joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e06218d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x224], esi
call fcn.2e061f26
test eax, eax
je 0x2e0622a8
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
mov ebx, 0x2e01e7d8
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x2e0622a6
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x2e06229a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x2e01e7c4
push edi
push dword [ebp - 0x218]
mov ebx, 0x20a
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e06228e
cmp dword [ebp - 0x21c], 1
jne 0x2e06228e
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x2e06228e
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x2e06228e
call fcn.2e062111
test eax, eax
jne 0x2e06228e
mov dword [ebp - 0x224], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop esi
call fcn.2e06e7f2
leave
ret

Function at 0x2e062db9
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x2e08cc18
call fcn.2e06eb1c
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x2e062df7
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x2e062df7
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x2e062df7
mov eax, dword [ecx + 0x50]
jmp 0x2e062e18
mov ecx, 0x4550
cmp dx, cx
jne 0x2e062e24
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x2e062e24
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x2e062e24
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x2e062e28
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.2e06eb61
ret 4
Function at 0x2e064b0b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.2e070b05
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2e06e7f2
leave
ret

Function at 0x2e068286
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x2e0de084
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x2e0682d7
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x2e0de088], eax
mov ax, word [ebp - 0x30]
mov word [0x2e0de08c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x2e0de090], eax
mov eax, dword [ebp - 0x40]
mov dword [0x2e0de094], eax
mov eax, esi
pop esi
leave
ret
Function at 0x2e06aa05
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x2e0de13c
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x2e06ac1a
mov eax, dword [esi + 0x14]
push edi
mov edi, 0x2e0de178
cmp eax, ebx
je 0x2e06aa5b
push eax
mov ecx, edi
call fcn.2e06dafc
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x2e06ab5c
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x2e0230a8
push ebx
call fcn.2e06c4f0
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x2e06ab5c
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.2e06dad2
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x2e06ab6c
mov dword [ebp - 0x21c], ebx
cmp dword [ebp - 0x238], ebx
jbe 0x2e06ab30
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.2e06a5d4
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x2e06ab15
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x2e06ab1c
cmp eax, 0x8007000e
je 0x2e06ab47
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x2e06aadb
cmp byte [esi + 0x1d], bl
jne 0x2e06ac06
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x2e06ac06
push dword [esi + 0x14]
mov ecx, edi
call fcn.2e06dafc
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x2e06ac19
push 4
mov ecx, edi
call fcn.2e06dad2
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x2e06ab7b
mov dword [ebp - 0x218], 0x8007000e
jmp 0x2e06ac19
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.2e06dcf9
test al, al
je 0x2e06abab
cmp dword [esi + 8], 0x1000
jne 0x2e06abab
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.2e06dc9c
jmp 0x2e06abc2
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x2e06ac06
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.2e069766
test eax, eax
je 0x2e06abfa
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.2e06d8d4
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x2e06ac19
cmp dword [esi + 8], 0xc00
je 0x2e06ac13
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x2e0de13c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x2e06ac3b
lea eax, [ebp - 0x23c]
push eax
call fcn.2e06c55d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.2e06e7f2
leave
ret 4
Function at 0x2e06b3cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x2e0de154], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x2e06b3f5
mov edi, 0x8ff000ff
jmp 0x2e06b43a
test ebx, ebx
je 0x2e06b435
call fcn.2e06a9e3
mov edi, eax
test edi, edi
jl 0x2e06b43a
push esi
call fcn.2e069700
mov esi, eax
test esi, esi
je 0x2e06b435
test byte [esi + 0x1f], 4
jne 0x2e06b42c
push esi
call fcn.2e06a483
mov edi, eax
test edi, edi
jge 0x2e06b42c
cmp edi, 0x8007000e
je 0x2e06b43a
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x2e06b44d
dec eax
je 0x2e06b465
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e06e7f2
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x2e06b465
cmp byte [esi + 0x1e], 0
jbe 0x2e06b465
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x2e06b43a
cmp dword [esi + 8], 0x1000
jne 0x2e06b48c
call fcn.2e06dcf9
test al, al
je 0x2e06b48c
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.2e06dc9c
jmp 0x2e06b4a0
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x2e06b435
lea eax, [ebp - 0xc]
push eax
call fcn.2e06968b
push ebx
push eax
call fcn.2e06a98d
mov edi, eax
jmp 0x2e06b43a
Function at 0x2e06dcf9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x2e0de18b], 0
jne 0x2e06dd53
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x2e06dd4c
cmp dword [ebp - 0x110], 2
jne 0x2e06dd4c
cmp dword [ebp - 0x11c], 6
jb 0x2e06dd4c
call fcn.2e06dbaf
mov byte [0x2e0de18a], al
mov byte [0x2e0de18b], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x2e0de18a]
xor ecx, ebp
call fcn.2e06e7f2
leave
ret

Function at 0x2e06dd78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x160], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x164], ebx
call fcn.2e06dcf9
test al, al
je 0x2e06ddbf
push dword [ebp + 0x10]
push ebx
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x160], eax
jmp 0x2e06de5b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 0x56
lea eax, [ebp - 0xb0]
push eax
push 0x59
push dword [ebp + 8]
call esi
push 0x56
mov edi, eax
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push dword [ebp + 8]
call esi
cmp edi, 1
jle 0x2e06de59
cmp eax, 1
jle 0x2e06de3b
mov esi, dword [ebp + 0x10]
lea ebx, [eax + edi]
cmp ebx, esi
jg 0x2e06de59
lea eax, [ebp - 0xb0]
push eax
push esi
push dword [ebp - 0x164]
call fcn.2e070d96
mov eax, dword [ebp - 0x164]
push 0x2d
pop ecx
lea eax, [eax + edi*2]
mov word [eax - 2], cx
lea ecx, [ebp - 0x15c]
push ecx
sub esi, edi
push esi
push eax
call fcn.2e070d96
add esp, 0x18
mov dword [ebp - 0x160], ebx
jmp 0x2e06de59
cmp edi, dword [ebp + 0x10]
jg 0x2e06de59
lea eax, [ebp - 0xb0]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.2e070d96
add esp, 0xc
mov dword [ebp - 0x160], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x160]
xor ecx, ebp
pop ebx
call fcn.2e06e7f2
leave
ret 0xc
Function at 0x2e06e7f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e0c18a0]
jne 0x2e0733c4
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2e0de740], eax
mov dword [0x2e0de73c], ecx
mov dword [0x2e0de738], edx
mov dword [0x2e0de734], ebx
mov dword [0x2e0de730], esi
mov dword [0x2e0de72c], edi
mov word [0x2e0de758], ss
mov word [0x2e0de74c], cs
mov word [0x2e0de728], ds
mov word [0x2e0de724], es
mov word [0x2e0de720], fs
mov word [0x2e0de71c], gs
pushfd
pop dword [0x2e0de750]
mov eax, dword [ebp]
mov dword [0x2e0de744], eax
mov eax, dword [ebp + 4]
mov dword [0x2e0de748], eax
lea eax, [ebp + 8]
mov dword [0x2e0de754], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2e0de690], 0x10001
mov eax, dword [0x2e0de748]
mov dword [0x2e0de644], eax
mov dword [0x2e0de638], 0xc0000409
mov dword [0x2e0de63c], 1
mov eax, dword [0x2e0c18a0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x2e0c18a4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2e0de688], eax
push 1
call fcn.2e079ca8
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2e0238dc
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2e0de688], 0
jne 0x2e0734b0
push 1
call fcn.2e079ca8
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x2e07992c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.2e071d67
and dword [ebp - 4], 0
cmp dword [0x2e0deb14], 0
mov ebx, eax
jne 0x2e0799dd
push 0x2e023aa4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2e079a8e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2e023a98
push edi
call esi
test eax, eax
je 0x2e079a8e
push eax
call fcn.2e071cf5
mov dword [esp], 0x2e023a88
push edi
mov dword [0x2e0deb14], eax
call esi
push eax
call fcn.2e071cf5
mov dword [esp], 0x2e023a74
push edi
mov dword [0x2e0deb18], eax
call esi
push eax
call fcn.2e071cf5
mov dword [esp], 0x2e023a58
push edi
mov dword [0x2e0deb1c], eax
call esi
push eax
call fcn.2e071cf5
pop ecx
mov dword [0x2e0deb24], eax
test eax, eax
je 0x2e0799dd
push 0x2e023a40
push edi
call esi
push eax
call fcn.2e071cf5
pop ecx
mov dword [0x2e0deb20], eax
mov eax, dword [0x2e0deb20]
cmp eax, ebx
je 0x2e079a35
cmp dword [0x2e0deb24], ebx
je 0x2e079a35
push eax
call fcn.2e071d70
push dword [0x2e0deb24]
mov esi, eax
call fcn.2e071d70
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2e079a35
test edi, edi
je 0x2e079a35
call esi
test eax, eax
je 0x2e079a2c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2e079a2c
test byte [ebp - 0xc], 1
jne 0x2e079a35
or dword [ebp + 0x10], 0x200000
jmp 0x2e079a6e
mov eax, dword [0x2e0deb18]
cmp eax, ebx
je 0x2e079a6e
push eax
call fcn.2e071d70
pop ecx
test eax, eax
je 0x2e079a6e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2e079a6e
mov eax, dword [0x2e0deb1c]
cmp eax, ebx
je 0x2e079a6e
push eax
call fcn.2e071d70
pop ecx
test eax, eax
je 0x2e079a6e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2e0deb14]
call fcn.2e071d70
pop ecx
test eax, eax
je 0x2e079a8e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2e079a90
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2e07f1ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x2e07f1da
xor eax, eax
jmp 0x2e07f202
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x2e07f1f7
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x2e07f207
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x2e07f221
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x2e07f289
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x2e07f280
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.2e06e7f2
leave
ret
Function at 0x2e07f6c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x464]
push esi
push eax
mov dword [ebp - 0x468], 0x44
call fcn.2e06e640
xor eax, eax
mov dword [ebp - 0x424], esi
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push ebx
stosd dword es:[edi], eax
call fcn.2e025e0d
cmp eax, 0x104
jg 0x2e07f77b
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push 0x6b
push ebx
push 0x2e02465c
push 0x208
push eax
call fcn.2e06ea2b
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x2e07f77b
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
jmp 0x2e07f786
push esi
push 0x30303030
call fcn.2e0448b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e06e7f2
leave
ret 8

Function at 0x2e07ff28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.2e07fd91
test eax, eax
je 0x2e07ff99
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x2e07ff99
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2e02475c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2e07ff8f
cmp dword [ebp - 0x10], 1
je 0x2e07ff8f
mov word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x2e082afc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x2e082b3b
push esi
movzx esi, byte [ecx]
xor ebx, ebx
dec eax
inc ecx
mov bh, byte [ecx]
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or esi, ebx
inc ecx
xor edx, esi
test eax, eax
jg 0x2e082b16
pop esi
and edi, 3
xor eax, eax
dec edi
je 0x2e082b57
dec edi
je 0x2e082b50
dec edi
jne 0x2e082b5c
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
xor eax, edx
pop ebx
pop ebp
ret 0xc

Function at 0x2e083f63
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
xor edi, edi
cmp byte [ebp + 0x24], 0
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov word [ebx + 0xc], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], edi
mov esi, 0x8000
jne 0x2e083fb3
push esi
push eax
add eax, esi
push eax
call fcn.2e06e2ea
add esp, 0xc
mov word [ebx + 0x2c], di
mov dword [ebx + 0x30], edi
call fcn.2e0839bd
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], edi
push 2
mov word [ebx + 0x3c], si
mov dword [ebx + 0x34], esi
add eax, esi
pop ecx
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x2e083fd1
cmp byte [ebp + 0x24], cl
je 0x2e083ff7
mov edi, ebx
call fcn.2e08381a
jmp 0x2e084008
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x2e083ffb
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.2e082c60
push 0x4b
pop edx
call fcn.2e082c60
call fcn.2e083ce9
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x2e084046
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call fcn.2e06e2ea
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x2e0863fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
mov eax, dword [0x2e0c18a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc8c], eax
mov eax, dword [esi + 0x870]
add eax, 0x20
mov ecx, eax
shl ecx, 3
cmp ecx, 0x320
mov dword [ebp - 0xc9c], ecx
jb 0x2e086449
xor eax, eax
jmp 0x2e086625
push edi
mov edi, eax
shl edi, 4
push edi
lea eax, [ebp - 0xc84]
push 0
push eax
call fcn.2e06e640
push edi
lea eax, [ebp - 0x644]
push 0
push eax
call fcn.2e06e640
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
jbe 0x2e0865a9
mov eax, dword [ebp + 0x14]
mov edi, dword [esi + 0x30]
shl eax, 2
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
push ebx
mov ebx, dword [esi + 0x34]
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc98], ecx
jmp 0x2e0864a8
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc88]
and ecx, 7
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 0xc88]
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x2e0864d2
mov eax, dword [ebp - 0xc88]
movzx eax, byte [edi + eax]
jmp 0x2e086516
mov ecx, dword [ebp - 0xc88]
cmp byte [edi + ecx], 7
mov ecx, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x2e086500
call fcn.2e084766
mov ecx, dword [ebp - 0xc88]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x2e08650f
call fcn.2e084766
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc94], 4
inc dword [ebp - 0xc88]
lea eax, [ebp + eax*2 - 0xc84]
inc word [eax]
mov eax, dword [ebp - 0xc8c]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x2e086548
movzx eax, byte [edi + eax]
jmp 0x2e08658c
cmp byte [edi + eax], 7
mov ecx, dword [ebp - 0xc90]
mov eax, dword [esi + 0x2c]
push dword [eax + ecx]
push esi
jae 0x2e086576
call fcn.2e084766
mov ecx, dword [ebp - 0xc8c]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x2e086585
call fcn.2e084766
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc90], 4
inc dword [ebp - 0xc8c]
lea eax, [ebp + eax*2 - 0x644]
inc word [eax]
dec dword [ebp - 0xc98]
jne 0x2e0864a2
pop ebx
xor esi, esi
xor edi, edi
cmp dword [ebp - 0xc9c], esi
jbe 0x2e086622
movzx eax, word [ebp + esi*2 - 0xc84]
cmp ax, 0x100
movzx eax, ax
jae 0x2e0865cf
movzx eax, byte [eax + 0x2e024a40]
jmp 0x2e0865dc
shr eax, 8
movzx eax, byte [eax + 0x2e024a40]
add eax, 8
movzx ecx, word [ebp + esi*2 - 0x644]
cmp cx, 0x100
movzx ecx, cx
jae 0x2e0865f7
movzx ecx, byte [ecx + 0x2e024a40]
jmp 0x2e086604
shr ecx, 8
movzx ecx, byte [ecx + 0x2e024a40]
add ecx, 8
mov eax, dword [eax*4 + 0x2e0249f8]
sub eax, dword [ecx*4 + 0x2e0249f8]
cdq
xor eax, edx
sub eax, edx
add edi, eax
inc esi
cmp esi, dword [ebp - 0xc9c]
jb 0x2e0865b5
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.2e06e7f2
leave
ret 0x14