joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c0ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 8]
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
cmp edx, 0xffffffff
jne 0x5c0ade
cmp ecx, 0xffffffff
je 0x5c0b00
mov eax, dword [ebx]
push 0
mov eax, dword [eax + 0x20]
push ecx
push edx
mov ecx, ebx
call eax
cmp eax, 0xffffffff
jne 0x5c0b00
cmp edx, eax
jne 0x5c0b00
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 0x14]
mov dword [esp + 0xc], 0
test esi, esi
jne 0x5c0b7a
cmp byte [0x65c1e4], 0
mov eax, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x14]
je 0x5c0b61
push 0x14
mov dword [esp + 0x24], eax
push 8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push edx
mov dword [esp + 0x38], ecx
call fcn.0041ed62
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
setns al
dec eax
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ecx
push eax
mov ecx, edx
call fcn.005b3d40
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x18], 0
je 0x5c0c77
cmp dword [ebx + 0x40], 0
jne 0x5c0ba2
push 0x10000
call fcn.005421d4
add esp, 4
mov dword [ebx + 0x40], eax
test eax, eax
je 0x5c0af4
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea esp, [esp]
mov edi, 0x10000
cmp esi, 0x10000
jae 0x5c0bbf
mov edi, esi
push edi
push eax
push dword [ebx + 0x40]
call fcn.005495a0
mov ecx, dword [ebx + 0x40]
add esp, 0xc
mov edx, edi
call fcn.005a7d40
cmp edi, eax
jne 0x5c0af4
cmp byte [0x65c1e4], 0
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x14]
push 0
je 0x5c0c2e
xor edx, edx
push edx
push edi
push eax
lea eax, [esp + 0x28]
push eax
push edx
push edx
push edx
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
call fcn.0041eeb8
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x5c0c25
mov esi, dword [ebp + 0x14]
or eax, 0xffffffff
jmp 0x5c0c49
mov eax, dword [esp + 0x1c]
mov esi, dword [ebp + 0x14]
jmp 0x5c0c49
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c0c45
or eax, 0xffffffff
jmp 0x5c0c49
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x5c0af4
mov ecx, dword [esp + 0xc]
add ecx, eax
mov dword [esp + 0xc], ecx
cmp eax, edi
jne 0x5c0c88
mov eax, dword [esp + 0x10]
add eax, edi
sub esi, edi
mov dword [esp + 0x10], eax
mov dword [ebp + 0x14], esi
jne 0x5c0bb0
jmp 0x5c0c88
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
push esi
call fcn.005b1b90
add esp, 4
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5c0c94
add dword [ebx + 0x28], ecx
adc dword [ebx + 0x2c], 0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c47d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.SysInspector_
mov esi, ecx
push 0x105
push esi
mov dword [ebp - 0x22c], 0x105
call fcn.00543349
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x218]
push eax
mov edx, 0x105
mov ecx, esi
call fcn.005c1c80
add esp, 4
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x5c48c7
test eax, eax
je 0x5c4893
push eax
movzx eax, word [ebp - 0x21e]
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
sub eax, 0x7d0
push eax
push str.__02d_02d_02d__02d_02d__d
lea eax, [ebp - 0x218]
push 0x105
push eax
call fcn.005c1aa0
add esp, 0x24
jmp 0x5c490d
movzx eax, word [ebp - 0x21e]
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
sub eax, 0x7d0
push eax
push str.__02d_02d_02d__02d_02d
jmp 0x5c48f9
movzx eax, word [ebp - 0x21e]
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
sub eax, 0x7d0
push eax
push 0x617ab4
lea eax, [ebp - 0x218]
push 0x105
push eax
call fcn.005c1aa0
add esp, 0x20
push str..xml
mov edx, 0x105
lea ecx, [ebp - 0x218]
call fcn.005c1c80
lea eax, [ebp - 0x218]
push eax
mov edx, 0x105
mov ecx, esi
call fcn.005c1c80
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x41ec10
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42f8c0
call fcn.0041e810
push 1
call fcn.0041e11a
pop ecx
test al, al
je 0x41ebf8
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041e0cb
mov byte [ebp - 0x24], al
mov eax, dword [0x430160]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41ebf8
test eax, eax
jne 0x41eb1c
mov dword [0x430160], ecx
push 0x42d0fc
push 0x42d0ec
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41eaff
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41ebe8
push 0x42d0e8
push 0x42d0d4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x430160], 2
jmp 0x41eb21
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041e0fd
pop ecx
call fcn.0041ed11
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41eb52
push esi
call fcn.0041e037
pop ecx
test al, al
je 0x41eb52
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.0041ed17
mov esi, eax
cmp dword [esi], edi
je 0x41eb70
push esi
call fcn.0041e037
pop ecx
test al, al
je 0x41eb70
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0041e43d
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041e46e
test al, al
je 0x41ebff
test bl, bl
jne 0x41eb9e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0041e153
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41ebe8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0041e4d4
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00576000
jmp 0x41ea92
Function at 0x100376e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10011bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10037c9
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10037c0
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4

