joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10799ac
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x109a5c6
call fcn.01077478
sub esp, 0x1c
mov eax, dword [0x10a6184]
push ebx
push esi
push edi
mov edi, 0x10a6184
cmp eax, edi
je 0x10799e8
test byte [eax + 0x1c], 1
je 0x10799e8
cmp byte [eax + 0x19], 5
jb 0x10799e8
push 0x10080a8
push 0x5d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079a3c
test byte [eax + 0x1c], 2
je 0x1079a3c
cmp byte [eax + 0x19], 4
jb 0x1079a3c
push ebx
push 0x10080a8
push 0x5e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
inc dword [ebp - 0x14]
cmp ebx, esi
jne 0x1079b56
push 0x10a8b2c
lea ecx, [ebp - 0x10]
call fcn.01020db5
mov eax, dword [0x10a6184]
cmp eax, edi
mov dword [ebp - 4], esi
je 0x1079a81
test byte [eax + 0x1c], 2
je 0x1079a81
cmp byte [eax + 0x19], 4
jb 0x1079a81
push dword [ebp - 0x1c]
push 0x10080a8
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
cmp dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
jbe 0x1079b46
cmp ebx, esi
jne 0x1079b46
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.0100a6ca
push eax
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079ae9
test byte [eax + 0x1c], 2
je 0x1079ae9
cmp byte [eax + 0x19], 4
jb 0x1079ae9
push ebx
push 0x10080a8
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
call fcn.0100a2eb
cmp ebx, esi
jne 0x1079b37
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.01064274
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079b37
test byte [eax + 0x1c], 2
je 0x1079b37
cmp byte [eax + 0x19], 4
jb 0x1079b37
push dword [ebp - 0x10]
push 0x10080a8
push 0x61
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009add
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jb 0x1079a8d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01009cd1
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079b87
test byte [eax + 0x1c], 1
je 0x1079b87
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x1079b87
push ebx
push 0x10080a8
push 0x62
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1079b9f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x109a5dd
call fcn.01077478
sub esp, 0x18
mov eax, dword [0x10a6184]
push ebx
push esi
push edi
mov edi, 0x10a6184
cmp eax, edi
je 0x1079bdb
test byte [eax + 0x1c], 1
je 0x1079bdb
cmp byte [eax + 0x19], 5
jb 0x1079bdb
push 0x10080a8
push 0x63
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079c2f
test byte [eax + 0x1c], 2
je 0x1079c2f
cmp byte [eax + 0x19], 4
jb 0x1079c2f
push ebx
push 0x10080a8
push 0x64
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
inc dword [ebp - 0x10]
cmp ebx, esi
jne 0x1079d26
push 0x10a8b2c
lea ecx, [ebp - 0x1c]
call fcn.01020db5
mov eax, dword [0x10a6184]
cmp eax, edi
mov dword [ebp - 4], esi
je 0x1079c74
test byte [eax + 0x1c], 2
je 0x1079c74
cmp byte [eax + 0x19], 4
jb 0x1079c74
push dword [ebp - 0x18]
push 0x10080a8
push 0x65
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
jbe 0x1079d16
cmp ebx, esi
jne 0x1079d16
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x10]
push esi
push esi
lea ecx, [ebp - 0x24]
push ecx
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
call fcn.0100a6ca
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079cdf
test byte [eax + 0x1c], 2
je 0x1079cdf
cmp byte [eax + 0x19], 4
jb 0x1079cdf
push ebx
push 0x10080a8
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0100a2eb
cmp ebx, esi
jne 0x1079d07
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.01079296
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jb 0x1079c80
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.01009cd1
mov eax, dword [0x10a6184]
cmp eax, edi
je 0x1079d57
test byte [eax + 0x1c], 1
je 0x1079d57
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x1079d57
push ebx
push 0x10080a8
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x107a7f4
Capabilities:
Get user security identifier

Disassembly:
mov eax, 0x109a64e
call fcn.01077478
sub esp, 0xe0
mov eax, dword [0x10a64dc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe4], eax
jne 0x107a82d
xor al, al
jmp 0x107a98f
and dword [ebp - 0xd8], 0
push ebx
and dword [ebp - 4], 0
push 0x100
lea ecx, [ebp - 0xd8]
call fcn.0107845e
mov eax, dword [ebp - 0xd8]
lea ebx, [esi + 0x4c]
