joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f0f0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0xbc], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x98
stosb byte es:[edi], al
lea eax, [ebp - 0xac]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x446a6e49
mov edi, 0x1000
push edi
push ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
lea eax, [ebp - 0xac]
push eax
call fcn.00019786
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp + 0x10]
jg 0x1f1e7
jl 0x1f180
mov eax, dword [ebp - 0xb4]
jmp 0x1f1e2
push ebx
lea eax, [ebp - 0xb4]
push eax
push edi
push esi
lea eax, [ebp - 0xc8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc0]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, ebx
mov dword [ebp - 0xb8], eax
jl 0x1f223
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xc4]
push esi
call fcn.00019eac
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0xc4]
mov ecx, dword [ebp + 0x10]
adc dword [ebp - 0xb0], ebx
cmp dword [ebp - 0xb0], ecx
mov dword [ebp - 0xb4], eax
jl 0x1f180
jg 0x1f1e7
cmp eax, dword [ebp + 0xc]
jb 0x1f180
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00019f4c
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [ebp - 0xbc]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xb8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 0x10
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1f20c

Function at 0x1f2d2
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [edi + 0x20e], 0
je 0x1f2ec
mov eax, 0x80
jmp 0x1f346
mov eax, 0x1f2cc
push esi
mov esi, 0x1f270
mov ecx, eax
sub ecx, esi
mov dword [ebp + 0xc], ecx
cmp eax, esi
jae 0x1f309
mov dword [ebp + 0xc], 0x100
and dword [ebp - 4], 0
push 0x40
push 0x1000
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jl 0x1f345
push dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0001dc4a
pop esi
pop edi
leave
ret 8
Function at 0x20290
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor eax, eax
push eax
mov esi, 0x28b50
mov edi, 0x28bec
movsd dword es:[edi], dword [esi]
push 0x20200
push eax
movsd dword es:[edi], dword [esi]
push eax
push eax
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 4]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
pop edi
pop esi
test eax, eax
jl 0x202cb
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
leave
ret

Function at 0x20486
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0xc], 0x34
mov byte [ebp - 0x20d], bl
jb 0x205e0
add esi, 0x10
cmp esi, ebx
je 0x205e0
push edi
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [ebp - 0x214], ebx
call sub.ntoskrnl.exe_memset
push esi
push 0x22650
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.000113da
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x234]
push eax
call edi
lea eax, [ebp - 0x234]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
push 0x30006
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x22c], 0x18
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], 0x240
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jge 0x20566
push 0x22644
jmp 0x205c6
cmp dword [esi + 0x2c], ebx
jne 0x20589
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
test eax, eax
jl 0x20582
push 0x2263a
jmp 0x205c6
push 0x2262e
jmp 0x205c6
push 0x22624
lea eax, [ebp - 0x240]
push eax
call edi
push dword [esi + 0x2c]
add esi, 0x30
push esi
push 3
push ebx
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
jl 0x205c1
mov byte [ebp - 0x20d], 1
jmp 0x205cb
push 0x22618
call fcn.0001c9b0
pop edi
cmp dword [ebp - 0x214], ebx
je 0x205e0
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 4

Function at 0x20cc3
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
mov ebx, eax
or ebx, ecx
or ebx, edx
push esi
test bl, 3
jne 0x20ce8
shr edx, 2
test edx, edx
jbe 0x20cf9
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x20cdb
jmp 0x20cf9
test edx, edx
jbe 0x20cf9
sub ecx, eax
mov esi, edx
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x20cf0
pop esi
pop ebx
ret
Function at 0x2b9f4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x18]
push edi
test ecx, ecx
jge 0x2ba21
cmp ecx, 0xc000010e
je 0x2ba21
add eax, 4
push eax
push dword [eax]
push edx
call fcn.0002b78c
jmp 0x2ba28
push edx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov edi, dword [esi + 0x18]
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x2bae4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x18], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x24]
jl 0x2bb4e
mov ecx, 0x2a180
call dword [sym.imp.HAL.dll_ExAcquireFastMutex]
lea eax, [ebp + 0x10]
push eax
push dword [esi + 8]
call fcn.0002bab6
push edi
test al, al
jne 0x2bb32
push dword [esi + 8]
call fcn.0002b7dc
test eax, eax
jge 0x2bb41
push edi
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x2bb41
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov ecx, dword [ebp + 0x10]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ecx, 0x2a180
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
jmp 0x2bb55
push edi
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov esi, dword [ebx + 0x18]
xor dl, dl
mov ecx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x2bb70
Capabilities:
Create device object

Disassembly:
push 0xb4
push 0x26298
call fcn.00020abc
mov edi, dword [ebp + 8]
mov dword [ebp - 0xbc], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xa4]
push eax
xor ebx, ebx
push ebx
push ebx
push dword [edi + 8]
call dword [0x27b4c]
mov esi, eax
cmp esi, ebx
jge 0x2bdc9
add dword [ebp - 0xa4], 8
push 0x746c4653
mov eax, dword [ebp - 0xa4]
shl eax, 2
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xac], eax
cmp eax, ebx
jne 0x2bbe0
mov eax, 0xc000009a
jmp 0x2bdcb
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp - 0xa4]
shl ecx, 2
push ecx
push eax
push dword [edi + 8]
call dword [0x27b4c]
mov esi, eax
cmp esi, ebx
jl 0x2bdbc
xor edi, edi
mov dword [ebp - 0xb4], edi
cmp edi, dword [ebp - 0xa4]
jae 0x2bdba
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xac]
lea esi, [eax + edi*4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xbc]
cmp eax, ecx
je 0x2bd80
mov edx, dword [eax + 0x2c]
cmp edx, dword [ecx + 0x2c]
jne 0x2bd80
push ebx
push eax
call fcn.0002bab6
test al, al
jne 0x2bd80
push dword [ebp - 0xb8]
push dword [esi]
call fcn.0001886e
mov eax, dword [ebp - 0xb8]
cmp word [eax], bx
ja 0x2bd80
lea eax, [ebp - 0xa8]
push eax
push dword [esi]
call dword [0x27b58]
cmp eax, ebx
jl 0x2bd80
lea eax, [ebp - 0x9d]
push eax
push dword [ebp - 0xa8]
call fcn.0002b2b8
cmp eax, ebx
jl 0x2bce8
cmp byte [ebp - 0x9d], bl
je 0x2bce8
test byte [0x27b74], 0x20
jne 0x2bce8
xor eax, eax
mov word [ebp - 0xc4], ax
mov eax, 0x80
mov word [ebp - 0xc2], ax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xa8]
call fcn.0001880c
jmp 0x2bd80
lea eax, [ebp - 0xb0]
push eax
push ebx
push ebx
mov eax, dword [esi]
push dword [eax + 0x2c]
push ebx
push 0x94
push dword [0x27b6c]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
jl 0x2bd80
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 0xa8]
mov dword [ecx + 8], eax
lea eax, [ecx + 0xc]
xor edx, edx
mov word [eax], dx
mov edx, 0x80
mov word [eax + 2], dx
add ecx, 0x14
mov dword [eax + 4], ecx
push eax
push dword [ebp - 0xa8]
call fcn.0001880c
mov ecx, 0x2a180
call dword [sym.imp.HAL.dll_ExAcquireFastMutex]
push ebx
push dword [esi]
call fcn.0002bab6
push dword [ebp - 0xb0]
test al, al
jne 0x2bd6f
push dword [esi]
call fcn.0002b7dc
cmp eax, ebx
jge 0x2bd75
push dword [ebp - 0xb0]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov ecx, 0x2a180
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
mov dword [ebp - 4], 0xfffffffe
call fcn.0002bd9a
inc edi
jmp 0x2bc07
xor esi, esi
push ebx
push dword [ebp - 0xac]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
call fcn.00020b04
ret 8
Function at 0x2bef0
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [edi + 0x2c]
cmp eax, 8
je 0x2bf2b
cmp eax, 3
je 0x2bf2b
cmp eax, 0x14
je 0x2bf2b
xor eax, eax
jmp 0x2c08a
xor eax, eax
test byte [0x27b74], 0x10
mov word [ebp - 0x90], ax
mov eax, 0x80
mov word [ebp - 0x8e], ax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x8c], eax
jne 0x2bf90
push 0x2c484
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x90]
push eax
push dword [edi + 8]
call fcn.0001880c
push 1
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
je 0x2bf24
push esi
lea eax, [ebp - 0x88]
push eax
xor esi, esi
push esi
push esi
push dword [edi + 0x2c]
push esi
push 0x94
push dword [0x27b6c]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, esi
jl 0x2c089
test byte [edi + 0x1c], 4
je 0x2bfc9
mov eax, dword [ebp - 0x88]
or dword [eax + 0x1c], 4
test byte [edi + 0x1c], 0x10
je 0x2bfd9
mov eax, dword [ebp - 0x88]
or dword [eax + 0x1c], 0x10
mov eax, 0x100
test dword [edi + 0x20], eax
je 0x2bfec
mov ecx, dword [ebp - 0x88]
or dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
push ebx
lea ecx, [esi + 4]
push ecx
push edi
push eax
mov dword [ebp - 0x94], ecx
call fcn.0002b78c
mov ebx, eax
test ebx, ebx
jl 0x2c076
push dword [ebp - 0x98]
lea eax, [esi + 0xc]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x80
add esi, 0x14
push eax
mov word [eax + 2], cx
mov dword [eax + 4], esi
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov eax, dword [ebp - 0x88]
and dword [eax + 0x1c], 0xffffff7f
mov eax, dword [0x27b64]
cmp eax, 5
jne 0x2c053
cmp dword [0x27b68], 1
jae 0x2c055
cmp eax, eax
jbe 0x2c086
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.0002bb70
mov ebx, eax
test ebx, ebx
jge 0x2c086
mov eax, dword [ebp - 0x94]
push dword [eax]
call dword [sym.imp.ntoskrnl.exe_IoDetachDevice]
push dword [ebp - 0x88]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x2c088
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00020898
leave
ret 8
Function at 0x2c114
Capabilities:
Complete processing asynchronous io request
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 4]
push edi
mov edi, dword [eax + 0xc]
lea eax, [ebp - 0x85]
push eax
push edi
mov dword [ebp - 0x94], esi
call fcn.0002b2b8
test eax, eax
jl 0x2c1a7
cmp byte [ebp - 0x85], 0
je 0x2c1a7
test byte [0x27b74], 0x20
jne 0x2c1a7
xor eax, eax
mov word [ebp - 0x98], ax
mov eax, 0x80
mov word [ebp - 0x96], ax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x98]
push eax
push edi
call fcn.0001880c
inc byte [ebx + 0x23]
add dword [ebx + 0x60], 0x24
jmp 0x2c301
lea eax, [ebp - 0x90]
push eax
xor eax, eax
push eax
push eax
push dword [esi + 0x2c]
push eax
push 0x94
push dword [0x27b6c]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0x9c], eax
test eax, eax
jge 0x2c1ed
and dword [ebx + 0x1c], 0
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebp - 0x9c]
jmp 0x2c312
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x28]
lea eax, [ecx + 0xc]
mov dword [ecx + 8], edi
xor edx, edx
mov word [eax], dx
push eax
mov edx, 0x80
add ecx, 0x14
push edi
mov word [eax + 2], dx
mov dword [eax + 4], ecx
call fcn.0001880c
mov eax, dword [0x27b64]
cmp eax, 5
jne 0x2c22c
cmp dword [0x27b68], 1
jae 0x2c22e
cmp eax, eax
jbe 0x2c2a9
push 0
push 0
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov esi, dword [ebx + 0x60]
lea eax, [esi - 0x24]
mov edi, eax
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 3], 0
mov eax, dword [ebx + 0x60]
sub eax, 0x24
lea ecx, [ebp - 0xac]
mov dword [eax + 0x1c], 0x186b6
mov dword [eax + 0x20], ecx
mov byte [eax + 3], 0xe0
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 4]
mov edx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x2c295
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
push dword [ebp - 0x90]
push ebx
push dword [ebp - 0x94]
call fcn.0002bae4
jmp 0x2c312
push 0x746c4653
push 0x1c
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test eax, eax
je 0x2c19b
and dword [eax], 0
mov dword [eax + 8], 0x18a9e
mov dword [eax + 0xc], eax
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], ebx
mov ecx, dword [ebp - 0x90]
mov dword [eax + 0x18], ecx
mov esi, dword [ebx + 0x60]
lea edx, [esi - 0x24]
push 7
pop ecx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov byte [edx + 3], 0
mov ecx, dword [ebx + 0x60]
sub ecx, 0x24
mov dword [ecx + 0x1c], 0x186b6
mov dword [ecx + 0x20], eax
mov byte [ecx + 3], 0xe0
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 4]
mov edx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 8
Function at 0x2c37a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
and dword [ebp - 0x14], 0
lea ecx, [eax + edx + 0x78]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
push ebx
push esi
mov dword [ebp - 0x18], ecx
add ecx, edx
mov esi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
push edi
mov edi, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
add esi, edx
add edi, edx
add ebx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jbe 0x2c437
movsx eax, word [edi + eax*2]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + eax*4]
cmp eax, ecx
jb 0x2c3dc
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp dword [esi + eax*4], ecx
jb 0x2c42b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebx + eax*4]
add eax, edx
mov dword [ebp - 4], eax
mov al, byte [eax]
mov ecx, dword [ebp - 0xc]
cmp al, byte [ecx]
jne 0x2c422
test al, al
je 0x2c41e
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
mov byte [ebp + 0xb], al
cmp al, byte [ecx + 1]
jne 0x2c422
mov eax, dword [ebp - 4]
inc eax
inc eax
inc ecx
inc ecx
cmp byte [ebp + 0xb], 0
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jne 0x2c3f0
xor eax, eax
jmp 0x2c427
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x2c441
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x20]
jb 0x2c3be
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0x10]
mov eax, dword [esi + eax*4]
add eax, edx
jmp 0x2c43a

Function at 0x2d14e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [0x27b74], esi
jne 0x2d1fb
lea eax, [ebp - 0x19]
and eax, 0x7fffffff
mov ecx, esi
jl 0x2d1b9
cmp ecx, esi
je 0x2d189
inc ecx
cmp ecx, eax
jle 0x2d17e
jmp 0x2d1b9
lea eax, [ebp - 0x3c]
push eax
push 0x20019
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jl 0x2d1fb
push 0x2d6e0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x40]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jl 0x2d1f2
mov eax, dword [ebp - 0xc]
mov dword [0x27b74], eax
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00020898
leave
ret 4
Function at 0x469263
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx - 0x5605d949], ah
inc dword [eax - 0x11]
lcall 0xdcff, 0x9aa4f37c
in eax, dx
jp 0x7cecc625
xor esp, dword [esi - 0x65111b84]
or dword [eax - 0x1b8365ec], ebx
in al, 0xee
lcall 0xe47c, 0x9a149809
out dx, al
and eax, 0x50fdd0d1
push esp
insb byte es:[edi], dx
scasd eax, dword es:[edi]
test eax, 0xb7086832
jge 0x469277
out dx, al
push ds
cmp al, 0xf3
lodsb al, byte [esi]
push 0xffffffffffffff8b
push 0xe47c9aa4
jbe 0x46930b
add al, 0xb5
sbb cl, dl
mov eax, 0x821fded
in al, 0xee
lcall 0xa390, 0x27afa28b
jnp 0x4692cb
int3
push ebp
add dl, ah
dec edx
in eax, 0x84
add eax, 0x9b92afd4
scasd eax, dword es:[edi]
xchg edx, eax
wait
movsd dword es:[edi], dword [esi]
call 0x7a009878
out dx, eax
mov byte [0x584e1fb4], cl
sbb byte [0xdc29ecbe], ah
mov bl, dh
jno 0x469325
jl 0x4692d3
out dx, al
test eax, 0x232eec32
mov esi, 0x8d0f2fec
jecxz 0x46932f
sub byte [ebp - 0x77204a4a], 0xe4
out dx, al
lcall 0xe37b, 0x9897cd7c
jns 0x4692fc
mov bl, ah
xor eax, dword [edx - 0x6601d6bd]
jecxz 0x469343
add byte [ebx + 0x29], 0xfe
cdq
invalid
jnp 0x4692fa
in eax, dx
adc dword [ebx], 0xffffffe2
in eax, dx
cdq
or dword [eax - 0x1b8365ec], ebx
out dx, al
push ds
cmp al, 0xf3
jae 0x4692d1
jnp 0x46930e
in eax, dx
push esp
jge 0x469313
out dx, al
lcall 0xe385, 0x1efdb601
in eax, dx
cdq
pop es
xor dword [esi], edx
ror ecx, cl
int3
fisub word [0xa271f4d1]
sub byte [edi + 0x33], 0xa6
jmp [eax + 0x43daf50a]
Function at 0x103b4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.103b41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103b407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b406a
add dl, dl
jne 0x103b4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b40dc
xor eax, eax
add dl, dl
jne 0x103b4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b417d
add dl, dl
jne 0x103b40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103b40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x103b4075
mov eax, 1
add dl, dl
jne 0x103b40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b40e1
sub eax, ebx
mov ebx, 1
jne 0x103b4128
mov ecx, 1
add dl, dl
jne 0x103b410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103b4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103b413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103b414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b4136
cmp eax, 0x7d00
jae 0x103b416d
cmp eax, 0x500
jb 0x103b4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b4075
cmp eax, 0x7f
ja 0x103b4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103b419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x103b4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10