Function at 0x10037d0
Capabilities:
Get common file path
Print debug messages
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push dword [ebp + 0x78]
lea eax, [ebp - 0x60]
push 0x1001210
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
xor eax, eax
call fcn.0100376e
test eax, eax
je 0x1003896
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10011fc
xor eax, eax
call fcn.0100376e
test eax, eax
je 0x1003896
push esi
push edi
push 0x80
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003831
mov esi, 0x10011f4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003846
mov esi, 0x10011e4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
push 0x10011e0
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1003894
mov eax, dword [ebp + 0x7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003874
push esi
sub eax, edx
push eax
push 1
push dword [ebp + 0x7c]
call dword [sym.imp.msvcrt.dll_fwrite]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
pop edi
pop esi
add ebp, 0x70
leave
ret 8
Function at 0x10038ca
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
jne 0x10038e0
mov dword [ebp + 8], 0x10012b0
push ebx
push esi
push edi
push 0x104
mov ebx, 0x1009898
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100391f
mov eax, dword [ebp + 8]
mov dword [0x1009898], 0x5c3a43
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003907
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003913
mov esi, edx
jmp 0x100394c
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003922
mov eax, dword [ebp + 8]
mov esi, 0x10011f4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003938
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003944
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0xc], 0
rep movsb byte es:[edi], byte [esi]
je 0x10039d4
xor eax, eax
push 0x10012a0
inc eax
call fcn.0100376e
test eax, eax
je 0x10039ce
call fcn.0100389d
test eax, eax
je 0x10039d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x80]
push 0x1001260
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10011e0
push ebx
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10039d4
lea eax, [ebp - 0x80]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039ab
sub eax, edx
push esi
push eax
lea eax, [ebp - 0x80]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
jmp 0x10039d4
push ebx
call fcn.01003738
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8

Function at 0x1003a5e
Capabilities:
Write file on windows

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov esi, eax
call fcn.010039de
cmp eax, 1
jne 0x1003b11
mov eax, dword [esp + 8]
cmp eax, dword [0x1009094]
jg 0x1003b11
push ebx
push esi
push 0x10012c0
mov ebx, 0x1008890
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003aa2
push edi
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x18]
sub eax, esi
lea eax, [eax + 0x1008890]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003ac5
push 0x10011e0
mov esi, 0x10012bc
push 0x1009898
movsw word es:[edi], word [esi]
call dword [sym.imp.msvcrt.dll_fopen]
pop ecx
mov esi, eax
test esi, esi
pop ecx
pop edi
je 0x1003b10
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003af2
push esi
sub eax, edx
push eax
push 1
push ebx
call dword [sym.imp.msvcrt.dll_fwrite]
push esi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x1003d8e
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x1001224
push ebx
push 0x10
mov edi, 0x100130c
push edi
mov esi, 0x1001220
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
push edi
push esi
push ebx
push 0x1001300
push 2
call fcn.01003a5e
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x1003dc8
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x1001224
push ebx
push 0
mov edi, 0x100131c
push edi
mov esi, 0x1001220
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
push edi
push esi
push ebx
push 0x1001300
push 2
call fcn.01003a5e
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x1003e9e
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push edi
push 0x10013e0
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
cmp ebx, edi
jne 0x1003ecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10013ac
push edi
call fcn.01003a5e
add esp, 0xc
jmp 0x1003f31
push esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, edi
je 0x1003efc
cmp esi, 0x80
je 0x1003efc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x100136c
push edi
call fcn.01003a5e
add esp, 0x10
jmp 0x1003f29
call fcn.01003d8e
mov edi, eax
call fcn.01003dc8
mov esi, eax
lea eax, [esi + 1]
cdq
idiv edi
push edx
call fcn.01003e02
push esi
push dword [esp + 0x14]
mov edi, eax
call fcn.01003d24
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
ret 4

