joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103cd45
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
jne 0x103cd88
mov dword [ebp - 0x10], 0x80070057
jmp 0x103cdda
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x103cdbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov dword [ebp - 0x10], eax
jmp 0x103cdd5
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x103cdac
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
jge 0x103ce01
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x103ce01
test byte [eax + 0x3c], 2
je 0x103ce01
push dword [ebp - 0x10]
push 0x1002760
push 0x2a
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 0x14]
call fcn.0103a4da
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 8
Function at 0x103e981
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x2000000
push ebx
xor esi, esi
push edi
mov dword [ebp - 0x218], esi
call fcn.0103bfad
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x103ea71
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.010330ee
test eax, eax
je 0x103ea69
jmp 0x103ea49
dec dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
push 0x105
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
call fcn.010330ee
test eax, eax
je 0x103ea69
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call fcn.0103e981
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x103ea71
cmp dword [ebp - 0x21c], esi
ja 0x103e9f8
lea ecx, [ebp - 0x218]
call fcn.010339a8
push ebx
push edi
call fcn.010392ba
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], esi
jge 0x103ea9b
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x103ea9b
test byte [eax + 0x3c], 2
je 0x103ea9b
push dword [ebp - 0x214]
push 0x10027a0
push 0x2e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 0x218]
call fcn.010339a8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 8
Function at 0x1040fed
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
push 1
push 0x1002cc4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebx + 4], esi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x104103e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov dword [ebp - 4], eax
jmp 0x1041101
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0103397a
cmp edi, esi
jne 0x104109b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], esi
call edi
cmp eax, 5
jne 0x10410cd
push dword [ebp + 8]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.0103397a
cmp ebx, esi
jne 0x10410c3
mov dword [ebp - 8], esi
call edi
jmp 0x1041030
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x10410ed
cmp eax, 0x80
je 0x10410e4
cmp eax, 0x102
jne 0x10410f4
mov dword [ebp - 4], 0x800705b4
jmp 0x1041106
mov edi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], edi
jmp 0x104109e
cmp eax, esi
jle 0x1041036
and eax, 0xffff
or eax, 0x80070000
jmp 0x1041036
mov dword [ebp - 4], 0x8000ffff
jmp 0x1041106
mov dword [ebx + 4], 1
mov eax, edi
push eax
mov ecx, ebx
mov dword [ebp - 8], esi
call fcn.01034536
cmp dword [ebp - 4], esi
jge 0x104112d
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x104112d
test byte [eax + 0x3c], 2
je 0x104112d
push dword [ebp - 4]
push 0x100264c
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 8]
call fcn.0103397a
lea ecx, [ebp - 0xc]
call fcn.0103a58d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10442c8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010401d2
mov dword [ebp + 0xc], eax
test eax, eax
jl 0x1044307
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010330ee
cmp dword [ebp + 0xc], 0
jge 0x104432e
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x104432e
test byte [eax + 0x3c], 2
je 0x104432e
push dword [ebp + 0xc]
push 0x10027a0
push 0x1e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.010339a8
mov eax, dword [ebp + 0xc]
leave
ret 0xc
Function at 0x10459a1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.010401d2
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x1045a18
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x10459fe
dec ecx
dec ecx
je 0x10459fa
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.010330ee
test eax, eax
je 0x1045a12
jmp 0x1045a01
xor esi, esi
jmp 0x1045a01
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x1045a12
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x1045a3f
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x1045a3f
test byte [eax + 0x3c], 2
je 0x1045a3f
push dword [ebp + 0xc]
push 0x10027a0
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.010339a8
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14

Function at 0x1045a4f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1045a70
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01040363
mov edi, eax
cmp edi, esi
jl 0x1045ab4
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.010330ee
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1045ad9
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x1045ad9
test byte [eax + 0x3c], 2
je 0x1045ad9
push edi
push 0x10027a0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 8]
call fcn.0103a5a4
lea ecx, [ebp - 0xc]
call fcn.010339a8
lea ecx, [ebp - 4]
call fcn.010339a8
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x1045b79
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1045b9a
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104040f
mov edi, eax
cmp edi, esi
jl 0x1045bde
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 3
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.010330ee
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1045c03
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x1045c03
test byte [eax + 0x3c], 2
je 0x1045c03
push edi
push 0x10027a0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 8]
call fcn.0103a5a4
lea ecx, [ebp - 0xc]
call fcn.010339a8
lea ecx, [ebp - 4]
call fcn.010339a8
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x1045da7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1045dc8
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010400ff
mov edi, eax
cmp edi, esi
jl 0x1045e0c
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.010330ee
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1045e31
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x1045e31
test byte [eax + 0x3c], 2
je 0x1045e31
push edi
push 0x10027a0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 8]
call fcn.0103a5a4
lea ecx, [ebp - 0xc]
call fcn.010339a8
lea ecx, [ebp - 4]
call fcn.010339a8
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x10494fa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov dword [ebp - 0x218], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x1049555
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov edi, eax
jmp 0x10495b9
cmp eax, edi
ja 0x104956d
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.01034ec1
jmp 0x1049551
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0
call fcn.010466ff
mov edi, eax
test edi, edi
jl 0x10495bd
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push ebx
call esi
test eax, eax
je 0x1049545
cmp eax, dword [ebp - 0x214]
je 0x10495a4
mov edi, 0x8007007a
jmp 0x10495bd
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x218]
and dword [ebp - 0x210], 0
mov dword [ecx], eax
test edi, edi
jge 0x10495e2
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10495e2
test byte [eax + 0x3c], 2
je 0x10495e2
push edi
push 0x1002760
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 0x210]
call fcn.01033b21
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 8
Function at 0x104c68e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x104c6af
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010400ff
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x104c76e
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010330ee
test eax, eax
je 0x104c767
cmp dword [ebp - 4], edi
jne 0x104c725
cmp dword [ebp + 8], edi
jbe 0x104c760
push dword [ebp + 8]
call fcn.010324a4
lea ecx, [ebp - 4]
mov esi, eax
call fcn.01033cc2
cmp esi, edi
je 0x104c71b
mov dword [ebp - 4], esi
jmp 0x104c6d0
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x104c76a
cmp dword [ebp - 0x10], 1
je 0x104c732
mov esi, 0x8007000d
jmp 0x104c76e
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0104947a
mov esi, eax
cmp esi, edi
jl 0x104c76e
