joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dd50
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x34
lea eax, [esp]
push ebx
push esi
push 0x32
push eax
push str.DD_ERRCODE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1000dd74
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 8]
test ecx, ecx
jne 0x1000dd85
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
mov esi, 0x10073a6c
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000ddb6
test cl, cl
je 0x1000ddb2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000ddb6
add eax, 2
add esi, 2
test cl, cl
jne 0x1000dd8e
xor eax, eax
jmp 0x1000ddbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000df10
mov esi, 0x10073a68
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000ddf4
test cl, cl
je 0x1000ddf0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000ddf4
add eax, 2
add esi, 2
test cl, cl
jne 0x1000ddcc
xor eax, eax
jmp 0x1000ddf9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000df10
mov esi, 0x10073a64
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000de32
test cl, cl
je 0x1000de2e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000de32
add eax, 2
add esi, 2
test cl, cl
jne 0x1000de0a
xor eax, eax
jmp 0x1000de37
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000df05
mov esi, 0x10073a60
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000de70
test cl, cl
je 0x1000de6c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000de70
add eax, 2
add esi, 2
test cl, cl
jne 0x1000de48
xor eax, eax
jmp 0x1000de75
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000df05
mov esi, str.soft
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000deae
test cl, cl
je 0x1000deaa
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000deae
add eax, 2
add esi, 2
test cl, cl
jne 0x1000de86
xor eax, eax
jmp 0x1000deb3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000defa
mov esi, str.SOFT
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000dee8
test cl, cl
je 0x1000dee4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000dee8
add eax, 2
add esi, 2
test cl, cl
jne 0x1000dec0
xor eax, eax
jmp 0x1000deed
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000defa
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
mov eax, 2
pop esi
pop ebx
add esp, 0x34
ret
mov eax, 1
pop esi
pop ebx
add esp, 0x34
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x34
ret

Function at 0x1000df20
Capabilities:
Identify system language via api

Disassembly:
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xff
cmp ax, 0xc
jne 0x1000df39
mov esi, 1
cmp ax, 7
jne 0x1000df44
mov esi, 2
cmp ax, 0xa
jne 0x1000df4f
mov esi, 3
mov eax, esi
pop esi
ret
Function at 0x10050390
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004fb6a

Function at 0x1005039b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004fda5

Function at 0x100584b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100580bb

Function at 0x100584c1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005823c

Function at 0x1005c37b
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005c102
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x89877ac
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x60042ca
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403340
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040cdc0
mov eax, dword [0xa3e52c]
mov ecx, dword [0xa3e49c]
shr eax, 3
test eax, eax
jbe 0x403472
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403390
cmp dword [0xa3e52c], 0x959
jne 0x403454
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x1024]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402d38
push 0x402d48
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403160
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403390
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x403d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1830
call fcn.0040cdc0
cmp dword [0xa3e52c], 0xc
push ebx
push ebp
push esi
push edi
jne 0x403e23
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
lea ecx, [esp + 0xc48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
push 0x402df8
push 0x402e14
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402e30
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
lea eax, [esp + 0x1044]
push eax
push 0x402e64
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402e70
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call fcn.00403edf
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.0040421a
fstp st(0)
add esp, 8
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x403e55
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1044]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14ee8
jl 0x403e37
mov edx, dword [0x4316d4]
mov eax, dword [0x4316a8]
mov dword [0xa3e52c], edx
mov dword [0xa3fe34], eax
call fcn.00403580
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4072e3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430ab0]
jne 0x4072ed
repz ret
jmp fcn.0040a61b
Function at 0x40a1ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405648
and dword [ebp - 4], 0
cmp dword [0x431fa8], 0
mov ebx, eax
jne 0x40a25e
push 0x4023cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a30f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023c0
push edi
call esi
test eax, eax
je 0x40a30f
push eax
call fcn.004055d6
mov dword [esp], 0x4023b0
push edi
mov dword [0x431fa8], eax
call esi
push eax
call fcn.004055d6
mov dword [esp], 0x40239c
push edi
mov dword [0x431fac], eax
call esi
push eax
call fcn.004055d6
mov dword [esp], 0x402380
push edi
mov dword [0x431fb0], eax
call esi
push eax
call fcn.004055d6
pop ecx
mov dword [0x431fb8], eax
test eax, eax
je 0x40a25e
push 0x402368
push edi
call esi
push eax
call fcn.004055d6
pop ecx
mov dword [0x431fb4], eax
mov eax, dword [0x431fb4]
cmp eax, ebx
je 0x40a2b6
cmp dword [0x431fb8], ebx
je 0x40a2b6
push eax
call fcn.00405651
push dword [0x431fb8]
mov esi, eax
call fcn.00405651
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a2b6
test edi, edi
je 0x40a2b6
call esi
test eax, eax
je 0x40a2ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a2ad
test byte [ebp - 0xc], 1
jne 0x40a2b6
or dword [ebp + 0x10], 0x200000
jmp 0x40a2ef
mov eax, dword [0x431fac]
cmp eax, ebx
je 0x40a2ef
push eax
call fcn.00405651
pop ecx
test eax, eax
je 0x40a2ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a2ef
mov eax, dword [0x431fb0]
cmp eax, ebx
je 0x40a2ef
push eax
call fcn.00405651
pop ecx
test eax, eax
je 0x40a2ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431fa8]
call fcn.00405651
pop ecx
test eax, eax
je 0x40a30f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a311
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ac9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
jmp loc.0100ab2a