Function at 0x1003fac
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x1001224
push ebx
push 0
mov edi, 0x1001450
push edi
mov esi, 0x1001448
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
push edi
push esi
push ebx
push 0x1001300
push 1
call fcn.01003a5e
push 0x1001428
push 1
call fcn.01003a5e
add esp, 0x20
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x100518d
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [0x1009cf4], ebx
je 0x10051b2
push 0x4df
xor edi, edi
call ebp
jmp 0x10052b8
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x1009cf4], eax
je 0x10052b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100217c
push eax
call esi
test eax, eax
mov dword [0x1009cf8], eax
je 0x10052b6
push 0x1002170
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009cfc], eax
je 0x10052b6
push 0x1002164
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d00], eax
je 0x10052b6
push 0x1002158
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d04], eax
je 0x10052b6
push 0x100214c
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d08], eax
je 0x10052b6
push 0x1002138
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d18], eax
je 0x10052b6
push 0x1002128
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d1c], eax
je 0x10052b6
push 0x1002118
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d20], eax
je 0x10052b6
push 0x1002108
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d24], eax
je 0x10052b6
push 0x10020f4
push dword [0x1009cf4]
call esi
test eax, eax
mov dword [0x1009d28], eax
jne 0x10052de
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0
push dword [esp + 0x1c]
push 0x227
push 0x1001ea8
push 0x10020bc
call fcn.01003f38
add esp, 0x18
push ebx
push edi
push dword [esp + 0x1c]
push 0x1002080
push 1
call fcn.01003a5e
add esp, 0x14
push ebx
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1005421
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x1001224
push ebx
push 0
mov edi, 0x100222c
push edi
mov esi, 0x1001448
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
push edi
push esi
push ebx
push 0x1002220
push 1
call fcn.01003a5e
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x100545b
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x1001224
push ebx
push 0
mov edi, 0x1002238
push edi
mov esi, 0x1002230
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
push edi
push esi
push ebx
push 0x1002220
push 1
call fcn.01003a5e
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x10055b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x108
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_strncpy]
push 0x78
push dword [ebp + 0x78]
lea eax, [ebp - 0x1c]
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0x78]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1001468
push 0x80000002
mov byte [ebp + 0x5c], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005641
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp + 0x68]
push eax
push ebx
push dword [ebp + 0x74]
mov dword [ebp + 0x68], 1
push dword [ebp + 0x78]
mov dword [ebp + 0x64], 0x78
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005638
push 0x78
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
add esp, 0xc
mov byte [ebp + 0x5c], bl
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
jl 0x100565d
lea eax, [edi - 1]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x7c]
call esi
mov eax, dword [ebp + 0x7c]
add esp, 0xc
mov byte [eax + edi - 1], bl
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc

Function at 0x1006821
Capabilities:
Check mutex on windows
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0x1002ce4
xor eax, eax
call fcn.01006b43
test eax, eax
je 0x100683a
pop ebp
jmp fcn.01004e07
pop ebp
jmp fcn.010061cb

Function at 0x1006885
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [0x1009e7c], ebx
je 0x10068a7
push 0x4df
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1006945
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x1009e7c], eax
je 0x1006943
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002e1c
push eax
call esi
cmp eax, ebx
mov dword [0x1009e80], eax
je 0x1006943
push 0x1002e10
push dword [0x1009e7c]
call esi
cmp eax, ebx
mov dword [0x1009e84], eax
je 0x1006943
push 0x1002dfc
push dword [0x1009e7c]
call esi
cmp eax, ebx
mov dword [0x1009e88], eax
je 0x1006943
push 0x1002de8
push dword [0x1009e7c]
call esi
cmp eax, ebx
mov dword [0x1009e8c], eax
je 0x1006943
push 0x1002dd8
push dword [0x1009e7c]
call esi
cmp eax, ebx
mov dword [0x1009e90], eax
je 0x1006943
push 0x1002dc8
push dword [0x1009e7c]
call esi
cmp eax, ebx
mov dword [0x1009e94], eax
jne 0x1006969
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push dword [esp + 0x14]
push 0x37c
push 0x1002d68
push 0x1002d30
call fcn.01003f38
add esp, 0x14
push ebx
push edi
push dword [esp + 0x18]
push 0x1002cf4
push 1
call fcn.01003a5e
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x1006b43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1001468
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1006b9e
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1006b95
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4

Function at 0x1006ba5
Capabilities:
Suspend thread

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [0x1009e98], edi
je 0x1006c57
push dword [0x1009ea0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1006bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003050
push edi
call fcn.01003a5e
add esp, 0xc
jmp 0x1006c57
push ebx
push dword [0x1008088]
push dword [0x1009e98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
cmp ebx, edi
je 0x1006c50
cmp ebx, 0x102
je 0x1006c2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1003018
push edi
call fcn.01003a5e
push esi
push ebx
push 0x130
push 0x1002d68
push 0x1002fec
call fcn.01003f38
add esp, 0x20
jmp 0x1006c50
push dword [0x1009e98]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1002fac
push edi
call fcn.01003a5e
add esp, 0x10
mov dword [0x1009e98], edi
pop ebx
mov eax, dword [0x1009ea0]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1006c6f
push eax
call esi
mov dword [0x1009ea0], edi
mov eax, dword [0x1009e9c]
cmp eax, edi
je 0x1006c81
push eax
call esi
mov dword [0x1009e9c], edi
cmp dword [0x1009ea4], edi
je 0x1006c95
push 1
call fcn.01006af8
call fcn.01006a2d
push 0x1002ce4
xor eax, eax
call fcn.01006b43
test eax, eax
jne 0x1006cb4
push 0x10025a8
inc eax
call fcn.01006b43
test eax, eax
jne 0x1006cbf
call fcn.0100698d
mov dword [0x100aebc], edi
mov dword [0x1009ea4], edi
xor eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x1007181
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
or dword [0x1009e60], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
push 0x1002ce4
xor eax, eax
mov dword [ebp - 4], esi
mov dword [0x1009ea8], esi
mov dword [0x1009e64], 0x1009eb0
mov word [0x1009e68], 0x800
mov word [0x1009e6a], si
mov word [0x1009e6c], si
mov word [0x1009e6e], si
mov dword [0x1009e70], 0x100a6b0
mov word [0x1009e74], 0x800
mov word [0x1009e76], si
mov word [0x1009e78], si
mov word [0x1009e7a], si
call fcn.01006b43
test eax, eax
mov ebx, 0x100259c
jne 0x100721b
push 0x10025a8
inc eax
call fcn.01006b43
test eax, eax
je 0x100721b
mov edi, dword [0x100aebc]
jmp 0x100722d
call fcn.01006854
push ebx
call fcn.01006885
mov dword [0x100aebc], eax
mov edi, eax
cmp edi, esi
jne 0x1007251
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x10033bc
push esi
call fcn.01003a5e
add esp, 0x10
call fcn.01006ba5
jmp 0x1007376
push 0x10033a4
push 0x12
pop eax
call fcn.0100376e
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.010069f6
mov edi, eax
cmp edi, esi
mov dword [0x1009ea4], edi
push esi
jne 0x1007298
push 0x1003378
push esi
call fcn.01003a5e
push esi
push 0xad
push 0x1002d68
push 0x1003350
jmp 0x1007357
call fcn.01006af8
push 1
call fcn.01006af8
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
jne 0x10072e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x1003314
push esi
mov dword [0x1009e9c], esi
xor edi, edi
call fcn.01003a5e
push ebx
push 0xc1
push 0x1002d68
push 0x10032e8
jmp 0x1007357
push esi
push esi
push esi
push esi
mov dword [0x1009e9c], eax
call edi
cmp eax, esi
jne 0x1007315
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x10032b0
push esi
mov dword [0x1009ea0], esi
xor edi, edi
call fcn.01003a5e
push ebx
push 0xd2
jmp 0x10072d6
mov dword [0x1009ea0], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x1007058
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0x1007364
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x1003274
push esi
xor edi, edi
call fcn.01003a5e
push ebx
push 0xe9
push 0x1002d68
push 0x1003248
call fcn.01003f38
add esp, 0x1c
jmp 0x1007247
xor edi, edi
push 0x270f
mov dword [0x1009e98], eax
inc edi
call fcn.01006af8
push edi
push 0x1003228
push 1
call fcn.01003a5e
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret