x103346e
push edi
call fcn.010312eb
test al, al
je 0x103346e
mov eax, edi
call fcn.01015539
mov edi, esp
jmp 0x1033479
push edi
lea ecx, [ebp - 0x14]
call fcn.0103278b
mov edi, eax
test edi, edi
jne 0x1033484
mov esi, 0x8007000e
jmp 0x10334e7
lea eax, [esi + 1]
push eax
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
test edi, edi
jne 0x103349e
xor eax, eax
jmp 0x10334d9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x10334c8
push ebx
call fcn.010312eb
test al, al
je 0x10334c8
mov eax, ebx
call fcn.01015539
mov eax, esp
jmp 0x10334d1
push ebx
lea ecx, [ebp - 0x14]
call fcn.0103278b
push esi
push edi
push eax
call fcn.010313e0
push dword [ebp + 0x14]
lea ecx, [ebp - 0x20]
push eax
call fcn.010332a9
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x14]
call fcn.01031ec4
mov eax, esi
lea esp, [ebp - 0x30]
call fcn.010079cb
ret 0x10