cmp dword [ebp + 0xc], edi
je 0x104c752
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x104c76a
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x104c76a
mov esi, 0x8000ffff
jmp 0x104c76e
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x104c793
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x104c793
test byte [eax + 0x3c], 2
je 0x104c793
push esi
push 0x10027a0
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.01033cc2
lea ecx, [ebp - 0xc]
call fcn.010339a8
lea ecx, [ebp - 8]
call fcn.010339a8
pop edi
mov eax, esi
pop esi
leave
ret 0x14
Function at 0x1052d35
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push 0x10042e0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], edi
call fcn.01038347
call fcn.0125bfba
mov bl, 0xa8
mov cl, 0x40
pop esi
mov dword [0x2c6a3040], ebx
xor byte [esi], ah
add byte [eax], al
push eax
call fcn.01077ff4
xor eax, dword [eax]
add byte [eax], al
push eax
inc ecx
sub al, 0x80
invalid
Function at 0x1055d8d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
push 0x100478c
lea ecx, [ebp - 0x10]
call fcn.01038347
call fcn.01032a62
inc eax
test al, 0x59
pushal
push esi
add eax, dword [eax]
mov al, byte [0xa02cd41c]
push ss
adc al, 0xa
and al, ch
push ebx
jmp 0x1055de3
add byte [eax], al
pushal
nop
cmp ch, byte [eax + esi*2]
cmp dword [ebp + 0xc], 0
jne 0x1055e24
call fcn.0121d60e
cmp bl, bh
sub al, 0x10
pop esp
pop es
add byte [ebx], ah
add byte [eax], al
and byte [ebx + edi*8], dh
sub al, 0
call fcn.0108ab6c
sub byte [ebx - 0x150bffd4], dh
or al, 0x40
fild word [ecx]
add byte [eax + 0x402cb32c], al
mov esi, 0x80070057
jmp 0x10560eb
call fcn.01032a62
sbb dword [esi + 0x57], edi
loopne 0x1055e34
add al, byte [eax]
xor byte [eax], cl
mov edi, 0xd70e102b
adc byte [esi], cl
xlatb
sub byte [eax - 0x7d], dh
jge 0x1055e54
add esi, dword [ebp - 0x4f]
call fcn.01077ff4
wait
add byte [eax], al
cmp ah, 3
sub eax, 0x7165850
xor al, bh
add ebp, dword [0x4d13e810]
add eax, dword [eax]
call fcn.0108ab6c
aam 0xfd
sub al, 0
ret 0x750
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x105613a
test byte [eax + 0x3c], 2
je 0x105613a
call fcn.01254918
sub al, 0
add byte [eax - 0x2fd36ce8], ah
sbb al, 0x93
sub al, 0x80
xchg edx, eax
or al, 0xe
xor al, ch
dec ebx
leave
std
push dword [eax]
push cs
pop eax
pushal
push cs
add byte [eax], al
adc byte [edi + eax], dl
sub al, 0x60
xchg byte [edx + 0x24], bl
adc byte [esi + 0x68], dl
pushfd
add byte es:[ecx], al
push 0x36
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
invalid
call fcn.0121d60e
push eax
sbb ch, byte [eax + esi*4]
push edi
and eax, dword [eax - 0x7fffffdc]
dec esp
sbb ch, byte [eax + esi*4]
lea ecx, [ebp - 0x10]
call fcn.01038364
call fcn.01032a62
mov byte [edx], cl
pop esi
and byte [edi], dl
add byte [eax], al
pushal
inc eax
add eax, 0x3170902f
add edx, eax
call fcn.01031025
mov edi, 0x24001447
shr dword [eax + edx*2], cl
and bl, dl
sub al, 0x50
lds eax, [eax + eax]
add al, ch
xor al, 0x5e
and byte [eax], al
xchg edx, eax
loope 0x1056139
inc eax
aas
mov ebp, 0x38682021
sub al, 0xf0
and dword [eax], eax
add al, ah
lea ecx, [ebp - 8]
call fcn.01033b21
call fcn.01254918
wait
add byte [eax], al
loopne 0x105620c
out 0x1f, eax
add byte [ebx + 0x64e00000], bl
or eax, 0xd68b02d
sub eax, 0x6d348f0
add al, ch
pushal
out 0x1f, eax
add byte [ebp - 0x2f400000], al
push cs
sub al, 0x70
aam 0xe
sub al, 0xd0
jo 0x10561a0
and esp, dword [eax]
lea ecx, [ebp - 4]
call fcn.0104c14e
call fcn.0125bfba
add esp, dword [edx + esi*4 - 0x40]
xor eax, 0x4300ddd
cdq
sub al, 0xb0
pop ss
add byte [eax], al
and byte [ebx - 0x3d36a13a], cl
adc al, 0
add al, 0x55
in al, 0x89
jge 0x10561f8
Function at 0x106d1db
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x106d224
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x106d224
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x106d214
test esi, eax
je 0x106d252
not esi
and esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x106d252
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov edi, eax
jmp 0x106d229
mov edi, 0x80070057
test edi, edi
jge 0x106d252
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x106d252
test byte [eax + 0x3c], 2
