joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009cf70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016b110
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], 0
test edi, edi
je 0x1009d048
mov eax, edi
lea edx, [eax + 1]
jmp 0x1009cfc0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cfc0
sub eax, edx
cmp eax, 0x11
jne 0x1009d048
test esi, esi
je 0x1009d048
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push str._x__x__x__x__x__x
push edi
call fcn.10111ee3
add esp, 0x20
movzx eax, byte [ebp - 0x1c]
mov byte [esi], al
movzx ecx, byte [ebp - 0x20]
mov byte [esi + 1], cl
movzx edx, byte [ebp - 0x24]
mov byte [esi + 2], dl
movzx eax, byte [ebp - 0x28]
mov byte [esi + 3], al
movzx ecx, byte [ebp - 0x2c]
mov byte [esi + 4], cl
movzx edx, byte [ebp - 0x30]
mov byte [esi + 5], dl
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009d6f0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x98
push 0xfffffffffffffffe
push 0x1016b0d0
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 2
mov dword [ebp - 0x1c], esi
mov dword [ebp], edi
push 0x90
push edi
lea eax, [ebp + 4]
push eax
call fcn.10116880
add esp, 0xc
mov dword [ebp], 0x94
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 0x10], esi
jne 0x1009d7e1
mov ecx, dword [ebp + 4]
mov eax, dword [ebp + 8]
cmp ecx, 6
jne 0x1009d784
cmp eax, 1
jae 0x1009d7a6
cmp ecx, ecx
jne 0x1009d784
cmp eax, edi
je 0x1009d7a6
cmp ecx, 5
jne 0x1009d7a9
cmp eax, esi
jne 0x1009d794
mov esi, 1
jmp 0x1009d7a6
cmp ecx, 5
jne 0x1009d7a9
cmp eax, 1
je 0x1009d78d
cmp ecx, ecx
jne 0x1009d7a9
cmp eax, edi
jne 0x1009d7a9
mov dword [ebp - 0x1c], esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x1009d7ea
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x98
mov esp, ebp
pop ebp
ret 4
Function at 0x1009d8b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016dc50
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.10116880
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.10116880
add esp, 0x18
lea edx, [ebp - 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x1009d959
cmp esi, ebx
je 0x1009d9c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetCurrentDirectory_failed___d_
push esi
call fcn.1010d6a8
add esp, 0xc
jmp 0x1009d9c3
lea ecx, [ebp - 0x120]
call fcn.10049c40
cmp dword [ebp + 8], ebx
je 0x1009d97e
lea eax, [ebp - 0x120]
push eax
push str.rundll32.exe__sencdec.dll_Logoff_force
lea ecx, [ebp - 0x224]
push ecx
jmp 0x1009d991
lea edx, [ebp - 0x120]
push edx
push str.rundll32.exe__sencdec.dll_Logoff
lea eax, [ebp - 0x224]
push eax
call fcn.1010d6a8
add esp, 0xc
push 1
push esi
lea ecx, [ebp - 0x224]
push ecx
call sym.EncDec.dll_StartProcessAsUser
test eax, eax
jne 0x1009d9c3
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x1009d9cc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret 8

Function at 0x1009daa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016dc30
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.10116880
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.10116880
add esp, 0x18
lea edx, [ebp - 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x120]
call fcn.10049c40
lea eax, [ebp - 0x120]
push eax
push str.rundll32.exe__sencdec.dll_Lock
lea ecx, [ebp - 0x224]
push ecx
call fcn.1010d6a8
add esp, 0xc
push 1
push esi
lea edx, [ebp - 0x224]
push edx
call sym.EncDec.dll_StartProcessAsUser
test eax, eax
jne 0x1009db74
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebx + 1]
jmp 0x1009db7d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret 4
Function at 0x100a3d90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x100a3dbd
push esi
push edi
jmp 0x100a3da0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x10140af0]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x100a3da0
pop edi
pop esi
ret

Function at 0x100a3e20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x100a3e3d
mov esi, 0x80
cmp esi, dword [edi]
jne 0x100a3e4a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x10197a7c]
test eax, eax
je 0x100a3e55
call eax
lea ecx, [esi*8]
push ecx
call fcn.100a0790
mov ebp, eax
mov eax, dword [0x10197a80]
add esp, 4
mov dword [esp + 0x10], ebp
test eax, eax
je 0x100a3e76
call eax
test ebp, ebp
je 0x100a3e41
mov edx, dword [edi + 0xc]
push edx
call fcn.100a0aa0
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x10177780]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.10116880
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x100a3f5f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x100a3ef3
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x10140af0]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x100a3ed0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x100a3f3a
mov esi, dword [eax]
test esi, esi
je 0x100a3f10
mov edx, dword [eax + 4]
jmp 0x100a3f12
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x100a3f3a
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100a3f32
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x100a3f53
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x100a3f53
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x100a3f49
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x100a3ec3
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x100b55f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x34]
push edi
mov edi, eax
push esi
lea eax, [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.100b06c0
mov ax, word [esp + 0x3c]
add esp, 4
test ax, ax
je 0x100b5695
movzx ecx, word [esi + 0x12]
add ecx, dword [esi + 0x38]
movzx eax, ax
add eax, edi
lea edx, [eax + 3]
cmp edx, ecx
jbe 0x100b5658
push 0x10167a8c
push 0xda00
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100a2260
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [eax]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl esi, 8
or esi, ecx
mov ecx, dword [ebx + 0x24]
shl esi, 8
or esi, edx
movzx edx, word [esp + 0x36]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x30]
sub ecx, 4
sub eax, edx
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
xor ecx, ecx
cmp eax, ecx
jne 0x100b56aa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
xor ecx, ecx
dec eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
cmp esi, 2
jb 0x100b5796
cmp esi, dword [ebx + 0x2c]
ja 0x100b5796
cmp eax, ecx
je 0x100b56ee
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov edi, ebx
call fcn.100b39c0
add esp, 0xc
test eax, eax
jne 0x100b5697
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x100b56fd
call fcn.100b12f0
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x100b5727
mov eax, dword [edi + 0x44]
cmp word [eax + 0x1a], 1
je 0x100b5727
push 0x10167a8c
push 0xda22
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100a2260
add esp, 0x10
mov ebx, 0xb
jmp 0x100b5735
push esi
push ebx
mov eax, edi
call fcn.100b52a0
add esp, 8
mov ebx, eax
test edi, edi
je 0x100b5772
mov eax, dword [edi + 0x44]
test eax, eax
je 0x100b5772
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x100b5752
mov ecx, eax
call fcn.100ab3f0
jmp 0x100b5757
call fcn.100a79c0
cmp dword [esi + 0x78], 0
jne 0x100b5772
mov ecx, dword [esi + 0xcc]
cmp dword [ecx + 0xc], 0
jne 0x100b5772
push esi
call fcn.100a9d60
add esp, 4
test ebx, ebx
jne 0x100b578d
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jne 0x100b56a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10167a8c
push 0xda0e
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100a2260
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100be950
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
push ebp
mov ebp, dword [eax]
mov cl, byte [ebp + 4]
mov edx, dword [ebp + 0xc]
mov byte [esp + 0x3f], cl
mov ecx, dword [esp + 0x50]
mov al, byte [ecx]
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edx
cmp al, 0x80
jae 0x100be991
movzx eax, al
mov dword [esp + 0x18], eax
mov eax, 1
jmp 0x100be99d
lea esi, [esp + 0x18]
call fcn.100a3800
movzx eax, al
mov edi, dword [esp + 0x18]
movzx ebx, al
mov dword [esp + 0x1c], 0
add ebp, 0x14
nop
mov ecx, dword [esp + 0x58]
mov al, byte [ecx + ebx]
add ecx, ebx
cmp al, 0x80
jae 0x100be9cb
movzx eax, al
mov dword [esp + 0x20], eax
mov ecx, 1
jmp 0x100be9db
lea esi, [esp + 0x20]
call fcn.100a3800
movzx ecx, al
mov eax, dword [esp + 0x20]
movzx edx, cl
add ebx, edx
mov edx, dword [esp + 0x54]
lea ecx, [eax + edi + 2]
cmp ecx, edx
jbe 0x100bea05
cmp eax, 0xc
jb 0x100be9f8
lea ecx, [eax - 0xc]
shr ecx, 1
jmp 0x100be9ff
movzx ecx, byte [eax + 0x10141288]
add ecx, edi
cmp ecx, edx
ja 0x100bea7b
mov edx, dword [esp + 0x58]
lea ecx, [edi + edx]
lea esi, [esp + 0x28]
call fcn.100be600
mov esi, dword [esp + 0x5c]
add edi, eax
mov eax, dword [ebp]
push eax
mov eax, dword [esi + 8]
add eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.100bad80
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100bea5c
inc dword [esp + 0x14]
add dword [esp + 0x1c], 0x28
add ebp, 4
cmp ebx, dword [esp + 0x18]
jae 0x100bea83
movzx ecx, word [esi + 4]
cmp dword [esp + 0x14], ecx
jl 0x100be9b0
jmp 0x100bea83
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
cmp byte [edx + ecx], 0
je 0x100beab6
neg eax
mov dword [esp + 0x10], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
mov cl, byte [esi + 6]
test cl, 1
je 0x100bea9f
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test cl, 2
jne 0x100beab6
cmp ebx, dword [esp + 0x18]
jae 0x100beab6
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x100d3e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x100d3e57
xor ebx, ebx
jmp 0x100d3e6f
cmp byte [ebp], 0
je 0x100d3e66
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x100d3e60
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x14]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x100d3f30
jmp 0x100d3e94
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x100d3e9c
xor esi, 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100d3ec1
mov edx, dword [esp + 0x1c]
mov edx, dword [edx + 0x10]
mov ecx, esi
shl ecx, 4
mov ecx, dword [ecx + edx]
push ecx
push eax
call fcn.100a2c30
add esp, 8
test eax, eax
jne 0x100d3f1d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x10]
shl esi, 4
mov ecx, dword [esi + eax + 0xc]
add ecx, 8
cmp dword [ecx + 0xc], 0
je 0x100d3f07
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x100d3f01
movzx esi, byte [edx]
movzx esi, byte [esi + 0x10140af0]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x100d3ee2
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x100d3f09
xor edx, edx
push ebp
call fcn.100a3f70
add esp, 4
test eax, eax
je 0x100d3f3a
mov edi, dword [eax + 8]
test edi, edi
jne 0x100d3f30
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x100d3e90
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x100d3f1d

Function at 0x100d4030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x100d4046
xor ebx, ebx
jmp 0x100d405f
cmp byte [edi], 0
je 0x100d4056
jmp 0x100d4050
inc eax
cmp byte [eax], 0
jne 0x100d4050
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 0x14]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x100d4120
mov ecx, dword [ecx + 0x10]
push esi
mov dword [esp + 0x14], ecx
jmp 0x100d4084
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x100d408c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x100d40b1
mov eax, dword [eax]
push eax
push ecx
call fcn.100a2c30
add esp, 8
test eax, eax
jne 0x100d40ff
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
je 0x100d40e9
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x100d40e3
movzx edi, byte [edx]
movzx edi, byte [edi + 0x10140af0]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x100d40c4
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x100d40eb
xor edx, edx
push edi
call fcn.100a3f70
add esp, 4
test eax, eax
je 0x100d411c
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x100d4112
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x100d4080
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x100d40ff
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100da0f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x100da110
mov al, byte [ebp + 0x10141458]
mov byte [esp + 0x10], al
test edi, edi
je 0x100da195
cmp byte [edi], 0
mov eax, edi
je 0x100da12b
inc eax
cmp byte [eax], 0
jne 0x100da125
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x1a4
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x100da17d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x100da173
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x10140af0]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x100da150
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x100da17f
xor edx, edx
push edi
call fcn.100a3f70
add esp, 4
test eax, eax
je 0x100da191
mov eax, dword [eax + 8]
jmp 0x100da19c
xor eax, eax
jmp 0x100da19c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
je 0x100da1ac
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x100da1cd
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x100da110
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10109250
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x434
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, dword [esp + 0x438]
push ebx
push ebp
xor ebx, ebx
push esi
mov dword [esp + 0x1c], eax
mov ebp, 1
cmp eax, ebx
je 0x1010927f
mov byte [eax], bl
push edi
lea eax, [esp + 0x22c]
push str.typelib_s
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 9
push ebx
lea edx, [esp + 0x234]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x1010942a
mov ecx, dword [esp + 0xc]
push 0x208
lea eax, [esp + 0x24]
push eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x30], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1010941f
lea edx, [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x338]
push str.typelib_s_s0win32
push eax
call fcn.1010d6a8
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
lea edx, [esp + 0x33c]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x101093ed
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x30], 0x208
mov byte [esp + 0x38], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x20], bl
je 0x101093ed
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10109389
push 1
lea edx, [esp + 0x24]
push edx
call sym.EncDec.dll_IsItEnvStringType
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x28]
call fcn.10044660
add esp, 8
test eax, eax
je 0x1010941a
lea eax, [esp + 0x20]
push 0x2e
push eax
call fcn.1010e930
add esp, 8
cmp eax, ebx
je 0x101093d7
push 0x5c
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x101093d7
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x28]
mov byte [eax], bl
call fcn.10044660
add esp, 8
test eax, eax
je 0x1010941a
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x101093eb
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebp, ebp
mov eax, dword [esp + 0x14]
push 0x208
inc eax
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push eax
mov byte [esp + 0x30], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x101092e7
jmp 0x1010941f
mov ebp, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x43c]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x434
ret
Function at 0x10109450
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x43c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x434], eax
mov eax, dword [esp + 0x440]
push ebx
push ebp
mov ebp, dword [esp + 0x44c]
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], eax
mov esi, 1
cmp ebp, ebx
je 0x10109488
mov byte [ebp], bl
push eax
lea eax, [esp + 0x234]
push str.typelib_s
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x20119
lea edx, [esp + 0x238]
push edx
push closesocket
call fcn.10062150
test eax, eax
jne 0x10109662
mov ecx, dword [esp + 0x14]
push 0x208
lea eax, [esp + 0x2c]
push eax
push ebx
push ecx
xor edi, edi
mov byte [esp + 0x38], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10109657
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x340]
push str.typelib_s_s0win32
push ecx
call fcn.1010d6a8
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push 0x20119
lea eax, [esp + 0x340]
push eax
push closesocket
call fcn.10062150
test eax, eax
jne 0x1010962d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push ebx
push eax
mov dword [esp + 0x3c], 0x208
mov byte [esp + 0x40], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x28], bl
je 0x1010962d
lea edx, [esp + 0x28]
push 0x5c
push edx
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10109581
push 1
lea eax, [esp + 0x2c]
push eax
call sym.EncDec.dll_IsItEnvStringType
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
call fcn.1004f240
add esp, 4
test eax, eax
je 0x101095ba
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.10044660
mov edx, dword [esp + 0x24]
push edx
mov esi, eax
call fcn.1004f2c0
add esp, 0xc
cmp esi, ebx
je 0x10109652
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.10044660
add esp, 8
test eax, eax
je 0x10109652
lea eax, [esp + 0x28]
push 0x2e
push eax
call fcn.1010e930
add esp, 8
cmp eax, ebx
je 0x1010961b
push 0x5c
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x1010961b
lea ecx, [esp + 0x28]
push ecx
mov byte [eax], bl
call fcn.10044470
add esp, 4
test eax, eax
je 0x10109652
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.10044660
add esp, 8
test eax, eax
je 0x10109652
cmp ebp, ebx
je 0x1010962b
lea edx, [esp + 0x28]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
mov ecx, dword [esp + 0x14]
push 0x208
lea eax, [esp + 0x2c]
push eax
inc edi
push edi
push ecx
mov byte [esp + 0x38], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x101094e6
jmp 0x10109657
mov esi, 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x444]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x43c
ret