joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15021770
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret

Function at 0x15021a00
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov esi, 0x150508f0
mov dword [esp + 0x10], 0x1504c8f0
mov edi, dword [esp + 0x10]
xor eax, eax
cmp ebp, 1
sete al
mov ebx, 0x200000
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi], ebx
mov dword [esi], eax
add esi, 4
add edi, 4
add ebx, 0x200000
sub dword [esp + 0x14], 1
jne 0x15021a33
mov eax, dword [esp + 0x10]
add eax, 0x2000
mov dword [ebp*4 + 0x1504c8e8], 0x7ff
mov dword [ebp*4 + 0x1504c8e0], 0x3ff
mov dword [ebp*4 + 0x1504c8d8], 0x400
add ebp, 1
cmp eax, 0x150508f0
mov dword [esp + 0x10], eax
jl 0x15021a16
xor eax, eax
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 1
cmp eax, dword [esp + 0x30]
pop edi
sbb ecx, ecx
pop esi
and ecx, 0xf9f
add ecx, eax
pop ebp
mov dword [0x150497f0], ecx
pop ebx
add esp, 0x30
jmp 0x15033650
cmp dword [0x15057788], 0
jne 0x1503367e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x1505778c], eax
je 0x1503367e
push str.TryEnterCriticalSection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x15057788], eax
ret
Function at 0x15022d90
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
test eax, eax
jne 0x15022dcf
push 0x57
call sym.Storm.dll_Ordinal_465
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1503831e
add esp, 0x108
ret 4
push esi
push edi
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sym.Storm.dll_Ordinal_501
mov dl, 0x5c
lea ecx, [esp + 8]
call sym.Storm.dll_Ordinal_570
mov dl, 0x2f
lea ecx, [esp + 8]
mov esi, eax
call sym.Storm.dll_Ordinal_570
cmp esi, eax
mov edi, esi
ja 0x15022e01
mov edi, eax
test edi, edi
je 0x15022e1f
lea esi, [esp + 8]
call fcn.15022d20
lea eax, [esp + eax + 8]
cmp edi, eax
jae 0x15022e1b
mov byte [eax], 0
jmp 0x15022e1f
mov byte [edi + 1], 0
lea esi, [esp + 8]
call fcn.15022d20
lea esi, [esp + eax + 8]
mov dl, 0x2f
mov ecx, esi
call sym.Storm.dll_Ordinal_569
test eax, eax
je 0x15022e51
lea esp, [esp]
lea ecx, [eax + 1]
mov dl, 0x2f
mov byte [eax], 0x5c
call sym.Storm.dll_Ordinal_569
test eax, eax
jne 0x15022e40
mov dl, 0x5c
mov ecx, esi
call sym.Storm.dll_Ordinal_569
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
test esi, esi
je 0x15022e85
push 0
lea ecx, [esp + 0xc]
push ecx
mov byte [esi], 0
call edi
lea ecx, [esi + 1]
mov dl, 0x5c
mov byte [esi], 0x5c
call sym.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
jne 0x15022e66
push 0
lea edx, [esp + 0xc]
push edx
call edi
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.1503831e
add esp, 0x108
ret 4

Function at 0x15023740
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x150552a8
xor ebx, ebx
mov edi, edi
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebx + 0x15055294]
cmp esi, edi
je 0x150237ab
mov ecx, dword [esi + 0x10c]
cmp ecx, 0xffffffff
je 0x150237a4
mov eax, dword [esi + 0x114]
cmp eax, edi
je 0x150237a4
push edi
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esi + 0x124]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x15023761
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add ebx, 4
add ebp, 0x18
cmp ebx, 0x10
jb 0x15023750
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x15023eb0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
movzx eax, byte [esp + 0x18]
cmp dword [esp + 0x1c], eax
je 0x15023ed7
push 0x57
call sym.Storm.dll_Ordinal_465
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 0x18
mov ecx, dword [esp + 0x28]
push ebx
push esi
push 1
push 0x2000
push ecx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
cmp esi, ebx
jne 0x15023f13
push 1
push ebx
push ebx
push ebp
push edi
push 8
mov dword [0x15055358], 1
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [esp + 0x2c]
push 4