je 0x106d252
push edi
push 0x1004ff0
push 0x34
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x106d27a
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x12d41ec], 1
je 0x106d292
mov esi, 0x8000ffff
jmp 0x106d2ba
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x12d3f6c]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x106d2df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov esi, eax
test esi, esi
jge 0x106d2df
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x106d2df
test byte [eax + 0x3c], 2
je 0x106d2df
push esi
push 0x1004d88
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x106d49d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x106d4c8
test al, 0x10
je 0x106d4be
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
jmp 0x106d4ca
xor eax, eax
cmp dword [ebp + 0xc], eax
sete al
jmp 0x106d4ca
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0xc
Function at 0x106dd98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x62c]
push eax
push 0x104
push esi
call fcn.010337fc
mov edi, eax
test edi, edi
jl 0x106df97
push esi
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x41c]
push eax
call fcn.010399c4
mov edi, eax
test edi, edi
jl 0x106df97
lea eax, [ebp - 0x62c]
push eax
push 1
push dword [ebp - 0x62c]
call fcn.0106d348
mov edi, eax
test edi, edi
jl 0x106df97
mov eax, dword [ebp - 0x62c]
lea eax, [ebp + eax*2 - 0x41c]
cmp word [eax], 0x5c
jne 0x106de2b
xor ecx, ecx
mov word [eax], cx
and dword [ebp - 0x630], 0
xor eax, eax
cmp word [ebp - 0x41c], 0x5c
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x62c], eax
jne 0x106de5d
lea eax, [ebp - 0x41a]
mov dword [ebp - 0x62c], eax
push 0x5c
push dword [ebp - 0x62c]
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x634], esi
lea eax, [ebp - 0x628]
test esi, esi
jne 0x106dea2
push dword [ebp - 0x62c]
push ebx
push eax
call fcn.010399c4
mov edi, eax
test edi, edi
jl 0x106df97
mov dword [ebp - 0x630], 1
jmp 0x106dede
sub esi, dword [ebp - 0x62c]
sar esi, 1
push esi
push dword [ebp - 0x62c]
push ebx
push eax
call fcn.0106d4d5
mov edi, eax
test edi, edi
jl 0x106df97
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x634], eax
jb 0x106df7e
xor eax, eax
mov word [ebp + esi*2 - 0x628], ax
lea eax, [ebp - 0x628]
push eax
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0106d521
mov edi, eax
test edi, edi
jl 0x106df97
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
je 0x106df14
test al, 0x10
jne 0x106df44
mov eax, dword [ebp - 0x630]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x638]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x106df85
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
je 0x106df85
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x106df6f
add eax, 2
push 0x100188c
mov dword [ebp - 0x62c], eax
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0106d521
mov edi, eax
test edi, edi
jl 0x106df97
cmp dword [ebp - 0x630], 0
je 0x106de5d
jmp 0x106df93
mov edi, 0x80070216
jmp 0x106df97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov edi, eax
test edi, edi
jge 0x106dfbc
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x106dfbc
test byte [eax + 0x3c], 2
je 0x106dfbc
push edi
push 0x1004ff0
push 0x1c
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 8
Function at 0x106e775
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
jne 0x106e78f
mov ebx, 0x80070057
jmp 0x106e803
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0106d07b
cmp dword [ebp - 4], 0xffffffff
jne 0x106e7c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov ebx, eax
jmp 0x106e7ff
push dword [ebp - 4]
call fcn.0106d02f
mov edi, dword [ebp + 0xc]
movzx eax, al
push 0
neg eax
lea ecx, [ebp + 8]
push ecx
sbb eax, eax
push edi
push dword [ebp + 0x10]
not eax
and eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x106e7b9
cmp dword [ebp + 8], edi
je 0x106e828
mov ebx, 0x8000ffff
test ebx, ebx
jge 0x106e828
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x106e828
test byte [eax + 0x3c], 2
je 0x106e828
push ebx
push 0x1004ff0
push 0x33
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.0106d05c
pop edi
mov eax, ebx
pop ebx
leave
ret 0xc