joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104087e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x104089f
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010403ad
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x104095e
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.0103ecb3
test eax, eax
je 0x1040957
cmp dword [ebp - 4], edi
jne 0x1040915
cmp dword [ebp + 8], edi
jbe 0x1040950
push dword [ebp + 8]
call fcn.0103e460
lea ecx, [ebp - 4]
mov esi, eax
call fcn.0103f9a1
cmp esi, edi
je 0x104090b
mov dword [ebp - 4], esi
jmp 0x10408c0
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x104095a
cmp dword [ebp - 0x10], 4
je 0x1040922
mov esi, 0x8007000d
jmp 0x104095e
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0103e944
mov esi, eax
cmp esi, edi
jl 0x104095e
cmp dword [ebp + 0xc], edi
je 0x1040942
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x104095a
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x104095a
mov esi, 0x8000ffff
jmp 0x104095e
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x1040983
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1040983
test byte [eax + 0x3c], 2
je 0x1040983
push esi
push 0x1003204
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f9a1
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 8]
call fcn.0103f528
pop edi
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x1044ff1
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push eax
call fcn.0103ecb3
cmp dword [ebp - 4], 0
jge 0x104503e
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x104503e
test byte [eax + 0x3c], 2
je 0x104503e
push dword [ebp - 4]
push 0x1003ad0
push 0x2c
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x104892b
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
jne 0x104896e
mov dword [ebp - 0x10], 0x80070057
jmp 0x10489c0
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10489a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov dword [ebp - 0x10], eax
jmp 0x10489bb
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1048992
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
jge 0x10489e7
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10489e7
test byte [eax + 0x3c], 2
je 0x10489e7
push dword [ebp - 0x10]
push 0x1003a90
push 0x2a
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0x14]
call fcn.010458a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 8

Function at 0x1048a03
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor esi, esi
and dword [ebp - 8], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x1048a34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov esi, eax
jmp 0x1048a51
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1048a24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
test esi, esi
jge 0x1048a7a
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1048a7a
test byte [eax + 0x3c], 2
je 0x1048a7a
push esi
push 0x1003a90
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.010458a0
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x1049c81
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x2000000
push ebx
xor esi, esi
push edi
mov dword [ebp - 0x218], esi
call fcn.01047bfc
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x1049d71
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.0103ecb3
test eax, eax
je 0x1049d69
jmp 0x1049d49
dec dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
push 0x105
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
call fcn.0103ecb3
test eax, eax
je 0x1049d69
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call fcn.01049c81
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x1049d71
cmp dword [ebp - 0x21c], esi
ja 0x1049cf8
lea ecx, [ebp - 0x218]
call fcn.0103f528
push ebx
push edi
call fcn.01044ff1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], esi
jge 0x1049d9b
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1049d9b
test byte [eax + 0x3c], 2
je 0x1049d9b
push dword [ebp - 0x214]
push 0x1003ad0
push 0x2e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0x218]
call fcn.0103f528
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 8
Function at 0x104c41b
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
push 1
push 0x1003ff4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebx + 4], esi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x104c46c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov dword [ebp - 4], eax
jmp 0x104c52f
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0103f4fa
cmp edi, esi
jne 0x104c4c9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], esi
call edi
cmp eax, 5
jne 0x104c4fb
push dword [ebp + 8]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.0103f4fa
cmp ebx, esi
jne 0x104c4f1
mov dword [ebp - 8], esi
call edi
jmp 0x104c45e
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x104c51b
cmp eax, 0x80
je 0x104c512
cmp eax, 0x102
jne 0x104c522
mov dword [ebp - 4], 0x800705b4
jmp 0x104c534
mov edi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], edi
jmp 0x104c4cc
cmp eax, esi
jle 0x104c464
and eax, 0xffff
or eax, 0x80070000
jmp 0x104c464
mov dword [ebp - 4], 0x8000ffff
jmp 0x104c534
mov dword [ebx + 4], 1
mov eax, edi
push eax
mov ecx, ebx
mov dword [ebp - 8], esi
call fcn.010400b6
cmp dword [ebp - 4], esi
jge 0x104c55b
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x104c55b
test byte [eax + 0x3c], 2
je 0x104c55b
push dword [ebp - 4]
push 0x100397c
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0103f4fa
lea ecx, [ebp - 0xc]
call fcn.01045953
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x104f3e1
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104b4f1
mov dword [ebp + 0xc], eax
test eax, eax
jl 0x104f420
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.0103ecb3
cmp dword [ebp + 0xc], 0
jge 0x104f447
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x104f447
test byte [eax + 0x3c], 2
je 0x104f447
push dword [ebp + 0xc]
push 0x1003ad0
push 0x1e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, dword [ebp + 0xc]
leave
ret 0xc
Function at 0x10501f1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0104b4f1
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x1050268
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x105024e
dec ecx
dec ecx
je 0x105024a
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.0103ecb3
test eax, eax
je 0x1050262
jmp 0x1050251
xor esi, esi
jmp 0x1050251
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x1050262
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x105028f
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x105028f
test byte [eax + 0x3c], 2
je 0x105028f
push dword [ebp + 0xc]
push 0x1003ad0
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14

Function at 0x105029f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x10502c0
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104b682
mov edi, eax
cmp edi, esi
jl 0x1050304
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0103ecb3
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1050329
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1050329
test byte [eax + 0x3c], 2
je 0x1050329
push edi
push 0x1003ad0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x10503c9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x10503ea
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104b72e
mov edi, eax
cmp edi, esi
jl 0x105042e
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 3
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0103ecb3
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1050453
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1050453
test byte [eax + 0x3c], 2
je 0x1050453
push edi
push 0x1003ad0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x10505f7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1050618
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104b30b
mov edi, eax
cmp edi, esi
jl 0x105065c
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0103ecb3
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1050681
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1050681
test byte [eax + 0x3c], 2
je 0x1050681
push edi
push 0x1003ad0
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x1053d60
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov dword [ebp - 0x218], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x1053dbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
jmp 0x1053e1f
cmp eax, edi
ja 0x1053dd3
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.01040a41
jmp 0x1053db7
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0
call fcn.01050e48
mov edi, eax
test edi, edi
jl 0x1053e23
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push ebx
call esi
test eax, eax
je 0x1053dab
cmp eax, dword [ebp - 0x214]
je 0x1053e0a
mov edi, 0x8007007a
jmp 0x1053e23
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x218]
and dword [ebp - 0x210], 0
mov dword [ecx], eax
test edi, edi
jge 0x1053e48
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1053e48
test byte [eax + 0x3c], 2
je 0x1053e48
push edi
push 0x1003a90
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0x210]
call fcn.0103f6a1
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 8
Function at 0x105abb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x105abd1
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104b30b
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x105ac90
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.0103ecb3
test eax, eax
je 0x105ac89
cmp dword [ebp - 4], edi
jne 0x105ac47
cmp dword [ebp + 8], edi
jbe 0x105ac82
push dword [ebp + 8]
call fcn.0103e460
lea ecx, [ebp - 4]
mov esi, eax
call fcn.0103f9a1
cmp esi, edi
je 0x105ac3d
mov dword [ebp - 4], esi
jmp 0x105abf2
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x105ac8c
cmp dword [ebp - 0x10], 1
je 0x105ac54
mov esi, 0x8007000d
jmp 0x105ac90
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01053ce0
mov esi, eax
cmp esi, edi
jl 0x105ac90
cmp dword [ebp + 0xc], edi
je 0x105ac74
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x105ac8c
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x105ac8c
mov esi, 0x8000ffff
jmp 0x105ac90
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x105acb5
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x105acb5
test byte [eax + 0x3c], 2
je 0x105acb5
push esi
push 0x1003ad0
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f9a1
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 8]
call fcn.0103f528
pop edi
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x105d231
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
push 0x1005184
lea ecx, [ebp - 0xc]
call fcn.01044026
call fcn.0110c578
dec esp
sbb bh, byte [ecx]
add byte [edx + ebx + 0x39], cl
jo 0x105d24f
add dword [eax], eax
inc eax
push eax
sbb bh, byte [ecx]
xor byte [ecx - 0x176ffbec], dh
adc esi, ebx
or al, byte [eax]
shl dl, 1
adc byte ss:[esi], 0
add byte [eax - 0x2c], ah
loop 0x105d2a6
pushal
aam 0xe2
add byte ss:[edi - 0x51], 4
add byte [edi - 0x51], 4
adc al, ch
outsb dx, byte [esi]
xor al, 3
add byte [edi - 0x73], dh
add eax, 0x36d8d870
pushal
aam 0xd8
rcr byte ss:[edi], 0
add byte [eax], dl
call fcn.0103c38b
aam 0xad
xor eax, 0x30a0
adc byte [esp + esi*8 + 0x2f], ah
loopne 0x105d26c
lodsd eax, dword [esi]
xor eax, 0xf2d4e800
or al, byte [eax]
test byte [ecx + 0x35], ch
xor byte [edx], ch
add byte [eax], al
xor eax, 0x2a30
invalid
Function at 0x1060a95
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx - 0x176ffc03], 0xfb
mov esp, 0x1edfffd
add byte [eax - 0xfc9edd4], dl
in al, dx
fild qword [edx]
xor byte [eax], 0x12
loopne 0x1060a14
invalid
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.0104c9f3
call fcn.01298d5a
mov esp, 0x17f036be
add byte [eax], al
sar byte [eax + 0xf1036be], 1
xchg ebx, eax
or dword [eax], esp
call fcn.01347b48
sal dword [esi + edi*4], 0x80
sub dword [eax], eax
add al, dh
xchg esp, eax
mov dh, 0x35
loopne 0x1060a6e
mov dh, 0x35
xor al, ch
lodsd eax, dword [esi]
mov eax, 0x7288fffd
xor eax, 0x7760
nop
xchg dword [edi + 0x72843033], ecx
xor eax, 0x56086860
add byte [ecx], al
jb 0x1060b16
pushal
ja 0x1060ae4
add byte [eax + 0x30338f87], dl
test byte [edx + 0x35], dh
pushal
push 0x1005608
lea ecx, [ebp - 0x14]
call fcn.01044026
call fcn.01298d5a
or dh, bh
xor eax, 0xb790
and byte [esi + edi*8], al
xor eax, 0x2bf33bd0
shr al, 0xd3
sti
add al, byte [eax]
jne 0x1060adf
enter 0x202d, 4
aad 0x35
sub eax, 0x35d50420
inc eax
add ch, dl
xor eax, 0xa40
mov al, byte [0x85147d8b]
dec dword [edi]
test dword [ecx - 0x17ffffff], edx
jno 0x1060b56
or al, byte [eax]
or al, 0x4d
adc bl, bh
int1
adc byte [eax], dl
ja 0x1060b3f
add al, dh
adc byte [ebp + 0x36], cl
add al, ch
pop esp
and ecx, dword [edx]
add al, ch
out dx, eax
xor eax, 0x2c89ef10
inc eax
aaa
add byte [eax], al
inc eax
in al, dx
out dx, eax
xor eax, 0x2347e830
or al, byte [eax]
aam 0xdf
xor eax, 0x2d548b50
loopne 0x1060b62
push eax
mov edx, dword [ebp + ebp - 0x20]
cli
add byte [eax], al
rcr al, 1
fbstp tbyte [0x57be80]
pop es
and byte [ecx + 0x136ec90], 0x3d
nop
in al, dx
add dword ss:[ebp + ebp*2 - 0x18], esi
mov ecx, 0x1d60000a
and byte ss:[ecx + 0x64c00001], bl
sbb eax, 0x6c635036
sub dh, byte [eax]
test byte [eax + 0x3c], 2
je 0x1060bed
call fcn.01347b48
stc
mov esp, dword [ebx]
add byte [eax + eax], cl
xor byte [eax - 0x435fc933], bh
int 0x36
shr al, 1
adc dh, byte [ebp + edi*8 + 0x368f48ff]
adc byte [eax + 2], bh
add al, ah
dec esp
invalid
call fcn.0103bc4e
xor al, 0xff
xor eax, 0xe30
invalid
Function at 0x1061238
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push 0x1005638
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], edi
call fcn.01044026
call fcn.01298d5a
and byte [edx + 0x5e3036], dh
add byte [eax], al
sbb al, 0xb2
pushal
aas
jno 0x1061272
push eax
call fcn.0110c578
inc eax
and byte ss:[di], ch
add al, dl
inc esp
add byte ss:[di + 0xfc6], 0
call fcn.01347b48
bound ebp, qword [esi]
insd dword es:[edi], dx
add byte [eax], al
rol byte [edi + 0x36], 1
add byte [ebp - 0x17fff03a], 0xc5
push 0x2e62002e
inc edx
rcl byte [edi], 0
add al, dh
je 0x10612e7
add byte ss:[eax + 0x5a], bh
inc eax
cmp dword [ebp + 0x14], edi
jne 0x10612b7
call fcn.0103bc4e
pushal
cmpsb byte [esi], byte es:[edi]
xor eax, 0x6380
mov al, 0x5c
cmpsb byte [esi], byte es:[edi]
xor eax, 0x3033fba0
add byte [esi - 0x7ff8ffa9], bh
jmp 0x1061539
call fcn.0103c38b
mov ah, 0x6f
mov al, 7
add byte [eax], al
invalid
mov esp, 0x192035
add byte [eax - 0x7f], al
inc ebp
das
nop
les edi, [ebp + esi + 0x684de870]
add bl, ch
inc esi
les eax, [eax - 0x1ffffee3]
in al, dx
xchg ecx, eax
xor eax, 0x3591f0c0
mov al, 0xe8
jnp 0x10612be
std
jmp [eax - 0x80]
call fcn.0103bc4e
clc
dec edi
add byte ss:[esi], ah
add byte [eax], al
sal ah, 0x4f
cmp byte ss:[ebp - 0x2d], 0x10
mov al, byte [0xfdaa74e8]
invalid
Function at 0x108de67
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x108deb0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x108deb0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x108dea0
test esi, eax
je 0x108dede
not esi
and esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x108dede
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
jmp 0x108deb5
mov edi, 0x80070057
test edi, edi
jge 0x108dede
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x108dede
test byte [eax + 0x3c], 2
je 0x108dede
push edi
push 0x1006358
push 0x34
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x108df06
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x138a8c8], 1
je 0x108df1e
mov esi, 0x8000ffff
jmp 0x108df46
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x138a3b4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x108df6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov esi, eax
test esi, esi
jge 0x108df6b
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x108df6b
test byte [eax + 0x3c], 2
je 0x108df6b
push esi
push 0x10060e0
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x108e2c6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x108e2f1
test al, 0x10
je 0x108e2e7
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
jmp 0x108e2f3
xor eax, eax
cmp dword [ebp + 0xc], eax
sete al
jmp 0x108e2f3
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0xc