push 0x1000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x15023ef4
cmp edi, ebx
je 0x15023f36
push edi
call sym.Storm.dll_Ordinal_506
jmp 0x15023f38
xor eax, eax
lea edx, [eax + 1]
lea eax, [edx + 0x6f]
mov ecx, eax
and ecx, 7
mov dword [esp + 0x1c], edx
je 0x15023f56
mov edx, 8
sub edx, ecx
add eax, edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, esi
cmp edi, ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x68], ebp
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
je 0x15023fc1
push edx
lea ecx, [esi + 0x6c]
push edi
push ecx
call sub.MSVCR80.dll_memcpy
mov ecx, dword [esp + 0x30]
add esp, 0xc
jmp 0x15023fc4
mov byte [esi + 0x6c], bl
mov edx, esi
shr edx, 0x10
mov word [esp + 0x14], dx
mov word [esp + 0x16], 0x6f6d
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov edx, dword [ecx*4 + 0x15055370]
cmp edx, ebx
je 0x1502400c
mov edi, dword [esi + 4]
cmp dword [edx + 4], edi
je 0x1502400c
mov eax, edx
cmp dword [eax], ebx
je 0x1502400c
mov ecx, dword [eax]
cmp dword [ecx + 4], edi
je 0x15024002
mov eax, ecx
cmp dword [eax], ebx
jne 0x15023ff5
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x15024021
mov ecx, dword [esp + 0x24]
mov dword [esi], edx
mov dword [ecx*4 + 0x15055370], esi
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
add esp, 8
ret 0x18
mov dword [esi], ecx
mov dword [eax], esi
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
add esp, 8
ret 0x18

Function at 0x150240b0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov eax, 1
cmp ecx, eax
mov dword [0x15055364], eax
jbe 0x150240db
nop
add eax, eax
cmp eax, ecx
jb 0x150240d0
mov dword [0x15055364], eax
add esp, 0x24
ret
Function at 0x15025cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
cmp ebp, 0x7fffffff
push esi
mov esi, eax
jbe 0x15025d15
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x15025cee
lea eax, [eax + eax*2]
lea ecx, [eax*8 + 0x15055780]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebx], 0xffffffff
mov eax, dword [esi + 0x68]
push 1
push 0
push 0
push eax
add esi, 0x6c
push esi
push 8
mov dword [0x15055358], 1
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test esi, esi
push edi
je 0x15025d4e
mov eax, dword [esp + 0x10]
test eax, 0x4000000
mov byte [esp + 0x14], 0
je 0x15025d2f
mov byte [esp + 0x14], 0x40
test eax, 0x8000000
je 0x15025d3b
or byte [esp + 0x14], 0x80
mov edx, dword [esp + 0x14]
push edx
push ebp
mov eax, esi
call fcn.15025a00
mov edi, eax
test edi, edi
jne 0x15025db9
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x15025d6c
lea eax, [eax + eax*2]
lea ecx, [eax*8 + 0x15055780]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebx], 0xffffffff
cmp byte [esi + 0x6c], 0
push 1
lea eax, [esi + 0x6c]
push 0
push 0
je 0x15025d99
mov esi, dword [esi + 0x68]
push esi
push eax
push 8
mov dword [0x15055358], 1
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffffffffffffffff
push str.SMemHeapAlloc__
push 8
mov dword [0x15055358], 1
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [esp + 0x10], 8
je 0x15025dc5
push ebp
push 0
jmp 0x15025dd4
cmp dword [0x15055778], 0
je 0x15025ddd
push ebp
push 0xee
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.1502f010
add dword [esi + 0x38], 1
add dword [0x1505535c], ebp
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x15026020
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1505536c], 0
jne 0x15026052
push 1
push 0
push 0
push 0xffffffffffffffff
push str.SMemHeapAlloc__
push 0x8510007d
mov dword [0x15055358], 0
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ebx, dword [esp + 8]
push esi
movzx esi, bl
push edi
lea eax, [esi + esi*2]
lea edi, [eax*8 + 0x15055780]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x10], esi
mov esi, dword [esi*4 + 0x15055370]
test esi, esi
je 0x1502608b
lea esp, [esp]
cmp dword [esi + 4], ebx
je 0x150260b8
mov esi, dword [esi]
test esi, esi
jne 0x15026080
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
push 0
push 0
push 0xffffffffffffffff
push str.SMemHeapAlloc__
push 6
mov dword [0x15055358], 0
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov eax, esi
lea ebx, [esp + 0x18]
call fcn.15025cc0
mov edi, eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x150260e9
lea edx, [eax + eax*2]
lea eax, [edx*8 + 0x15055780]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x15055368]
test eax, eax
je 0x150260fb
cmp eax, esi
je 0x150260fb
call fcn.15025320
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x15026230
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1505536c], 0
jne 0x15026262
push 1
push 0
push 0
push 0xffffffffffffffff
push str.SMemReAlloc__
push 0x8510007d
mov dword [0x15055358], 0
call sym.Storm.dll_Ordinal_461
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
je 0x150262a6
cmp word [ebx - 2], 0x6f6d
lea edi, [ebx - 8]
je 0x150262c2
push 0x8510007c
call sym.Storm.dll_Ordinal_465
cmp dword [0x15055360], 0
je 0x150262a6
mov eax, dword [esp + 0x1c]
push 1
push 1
push 0
push ebp
push eax
push 0x8510007c
call sym.Storm.dll_Ordinal_461
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
push ebp
push edx
push eax
call sym.Storm.dll_Ordinal_401
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov al, byte [edi + 3]
test al, 2
je 0x150262db
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
mov esi, 0x8510007a
call fcn.15023e60
jmp 0x150262a6
test al, 1
je 0x15026303
movzx edx, byte [edi + 2]
movzx eax, word [edi]
sub eax, edx
cmp word [eax + edi - 2], 0x12b1
je 0x15026303
mov edx, dword [esp + 0x1c]
mov ecx, ebp
push ecx
push edx
mov esi, 0x8510007b
call fcn.15023e60
test byte [edi + 3], 8
je 0x1502630c
mov edi, dword [edi - 4]
movzx esi, word [edi + 4]
shl esi, 0x10
mov eax, dword [esi + 8]
lea eax, [eax + eax*2]
lea ecx, [eax*8 + 0x15055780]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 8]
push eax
mov eax, dword [esp + 0x1c]
push edi
push ebx
push esi
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], edx
call fcn.15025e00
mov esi, eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x15026360
lea edx, [eax + eax*2]
lea eax, [edx*8 + 0x15055780]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x15027190
Capabilities:
Get file version info

Disassembly:
sub esp, 0x114
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x118]
push ebp
mov ebp, dword [esp + 0x120]
push edi
add ecx, 0xfffffffe
push ecx
push eax
push esi
call sym.Storm.dll_Ordinal_501
mov edi, esi
add edi, 0xffffffff
jmp 0x150271d0
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x150271d0
mov dx, word [0x15043b04]
mov byte [esp + 0x14], al
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
mov word [edi], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test ebp, ebp
je 0x1502721e
mov eax, dword [ebp + 4]
test eax, eax
je 0x1502721e
cmp byte [eax], 0
je 0x1502721e
mov ecx, dword [esp + 0x128]
push ecx
push eax
push esi
call sym.Storm.dll_Ordinal_503
jmp 0x150272ba
cmp byte [esp + 0x14], 0
je 0x150272ba
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
push 0
push 0xb24
mov edi, eax
push str..SNet.cpp
push edi
call sym.Storm.dll_Ordinal_401
mov ecx, dword [esp + 0xc]
mov ebp, eax
push ebp
push edi
push ecx
lea edx, [esp + 0x20]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x150272a8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push str.StringFileInfo040904b0ProductVersion
push ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x150272a8
mov eax, dword [esp + 8]
test eax, eax
je 0x150272a8
cmp byte [eax], 0
je 0x150272a8
mov edx, dword [esp + 0x128]
push edx
push eax
push esi
call sym.Storm.dll_Ordinal_503
push 0
push 0xb2f
push str..SNet.cpp
push ebp
call sym.Storm.dll_Ordinal_403
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
xor ecx, esp
call fcn.1503831e
add esp, 0x114
ret 0xc
Function at 0x1502d6c5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebp
push edi
push 0x40
push 0
push 0x150573a8
call sub.MSVCR80.dll_memset
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call ebp
mov dword [esp + 8], eax
mov edi, 1
test edi, edi
jne 0x1502d6f1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
call fcn.1502a690
call fcn.1502c1b0
call fcn.1502b260
xor edx, edx
xor eax, eax
test esi, esi
jbe 0x1502d756
lea ebx, [ebx]
mov ecx, dword [ebx + eax*4]
cmp ecx, 0x10
jae 0x1502d725
cmp dword [ecx*4 + 0x150573a8], 0
je 0x1502d725
add edx, 1
add eax, 1
cmp eax, esi
jb 0x1502d710
cmp edx, esi
jae 0x1502d756
test edx, edx
je 0x1502d73b
cmp dword [esp + 0x10], 0
je 0x1502d756
cmp dword [esp + 0x14], 0xffffffff
je 0x1502d6e5
call ebp
sub eax, dword [esp + 8]
cmp eax, dword [esp + 0x14]
jb 0x1502d6e5
pop edi
xor eax, eax
pop ebp
pop ecx
ret 8
pop edi
mov eax, 1
pop ebp
pop ecx
ret 8

Function at 0x1502d770
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x150575b0]
test eax, eax
jne 0x1502d789
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x150575b0], eax
cmp dword [0x150575b8], 0
jne 0x1502d7c6
lea eax, [esp]
push eax
push 0
push 0
push 0x1502ca20
push 0
push 0
mov dword [0x150575b4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
mov dword [0x150575b8], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x150575b0]
test esi, esi
je 0x1502d7cc
mov dword [esi], eax
test eax, eax
je 0x1502d7e0
cmp dword [0x150575b8], 0
je 0x1502d7e0
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x1502f360
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1502f3ae
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push esi
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov dword [esi], eax
mov eax, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0x10
Function at 0x1502f690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
mov dword [esp], eax
mov al, byte [esp + 0x118]
test al, 0x10
push ebp
mov dword [esi], 0
mov dword [esp + 8], ecx
mov dword [edi], 4
mov ebp, 0x3f3
mov byte [esp + 0xc], 0
jne 0x1502f6f8
test al, 2
push 0x104
je 0x1502f6e9
push str.SoftwareBattle.net_
lea edx, [esp + 0x14]
push edx
jmp 0x1502f6f3
push str.SoftwareBlizzard_Entertainment_
lea eax, [esp + 0x14]
push eax
call sym.Storm.dll_Ordinal_501
mov ecx, dword [esp + 4]
push 0x104
push ecx
lea edx, [esp + 0x14]
push edx
call sym.Storm.dll_Ordinal_503
test byte [esp + 0x11c], 4
jne 0x1502f766
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, eax
test ebp, ebp
jne 0x1502f766
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x120]
push esi
push eax
push edi
push ebp
push ebx
push ecx
mov dword [esi], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1502f795
test byte [esp + 0x11c], 1
jne 0x1502f791
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 8]
push eax
push ecx
push edi
push ebx
mov eax, esi
lea ecx, [esp + 0x1c]
mov edx, 0x80000002
call fcn.1502f360
mov ebp, eax
test ebp, ebp
jne 0x1502f7b2
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1503831e
add esp, 0x110
ret 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x110]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1503831e
add esp, 0x110
ret 0xc
Function at 0x1502f7e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x10c], eax
test bl, 0x10
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
mov esi, ecx
mov edi, edx
mov byte [esp + 0x14], 0
jne 0x1502f831
test bl, 2
push 0x104
je 0x1502f822
push str.SoftwareBattle.net_
lea eax, [esp + 0x1c]
push eax
jmp 0x1502f82c
push str.SoftwareBlizzard_Entertainment_
lea ecx, [esp + 0x1c]
push ecx
call sym.Storm.dll_Ordinal_501
push 0x104
push esi
lea edx, [esp + 0x1c]
push edx
call sym.Storm.dll_Ordinal_503
lea eax, [esp + 0x10]
push eax
mov eax, ebx
and al, 4
lea ecx, [esp + 0x10]
push ecx
push 0
neg al
push 0x20006
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x1502f8d2
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x120]
push ecx
push ebp
push edx
push eax
mov eax, dword [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x1502f8cb
test bl, 8
je 0x1502f8b9
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, eax
test esi, esi
jne 0x1502f8cb
mov edx, dword [esp + 0xc]
push edx
call edi
mov esi, eax
test esi, esi
jne 0x1502f8cb
lea eax, [esi + 1]
jmp 0x1502f8db
mov eax, dword [esp + 0xc]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1503831e
add esp, 0x110
ret 0xc

Function at 0x15034440
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x15034456
push 0x57
call sym.Storm.dll_Ordinal_465
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x15034463
mov eax, 0x7fed7fed
test byte [esp + 0xc], 1
movzx edx, byte [esi]
push ebx
push edi
mov ecx, 0xeeeeeeee
je 0x150344b5
test edx, edx
je 0x15034508
lea esp, [esp]
mov edi, edx
shr edi, 4
mov edi, dword [edi*4 + 0x15043eb8]
mov ebx, edx
and ebx, 0xf
sub edi, dword [ebx*4 + 0x15043eb8]
add eax, ecx
xor eax, edi
mov edi, ecx
shl edi, 5
add esi, 1
add edi, edx
movzx edx, byte [esi]
add edi, ecx
test edx, edx
lea ecx, [edi + eax + 3]
jne 0x15034480
jmp 0x15034508
test edx, edx
je 0x15034508
lea esp, [esp]
lea edi, [edx - 0x61]
add esi, 1
cmp edi, 0x19
ja 0x150344ce
sub edx, 0x20
cmp edx, 0x2f
jne 0x150344d8
mov edx, 0x5c
mov edi, edx
shr edi, 4
mov edi, dword [edi*4 + 0x15043eb8]
mov ebx, edx
and ebx, 0xf
sub edi, dword [ebx*4 + 0x15043eb8]
add eax, ecx
xor eax, edi
mov edi, ecx
shl edi, 5
add edi, edx
movzx edx, byte [esi]
add edi, ecx
test edx, edx
lea ecx, [edi + eax + 3]
jne 0x150344c0
test eax, eax
pop edi
pop ebx
jne 0x15034513
mov eax, 1
pop esi
ret 0xc
Function at 0x15034690
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp edx, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, 0x9e3779b9
mov dword [esp + 0x10], edx
mov ebp, edx
mov ebx, edi
jb 0x1503479c
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [esp + 0x18], edx
lea ecx, [ecx]
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [edx + eax]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
sub eax, esi
sub eax, edi
sub edi, esi
mov edx, esi
shr edx, 0xd
add eax, ebx
xor eax, edx
sub edi, eax
mov edx, eax
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 0xd
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 0xc
xor eax, edx
sub edi, esi
sub edi, eax
mov edx, eax
shl edx, 0x10
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 5
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 3
xor eax, edx
sub edi, esi
mov ebx, eax
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov edx, edi
sub esi, ebx
shr edx, 0xf
xor esi, edx
add ecx, 0xc
sub ebp, 0xc
sub dword [esp + 0x18], 1
jne 0x150346c0
mov edx, dword [esp + 0x10]
add ebp, 0xffffffff
add esi, edx
cmp ebp, 0xa
ja case.default.0x150347a6
jmp dword [ebp*4 + 0x15034874]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 9]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 7]
shl edx, 0x18
add edi, edx
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx edx, byte [ecx + 5]
shl edx, 8
add edi, edx
movzx eax, byte [ecx + 4]
add edi, eax
movzx edx, byte [ecx + 3]
shl edx, 0x18
add ebx, edx
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx edx, byte [ecx + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xd
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xc
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0x10
xor edi, edx
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
sub edi, eax
shr ecx, 3
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0xa
xor edi, edx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4