push ebx
lea ecx, [ebp - 0xe0]
push ecx
push eax
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0xe4]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xdc], 0x44
mov dword [ebp - 0xe0], 0x80
call edi
test eax, eax
jne 0x107a909
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x107a96c
cmp dword [ebp - 0xdc], 0x44
jbe 0x107a8b5
push 0x80004005
call fcn.01009695
cmp dword [ebp - 0xe0], 0x80
jbe 0x107a8de
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xd8]
call fcn.0107848a
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe8], eax
push ebx
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe8]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xe4]
call edi
test eax, eax
je 0x107a96c
lea eax, [ebp - 0x54]
push eax
lea eax, [esi + 4]
push eax
push dword [ebp - 0xdc]
mov byte [esi + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x107a96c
push dword [ebp - 0xe8]
lea ecx, [esi + 0x54]
call fcn.0100ab82
push dword [ebp - 0xec]
lea ecx, [esi + 0x50]
call fcn.0100ab82
push dword [ebp - 0xe4]
lea ecx, [esi + 0x5c]
call fcn.0100ab82
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x107a968
lea ecx, [ebp - 0xd8]
call fcn.010783f3
mov al, 1
jmp 0x107a98e
mov ecx, esi
call fcn.0100fa44
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x107a98c
lea ecx, [ebp - 0xd8]
call fcn.010783f3
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.01076f63
leave
ret 8
Function at 0x107a9ac
Capabilities:
Get session user name

Disassembly:
mov eax, 0x109a665
call fcn.01077478
sub esp, 0x6c
mov eax, dword [0x10a64dc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x74], eax
mov eax, dword [0x10a6184]
mov esi, 0x10a6184
cmp eax, esi
push edi
mov edi, dword [ebp + 0xc]
je 0x107a9f9
test byte [eax + 0x1c], 1
je 0x107a9f9
cmp byte [eax + 0x19], 5
jb 0x107a9f9
push 0x10080a8
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
lea ecx, [ebp - 0x78]
mov eax, 0x7fff
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.0100a53f
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
movzx ebx, al
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107aa40
test byte [eax + 0x1c], 2
je 0x107aa40
cmp byte [eax + 0x19], 4
jb 0x107aa40
push ebx
push 0x10080a8
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
push 0xffffffffffffffff
mov ecx, edi
call fcn.0100a2eb
lea ecx, [ebp - 0x70]
call fcn.01060cb6
and dword [ebp - 4], 0
cmp ebx, 1
mov eax, dword [0x10a6184]
jne 0x107ab0a
cmp eax, esi
je 0x107aa87
test byte [eax + 0x1c], 2
je 0x107aa87
cmp byte [eax + 0x19], 4
jb 0x107aa87
push dword [edi]
push 0x10080a8
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009add
mov edi, dword [edi]
push 0
push edi
lea ecx, [ebp - 0x70]
call fcn.0107a7f4
movzx ebx, al
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107aac4
test byte [eax + 0x1c], 2
je 0x107aac4
cmp byte [eax + 0x19], 4
jb 0x107aac4
push ebx
push 0x10080a8
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
cmp ebx, 1
jne 0x107ab0a
lea ecx, [ebp - 0x70]
call fcn.01063465
mov edi, dword [ebp - 0x74]
push eax
mov ecx, edi
call fcn.0100ab82
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ab2d
test byte [eax + 0x1c], 2
je 0x107ab0a
cmp byte [eax + 0x19], 4
jb 0x107ab0a
push dword [edi]
push 0x10080a8
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009add
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ab2d
test byte [eax + 0x1c], 1
je 0x107ab2d
cmp byte [eax + 0x19], 5
jb 0x107ab2d
push ebx
push 0x10080a8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
lea ecx, [ebp - 0x70]
call fcn.01010e04
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
pop ebx
call fcn.01076f63
leave
ret 8
Function at 0x107ec44
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x109aa0e
call fcn.01077478
push ecx
push ecx
mov eax, dword [0x10a6184]
push ebx
push esi
mov esi, 0x10a6184
cmp eax, esi
push edi
mov edi, 0x10082fc
je 0x107ec80
test byte [eax + 0x1c], 1
je 0x107ec80
cmp byte [eax + 0x19], 5
jb 0x107ec80
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x100830c
push 0x17
push eax
push 0x100832c
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ecca
test byte [eax + 0x1c], 2
je 0x107ecca
cmp byte [eax + 0x19], 4
jb 0x107ecca
push ebx
push edi
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
