joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d001
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41ecc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406d15
and dword [ebp - 0x14], 0
cmp dword [0x817aa4], 0
mov dword [ebp - 0x18], eax
jne 0x40d0b4
push 0x403198
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d15c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40318c
push ebx
call edi
test eax, eax
je 0x40d15c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40317c
push ebx
mov dword [0x817aa4], eax
call edi
push eax
call esi
push 0x403168
push ebx
mov dword [0x817aa8], eax
call edi
push eax
call esi
push 0x40314c
push ebx
mov dword [0x817aac], eax
call edi
push eax
call esi
mov dword [0x817ab4], eax
test eax, eax
je 0x40d0b4
push 0x403134
push ebx
call edi
push eax
call esi
mov dword [0x817ab0], eax
mov eax, dword [0x817ab0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d10d
cmp dword [0x817ab4], ecx
je 0x40d10d
push eax
call esi
push dword [0x817ab4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d10d
test ebx, ebx
je 0x40d10d
call edi
test eax, eax
je 0x40d104
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d104
test byte [ebp - 8], 1
jne 0x40d10d
or dword [ebp + 0x10], 0x200000
jmp 0x40d140
mov eax, dword [0x817aa8]
cmp eax, dword [ebp - 0x18]
je 0x40d140
push eax
call esi
test eax, eax
je 0x40d140
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d140
mov eax, dword [0x817aac]
cmp eax, dword [ebp - 0x18]
je 0x40d140
push eax
call esi
test eax, eax
je 0x40d140
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x817aa4]
call esi
test eax, eax
je 0x40d15c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d15e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405e40
leave
ret
Function at 0x40e4d0
Capabilities:
Delete directory
Delete file
Get common file path
Read .ini file
Set file attributes

Disassembly:
mov eax, 0x1cbc
call fcn.0040e210
cmp dword [0x1f15124], 0x37
jne 0x40e628
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x4031e4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x403200
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x40320c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0xb8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
lea edx, [esp + 0x8bc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 4]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 0
lea ecx, [esp + 0x10bc]
push ecx
push 0x40321c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x4bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x403250
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0x403298
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 4]
push ecx
push 0x4032c0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x14b8]
push edx
push 0
push 0x403374
push 0x4033a8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
push 0x4033b8
push 0
push 0x4033f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [0x1f15128]
mov edx, dword [0x1f0feec]
mov cl, byte [eax + esi + 0x39ee]
mov byte [edx + esi], cl
add esp, 0x1cbc
ret
Function at 0x4031be
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4031d2
cmp dl, 0xcc
jne 0x40321c
inc eax
cmp eax, 0xffffffff
jle 0x4031c5
mov al, byte [ecx]
cmp al, 0x8b
je 0x4031e2
cmp al, 0x89
jne 0x40321c
cmp byte [ecx + 1], 0xff
jne 0x40321c
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x403219
Function at 0x10002799
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0
lea eax, [ebp - 0x104]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x100027bb
leave
ret
jle 0x100027cd
jg 0x100027cd
inc ebx
xor byte [eax - 0x72c625aa], cl
test esp, edi
invalid
lea eax, [ebp - 0x104]
push 0x100099cc
push eax
push 0x100099ec
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 1
pop eax
leave
ret

Function at 0x100027ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
mov dword [ebp - 4], 4
jl 0x1000281d
push edi
mov edi, 0x513b465
pop edi
jge 0x1000281d
sbb dl, bl
pop ss
push es
mov dl, 0xf4
dec esi
or edi, ebp
stosb byte es:[edi], al
sub dl, dl
aad 0x79
jb 0x10002822
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x100092dc
push 0x100092a8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10004d4f
add esp, 0x18
test eax, eax
jne 0x10002961
inc ebp
hlt
xor dl, dl
mov ecx, 0x81
lea edi, [ebp - 0x46f]
mov byte [ebp - 0x470], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x163]
mov byte [ebp - 0x164], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
mov esi, 0x104
lea eax, [ebp - 0x268]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jo 0x100028c8
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x100028c8
invalid
lea eax, [ebp - 0x164]
push esi
push eax
push dword [0x10009fac]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x470]
push 0x10009304
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x44
xor esi, esi
pop edi
lea eax, [ebp - 0x60]
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], edi
call sub.MSVCRT.dll_memset
add esp, 0x28
jo 0x10002941
push cx
mov ch, 0xe0
pop cx
jno 0x10002941
mov esp, 0x1e26fa6d
invalid
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x470]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10002965
xor eax, eax
jmp 0x10002980
pushal
sub dl, 0x33
and dh, 0x12
popal
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002bb9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 0x20019
mov edi, 0x10009a40
push ebx
mov esi, SysReAllocString
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002c7b
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10002c7b
mov eax, dword [ebp - 8]
lea ebx, [eax - 1]
test ebx, ebx
jl 0x10002c6a
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10002c7b
lea eax, [ebp - 0x11c]
push eax
push edi
lea eax, [ebp - 0x220]
push 0x100093d0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
dec ebx
jns 0x10002c13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x10002c76

Function at 0x100030cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x158]
push 0x10009c70
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x28
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
lea eax, [ebp - 0x158]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop esi
leave
ret

Function at 0x1000313e
Capabilities:
Delete file
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ebx, 0x100092fc
push eax
mov edi, 0x100092a8
push ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push esi
mov dword [ebp - 4], 4
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x10003192
push 0
lea eax, [ebp - 0x110]
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x10003196
xor eax, eax
jmp 0x100031c2
lea eax, [ebp - 0x110]
push 0x10009c94
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x110]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100043bb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x10004443
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
mov dword [ebp - 8], eax
je 0x10004443
push ecx
xor ecx, 0x6dd
inc cx
cmp cl, 0x23
add ch, al
xor ecx, edx
cmp cl, cl
test ch, 0x2b
cmp cx, cx
cmp ch, 0x51
or ecx, ecx
pop ecx
cmp dword [ebp - 4], 2
jne 0x10004443
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x2d
jne 0x1000442f
push 1
pop eax
jmp 0x10004445
push eax
call fcn.10005b0e
test eax, eax
pop ecx
je 0x10004443
mov eax, dword [ebp + 8]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100045f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
js 0x10004607
mov edx, edx
jns 0x10004607
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp edi, edi
jne 0x1000462a
push dword [ebp + 0x20]
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push eax
mov edi, SysReAllocString
push dword [ebp + 0x20]
push 1
push 0
push dword [ebp + 0xc]
push edi
call esi
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
mov ebx, 0x1000999c
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebx
push 1
push 0x10009994
push dword [ebp + 0x10]
push edi
call esi
jb 0x10004673
push esi
mov esi, 0xb484b386
pop esi
jae 0x10004673
out 0xbd, eax
retf
mov ebx, 0x10009978
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebx
push 1
push 0
push dword [ebp + 0x14]
push edi
call esi
cmp dword [ebp + 8], 1
je 0x100046e1
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
push dword [ebp + 0x24]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 0x24]
push 1
push 0
push dword [ebp + 0x18]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
push 0
push 0
push 1
push 0x100099b0
push dword [ebp + 0x1c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10004bf6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 1
pop edi
push ecx
dec ecx
and cx, di
or cx, 0x61be
pop ecx
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10004c2f
xor eax, eax
jmp 0x10004c73
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10004c63
xor edi, edi
push ebx
and bx, cx
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10004d4f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 1
pop esi
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10004d8c
xor eax, eax
jmp 0x10004dc5
push eax
test edx, eax
cmp eax, ecx
pop eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10004daf
xor esi, esi
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10006195
Capabilities:
Delete file
Delete registry key
Delete registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
and byte [ebp - 0x114], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10009c1c
push 0x10009bd4
push esi
mov dword [ebp - 4], 0x104
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x100062ef
lea eax, [ebp - 4]
mov ebx, 0x100092f8
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov edi, 0x100092a8
push ebx
push edi
push esi
mov dword [ebp - 4], 4
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x10006240
push 0x10009c84
call fcn.100030cb
mov dword [esp], 0x10009bd4
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
jmp 0x1000631d
push 1
pop edi
lea eax, [ebp - 0x114]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
test eax, eax
pop ecx
je 0x100062ef
and byte [eax], 0
mov eax, edi
dec edi
test eax, eax
jne 0x10006243
lea eax, [ebp - 0x114]
push 0x10009c28
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x114]
push 0x10009c44
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x100062ef
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call edi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp - 8]
mov edi, eax
push 0
push edi
call sub.MSVCRT.dll_memset
push ebx
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x40
push edi
call fcn.10002fd1
pop ecx
cmp eax, 0xffffffff
push edi
jne 0x100062f3
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
jmp 0x10006320
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10009bd4
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x10009c84
call fcn.100030cb
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100066b6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and byte [ebp - 0x110], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
and dword [ebp - 0xc], 0
mov dword [ebp - 4], 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10003506
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 8]
push eax
push 0x10009244
push 0x10009218
push SysReAllocString
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x10006752
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
lea eax, [ebp - 0x110]
push eax
call fcn.10002fd1
cmp eax, 0xffffffff
pop ecx
je 0x10006752
inc eax
mov dword [ebp - 0xc], eax
je 0x10006770
push edi
mov di, 0x9ce2
pop edi
jne 0x10006770
insd dword es:[edi], dx
dec esp
jl 0x100067da
jb 0x1000679e
xor eax, 0xdee0ed6d
insd dword es:[edi], dx
in eax, dx
loopne 0x1000674b
aad 0xcf
xor bh, bh
jne 0x10006767
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push dword [ebp - 4]
jne 0x1000679c
push esi
push esi
push VariantInit
push 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
leave
ret
adc byte [eax - 0x77], dl
jne 0x100067db
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x24]
push esi
push eax
push edi
mov dword [ebp - 8], 0x10009a04
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push esi
push dword [ebp - 4]
push esi
push esi
push 4
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
cmp dword [ebp - 4], esi
jne 0x1000681d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
leave
ret

Function at 0x10006821
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.10006779
push esi
call fcn.100067be
pop ecx
pop ecx
pop esi
ret
Function at 0x10006cef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
jb 0x10006d12
nop
nop
mov edi, edi
xchg dl, dl
jae 0x10006d12
adc ebx, dword [ebx + edx*4 + 0x69]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006eae
push edx
add edx, 0x2915
sub dl, ah
pop edx
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push esi
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10006e99
jp 0x10006d82
push si
pop si
jnp 0x10006d82
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x10006d74
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx - 0x75], eax
inc ebp
hlt
mov eax, dword [ebp - 0xc]
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x14], eax
je 0x10006e99
jo 0x10006dbc
push dx
mov dx, 0x7a78
pop dx
jno 0x10006dbc
add byte [eax], al
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x10006e27
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0x89f87539
jne 0x10006daa
cmp dword [ebp - 8], esi
mov dword [ebp - 0x18], esi
jbe 0x10006e90
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
jo 0x10006ddd
push ecx
mov ecx, 0x9bcdcc09
pop ecx
jno 0x10006ddd
inc eax
movsd dword es:[edi], dword [esi]
mov edx, 0x8d565656
inc ebp
invalid
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10006e2b
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll__strupr]
pop ecx
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
push 0x100093d8
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x10006e38
xor esi, esi
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jb 0x10006dc8
jmp 0x10006e90
and byte [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21f]
push dword [ebp - 0x14]
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x220]
push 0x100093d0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jp 0x10006ea5
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x10006ea5
cmp edi, 0x75
cld
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret