joyce8/EMBER2024-capa huggingface dataset:
Function at 0x81fb40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0x2a7000]
push edi
jmp 0x81fb5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x81fb61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81fb50
mov eax, 1
add ebx, ebx
jne 0x81fb73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x81fb84
jne 0x81fba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81fba3
dec eax
add ebx, ebx
jne 0x81fb90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x81fb68
add ebx, ebx
jne 0x81fb9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x81fbf5
xor ecx, ecx
sub eax, 3
jb 0x81fbbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x81fc2a
sar eax, 1
mov ebp, eax
jmp 0x81fbc6
add ebx, ebx
jne 0x81fbc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81fb94
inc ecx
add ebx, ebx
jne 0x81fbd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81fb94
add ebx, ebx
jne 0x81fbe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x81fbd6
jne 0x81fbf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x81fbd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x81fc14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x81fc06
jmp 0x81fb56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x81fc14
add edi, ecx
jmp 0x81fb56
pop esi
mov edi, esi
mov ecx, 0x2756d1
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x81fc4f
cmp byte [edi], 0x2f
jne 0x81fc34
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x81fc32
lea edi, [esi + 0x40e000]
mov eax, dword [edi]
or eax, eax
je 0x81fca0
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41ff70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x420078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x81fc55
mov ecx, edi
jns 0x81fc84
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x420080]
or eax, eax
je 0x81fc9a
mov dword [ebx], eax
add ebx, 4
jmp 0x81fc72
call dword [esi + 0x42007c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x81fcd1
cmp al, 0xef
ja 0x81fcc4
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x81fca6
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x81fcb3
mov ebp, dword [esi + 0x420084]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x81fd05
sub esp, 0xffffff80
jmp 0x659d03
Function at 0x401360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 4], 0
call fcn.00410ab0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10]
push edx
call esi
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407e54
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41929c]
jne 0x407e5e
repz ret
jmp fcn.0040c33d

Function at 0x411cdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41929c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cffc
and dword [ebp - 0x14], 0
cmp dword [0x41adc8], 0
mov dword [ebp - 0x18], eax
jne 0x411d8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411e37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411e37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41adc8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41adcc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41add0], eax
call edi
push eax
call esi
mov dword [0x41add8], eax
test eax, eax
je 0x411d8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41add4], eax
mov eax, dword [0x41add4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411de8
cmp dword [0x41add8], ecx
je 0x411de8
push eax
call esi
push dword [0x41add8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411de8
test ebx, ebx
je 0x411de8
call edi
test eax, eax
je 0x411ddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411ddf
test byte [ebp - 8], 1
jne 0x411de8
or dword [ebp + 0x10], 0x200000
jmp 0x411e1b
mov eax, dword [0x41adcc]
cmp eax, dword [ebp - 0x18]
je 0x411e1b
push eax
call esi
test eax, eax
je 0x411e1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411e1b
mov eax, dword [0x41add0]
cmp eax, dword [ebp - 0x18]
je 0x411e1b
push eax
call esi
test eax, eax
je 0x411e1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41adc8]
call esi
test eax, eax
je 0x411e37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411e39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407e54
leave
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2e8c55d9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5f6e655a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x10c6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10c61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10c607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c606a
add dl, dl
jne 0x10c6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c60dc
xor eax, eax
add dl, dl
jne 0x10c6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c617d
add dl, dl
jne 0x10c60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10c60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10c6075
mov eax, 1
add dl, dl
jne 0x10c60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c60e1
sub eax, ebx
mov ebx, 1
jne 0x10c6128
mov ecx, 1
add dl, dl
jne 0x10c610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10c613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c6136
cmp eax, 0x7d00
jae 0x10c616d
cmp eax, 0x500
jb 0x10c6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c6075
cmp eax, 0x7f
ja 0x10c6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10c619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10c6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402590
Capabilities:
Create shortcut via ishelllink
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41e5b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x238]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x234], 1
call fcn.00418ed8
lea ecx, [esp + 0x23c]
mov byte [esp + 0x230], 2
push ecx
lea ecx, [esp + 0x14]
call fcn.0041952f
lea edx, [esp + 0x10]
lea ecx, [esp + 0x238]
push edx
call fcn.00419250
push 0x10000000
push ecx
lea eax, [esp + 0x240]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00418ed8
mov ecx, esi
call fcn.00403150
mov ecx, dword [esp + 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp + 0x238]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and al, 0xfe
push eax
push edx
call ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x40275b
lea eax, [esp + 0xc]
push eax
push 0x421ed8
push 1
push 0
push 0x421ec8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x402715
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0x421ee8
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jne 0x402715
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x8c]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 0xc]
push 0x4275f8
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea edi, [esi + 0x78]
push str.IEXPLORE.exe
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.004193ac
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
push eax
push ecx
mov edx, dword [ecx]
mov byte [esp + 0x238], 3
call dword [edx + 0x50]
lea ecx, [esp + 0x18]
mov byte [esp + 0x230], 2
call fcn.00419163
mov eax, dword [esp + 0xc]
mov edi, dword [edi]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x238]
push 1
push eax
call ebp
push 0x80000000
push ecx
lea edx, [esp + 0x240]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00418ed8
mov ecx, esi
call fcn.00403150
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 1
call fcn.00419163
lea ecx, [esp + 0x238]
mov byte [esp + 0x230], 0
jmp loc.00432b9a
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401443
pop dword [ebp - 0x20]
mov eax, 0x531c6890
add eax, 0xad23abb3
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x5c4bc9b4
add dword [ebp - 0x30], 0xf2067b97
mov dword [ebp - 0x2c], 0x93e07682
sub dword [ebp - 0x2c], 0x61ad2a3d
mov dword [ebp - 0x28], 0x489f4269
add dword [ebp - 0x28], 0x3ad01c5
mov dword [ebp - 0x24], 0xc64fa735
sub dword [ebp - 0x24], 0xc64fa735
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x19c448b8
sub dword [ebp - 0x30], 0xa551df62
mov dword [ebp - 0x2c], 0x991fcf4
add dword [ebp - 0x2c], 0x37da6481
mov dword [ebp - 0x28], 0x8775b1a9
add dword [ebp - 0x28], 0xdbf9bac3
mov dword [ebp - 0x24], 0xd193b602
add dword [ebp - 0x24], 0x2e6c49fe
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x48498037
add eax, 0xb7f6f0d9
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d0e1
push 0
call eax
mov ecx, 0x5bd7
mov edi, eax
mov ebx, 0x436000
add ebx, dword [ebp - 0x20]
mov edx, 0x1f44ad9e
add edx, 0x17d37bf3
mov dword [ebp - 0x18], 0xcab20445
mov esi, dword [ebx]
add dword [ebp - 0x1c], 0xfcb5a148
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 0xc], ecx
add edi, 0xfbda7a90
sub edi, 0xfbda7a8c
add ebx, 0x714ba3c2
sub ebx, 0x714ba3be
loop 0x401554
add eax, 0x12cf9894
add eax, 0xed31c99b
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x10006fd3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10006ff4
jl 0x10006feb
test edi, edi
jne 0x10006ff4
xor eax, eax
xor edx, edx
jmp 0x100070b5
cmp dword [ebx + 0x38], 0
je 0x10007009
push eax
push edi
push dword [ebp + 8]
call fcn.100070bb
jmp 0x100070b5
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10007050
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10007050
cmp eax, edi
jb 0x1000702a
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.10008c80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10007056
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x100070aa
mov ecx, ebx
call fcn.10006823
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10007095
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.1000f749
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x100070aa
jmp 0x10007068
test edx, edx
je 0x100070aa
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1000f749
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x1000846a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100084a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100084a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100084a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100084a9
cmp dword [ecx + 0x74], 0xe
jbe 0x100084a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001649e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100280b8
push 0x100280b0
push str.FlsAlloc
push 0x1f
call fcn.10016309
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100164d2
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024140]
call esi
jmp 0x100164d8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001651c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100280c8
push 0x100280c0
push str.FlsGetValue
push 0x21
call fcn.10016309
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016553
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1001655b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100280d0
push 0x100280c8
push str.FlsSetValue
push 0x22
call fcn.10016309
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016595
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]