and dword [ebp - 0x10], 0
test ebx, ebx
mov byte [ebp - 4], 1
jl 0x107ed4c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x1c]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ed0e
test byte [eax + 0x1c], 2
je 0x107ed0e
cmp byte [eax + 0x19], 4
jb 0x107ed0e
push ebx
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
test ebx, ebx
jl 0x107ed4c
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ed7a
test byte [eax + 0x1c], 2
je 0x107ed4c
cmp byte [eax + 0x19], 4
jb 0x107ed4c
push ebx
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x107ed7a
test byte [eax + 0x1c], 1
je 0x107ed7a
movzx ecx, byte [eax + 0x19]
xor edx, edx
test ebx, ebx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x107ed7a
push ebx
push edi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 0
je 0x107ed8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x107ed9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x107fff1
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10a6184]
push ebx
push esi
mov esi, 0x10a6184
cmp eax, esi
push edi
mov dword [ebp - 4], ecx
je 0x1080028
test byte [eax + 0x1c], 1
je 0x1080028
push 0x100834c
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
mov eax, dword [0x10a6184]
xor edi, edi
cmp dword [ebp + 8], 2
je 0x108003a
cmp dword [ebp + 8], 3
je 0x108003a
xor ebx, ebx
jmp 0x108003d
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x1080060
test byte [eax + 0x1c], 2
je 0x1080060
cmp byte [eax + 0x19], 4
jb 0x1080060
push ebx
push 0x100834c
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
cmp ebx, 1
jne 0x10800f1
mov ecx, dword [ebp - 4]
push ebx
call fcn.0107fee1
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x108009c
test byte [eax + 0x1c], 2
je 0x108009c
cmp byte [eax + 0x19], 4
jb 0x108009c
push ebx
push 0x100834c
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
cmp ebx, 1
jne 0x10800f1
mov eax, dword [ebp - 4]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp ebx, 1
je 0x10800f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10a6184]
cmp ecx, esi
je 0x10800f1
test byte [ecx + 0x1c], 2
je 0x10800f1
cmp byte [ecx + 0x19], 4
jb 0x10800f1
push eax
push 0x100834c
push 0x1d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01009b3f
mov ecx, dword [ebp - 4]
call fcn.0107fe53
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x1080121
test byte [eax + 0x1c], 1
je 0x1080121
cmp byte [eax + 0x19], 5
jb 0x1080121
push ebx
push 0x100834c
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x108012f
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10a6184]
push ebx
push esi
mov esi, 0x10a6184
cmp eax, esi
push edi
mov dword [ebp - 4], ecx
mov edi, 0x100834c
je 0x1080162
test byte [eax + 0x1c], 1
je 0x1080162
push edi
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009ab7
mov ecx, dword [ebp - 4]
push 1
call fcn.0107fee1
mov ebx, eax
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x1080192
test byte [eax + 0x1c], 2
je 0x1080192
cmp byte [eax + 0x19], 4
jb 0x1080192
push ebx
push edi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
cmp ebx, 1
jne 0x10801d9
mov eax, dword [ebp - 4]
push 0
push 0
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
cmp ebx, 1
je 0x10801d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10a6184]
cmp ecx, esi
je 0x10801d9
test byte [ecx + 0x1c], 2
je 0x10801d9
cmp byte [ecx + 0x19], 4
jb 0x10801d9
push eax
push edi
push 0x21
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01009b3f
mov ecx, dword [ebp - 4]
call fcn.0107fe53
mov eax, dword [0x10a6184]
cmp eax, esi
je 0x1080205
test byte [eax + 0x1c], 1
je 0x1080205
cmp byte [eax + 0x19], 5
jb 0x1080205
push ebx
push edi
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009b3f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1089494
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x100]
mov byte [ebp + 0xb], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10894f4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
inc byte [ebp + 0xb]
movzx ecx, byte [ebp + 0xb]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
xor ecx, ecx
mov cl, byte [esi]
add ecx, edx
and ecx, 0xff
mov cl, byte [ecx + eax]
xor byte [edi], cl
inc edi
dec dword [ebp + 0xc]
jne 0x10894bf
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0xb]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
leave
ret
Function at 0x108978c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x10a9a20], 0
mov eax, dword [0x10a64dc]
mov dword [ebp - 4], eax
jne 0x108987a
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x108986f
xor eax, eax
cmp dword [ebp - 0x88], 2
push esi
sete al
test eax, eax
mov dword [0x10a7bd8], eax
je 0x108983d
push 0x1008b5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x108986e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008b40
push edi
call esi
test eax, eax
mov dword [0x10a9a0c], eax
je 0x1089821
mov dword [0x10a7bd4], 0x4000
push 0x1008b34
push edi
call esi
push 0x1008b1c
push edi
mov dword [0x10a9a10], eax
call esi
mov dword [0x10a9a14], eax
jmp 0x108986e
push 0x1008b10
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x108986e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008b00
push edi
call esi
push 0x1008af0
push edi
mov dword [0x10a9a04], eax
call esi
mov dword [0x10a9a08], eax
pop esi
mov dword [0x10a9a20], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [0x10a7bd8]
call fcn.01076f63
leave
ret
Function at 0x108a06e
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x170
push esi
xor esi, esi
push edi
inc ecx
movzx edi, byte [ecx + 1]
xor edx, edx
mov dh, byte [ecx - 1]
mov dl, byte [ecx]
add ecx, 4
shl edx, 8
or edx, edi
movzx edi, byte [ecx - 2]
shl edx, 8
or edx, edi
mov dword [ebp + esi*4 - 0x170], edx
inc esi
cmp esi, 0x10
jb 0x108a07e
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x30]
push 0x40
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x168]
pop esi
mov ecx, dword [edx + 0x2c]
xor ecx, dword [edx + 0x18]
xor ecx, dword [edx - 8]
xor ecx, dword [edx]
add edx, 4
mov edi, ecx
shr edi, 0x1f
add ecx, ecx
or edi, ecx
dec esi
mov dword [edx + 0x34], edi
jne 0x108a0ba
mov ecx, dword [eax]
mov edi, dword [eax + 8]
and dword [ebp - 4], 0
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 4]
and dword [ebp - 8], 0
push ebx
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x170]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ebx
mov ebx, ecx
shl ecx, 5
shr ebx, 0x1b
or ebx, ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0x3c
mov dword [ebp - 0x1c], ebx
jge 0x108a129
cmp ecx, 0x28
jl 0x108a124
mov ecx, esi
or ecx, edi
and ecx, edx
mov ebx, esi
jmp 0x108a13d
cmp ecx, 0x14
jl 0x108a131
mov ecx, edx
xor ecx, esi
xor ecx, edi
jmp 0x108a145
test ecx, ecx
jl 0x108a143
mov ecx, edx
not ecx
and ecx, esi
mov ebx, edx
and ebx, edi
or ecx, ebx
jmp 0x108a145
xor ecx, ecx
mov edi, dword [ebp - 0xc]
mov edi, dword [edi]
add edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
add edi, ecx
mov ecx, dword [ebp - 4]
add ebx, edi
cmp cx, 0x3c
jl 0x108a164
mov ecx, 0xca62c1d6
jmp 0x108a18c
cmp cx, 0x28
jl 0x108a171
mov ecx, 0x8f1bbcdc
jmp 0x108a18c
cmp cx, 0x14
jl 0x108a17e
mov ecx, 0x6ed9eba1
jmp 0x108a18c
test cx, cx
jl 0x108a18a
mov ecx, 0x5a827999
jmp 0x108a18c
xor ecx, ecx
add dword [ebp - 0xc], 4
mov edi, edx
shr edx, 2
shl edi, 0x1e
or edi, edx
mov edx, dword [ebp - 0x18]
add ecx, ebx
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp word [ebp - 4], 0x50
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
jl 0x108a100
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], esi
mov dword [eax + 4], edx
lea ecx, [ebp - 0x30]
mov esi, ecx
mov edx, eax
push 5
sub edx, esi
pop esi
mov dword [eax + 8], edi
pop ebx
mov edi, dword [edx + ecx]
add dword [ecx], edi
add ecx, 4
dec esi
jne 0x108a1da
push 5
pop ecx
lea esi, [ebp - 0x30]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret
Function at 0x108a3ef
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x108a43c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x108a413
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x108a62f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x108a67c
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x108a653
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1090787
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.01090706
test eax, eax
je 0x10907c8
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x1008c9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8