Function at 0x1001b21
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x10011ec
call fcn.01001ac9
test eax, eax
je 0x1001b52
xor eax, eax
jmp fcn.01001b89
jmp loc.01007bd7

Function at 0x1001cac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100124c
push ebx
mov dword [edi + 0x18], ebx
call esi
test eax, eax
mov dword [edi], eax
je 0x1001d19
push 0x1001244
push ebx
call esi
test eax, eax
mov dword [edi + 4], eax
je 0x1001d19
push 0x1001238
push ebx
call esi
test eax, eax
mov dword [edi + 8], eax
je 0x1001d19
push 0x1001220
push ebx
call esi
jmp loc.01009b13
jmp loc.0100802e

Function at 0x1001e83
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10055dc]
test eax, eax
jne fcn.01001ea4
jmp loc.010087b1

Function at 0x1001f4f
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and eax, dword [ebp + 8]
cmp dword [ebp + 8], 0x10
mov ecx, eax
mov eax, dword [0x10055ec]
jne 0x1001f69
and eax, 0x10
jmp 0x1001f6c
and eax, 0x20
test ecx, ecx
je 0x1001f79
xor ecx, ecx
test eax, eax
setne cl
jmp 0x1001f80
xor ecx, ecx
jmp 0x1008a3d
mov eax, ecx
pop ebp
ret 4

Function at 0x100201a
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [0x10055e4]
push 0x10
call fcn.01001f4f
test eax, eax
je 0x100204a
mov eax, dword [ebp + 8]
push 0x80
call fcn.01001f4f
neg eax
sbb eax, eax
and eax, 2
inc eax
jmp 0x100204c
xor eax, eax
inc eax
cmp edx, eax
mov dword [0x10055e4], eax
je 0x1002062
jmp 0x1007396
pop ebp
ret 4

Function at 0x10021ff
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [0x10055f4], eax
je 0x100223b
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x100206b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x10055f0], eax
jne 0x1002243
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x1002343
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10023c0
lea eax, [ebp - 0x10]
push eax
push 0x1001260
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10023b7
push ebx
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10023b6
jmp loc.0100a4ba
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x10023e8
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x2c], 0x10
jmp loc.01008876

Function at 0x10024f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0x1005608], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne fcn.0100250f
push esi
push esi
push esi
push esi
call edi
jmp loc.01007c96

Function at 0x100283b
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp loc.01008ff0

Function at 0x10028c1
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
dec eax
je 0x10028f1
dec eax
je 0x10028e7
dec eax
jne 0x10028f9
push dword [ebp + 0xc]
call fcn.010026c5
mov dword [0x100561c], 1
jmp 0x10028f9
push dword [ebp + 0xc]
call fcn.01002da6
jmp 0x10028f9
push dword [ebp + 0xc]
jmp 0x10088fd
pop ebp
ret 8

Function at 0x100298d
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push esi
push edi
push 3
or edi, 0xffffffff
pop esi
jmp 0x10029b3
jmp loc.0100a857
push edi
push esi
call fcn.01002884
test eax, eax
jne 0x1002999
mov eax, edi
pop edi
pop esi
ret

Function at 0x10029c8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x1005630]
push esi
xor esi, esi
inc esi
test eax, eax
je 0x10029eb
jmp loc.01007717
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x1002ada
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x1001258
mov dword [ebp - 0xc], 0x1002ab4
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne fcn.01002b19
jmp loc.0100a576
Function at 0x1002b27
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10055b4]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push 0x28
xor ebx, ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x60]
push eax
push 0x1001260
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1002baf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0x54]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x58], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x50]
push eax
call sub.POWRPROF.dll_GetPwrCapabilities
test al, al
je 0x1002ba3
cmp byte [ebp - 0x49], bl
je 0x1002ba3
push 0xffffffffffffffff
push 0xd
jmp 0x1002ba7
push 0xffffffffffffffff
push 5
jmp 0x100a5f4
jmp 0x100a149

Function at 0x1002ef0
Capabilities:
Packed with generic packer

Disassembly:
sub eax, 0
je 0x1002f29
dec eax
je 0x1002f22
sub eax, 4
je 0x1002f1b
dec eax
je 0x1002f14
dec eax
je 0x1002f0d
dec eax
jne fcn.01002f2f
push ecx
call fcn.01002da6
ret
push ecx
call fcn.010026c5
ret
push ecx
call fcn.01002d41
ret
push ecx
call fcn.010026c5
ret
push ecx
call fcn.0100283b
ret
push ecx
jmp loc.010084b7

Function at 0x1003113
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
jmp loc.01008c00

Function at 0x10032df
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
jmp loc.0100a75d

Function at 0x1003371
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10050ec
jmp loc.010081c5

Function at 0x1003464
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10051e8
jmp loc.01007a71

Function at 0x100349a
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
jmp loc.01007899

Function at 0x10034b5
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x1005290
jmp loc.01009e98

Function at 0x10034eb
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10052c8
jmp loc.01009a33

Function at 0x1003506
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10052e4
jmp loc.010081a5

Function at 0x10035a8
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10050ec
jmp loc.0100aaff

Function at 0x10035c3
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x1005108
jmp loc.01009d94

Function at 0x100364a
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
jmp loc.0100a28c
Function at 0x100378e
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
jmp loc.01008497

Function at 0x10037fa
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x10053a8
jmp loc.01008c5d

Function at 0x1003bf7
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
jmp loc.01007952

Function at 0x1007022
Capabilities:
Query or enumerate registry value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
aas
dec ecx
and al, 0
add al, 0
popal
popfd
jne fcn.010030fd
jmp fcn.0100306c

Function at 0x10070a2
Capabilities:
Query or enumerate registry value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050c0
push 0x404740
push eax
push ebx
push edi
push 1
pop ecx
mov ecx, dword [0x1005c66]
mov ecx, dword [0x1004245]
add esp, 0x18
leave
popal
popfd
je fcn.01003107
jmp loc.0100305d

Function at 0x100a9e4
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, 0x10007000
push 0x719533b1
push 0x40
push 0x3000
push 0x107b
push 0
mov ebx, 0x323
mov edi, eax
push eax
add esp, 0x18
leave
popal
popfd
mov edx, 0x4e414f44
jmp fcn.01006525
Function at 0x431bde
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d16f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5a6310]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x54bfd8
call fcn.00427af3
xor edi, edi
mov dword [esp + 0x3c], edi
or dword [esp + 0x3c], 0xffffffff
mov ecx, 0x5aace0
call fcn.00429a5c
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x14]
mov eax, dword [ecx]
push edx
call dword [eax + 0x80]
mov dword [esp + 0x38], 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x54b9b4
call fcn.00427af3
mov byte [esp + 0x3c], 2
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.004299f6
mov byte [esp + 0x40], 3
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x20]
call fcn.004440ab
mov byte [esp + 0x40], 4
add esp, 4
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004299f6
mov byte [esp + 0x3c], 5
mov byte [esp + 0x3c], 4
lea ecx, [esp + 0x28]
call 0x4a2064
mov byte [esp + 0x38], 6
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x54b68c
call fcn.00427af3
mov byte [esp + 0x3c], 7
lea ebx, [esi + 0x74]
mov byte [esp + 0x3c], 6
mov ecx, ebx
call fcn.00427ca5
test eax, eax
jne 0x431ce4
mov ecx, esi
call fcn.00431f59
mov ecx, esi
call fcn.004318bc
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x54bfe4
call fcn.00427af3
mov byte [esp + 0x3c], 8
mov byte [esp + 0x3c], 6
mov ecx, ebx
call fcn.00427ca5
test eax, eax
je 0x431d33
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x54bfe8
call fcn.00427af3
mov byte [esp + 0x3c], 9
push 2
mov byte [esp + 0x40], 6
call fcn.0044213c
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004299f6
mov byte [esp + 0x3c], 0xa
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x54be9c
call fcn.00427af3
mov byte [esp + 0x44], 0xb
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 6
mov ecx, dword [esi + 4]
call 0x4f5739
test eax, eax
jne 0x431d9a
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x54bffc
call fcn.00427af3
mov byte [esp + 0x3c], 0xc
push 1
mov byte [esp + 0x40], 6
call fcn.0044213c
jmp 0x431d9d
xor edi, edi
inc edi
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x24]
call 0x4a20ce
mov byte [esp + 0x38], 1
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00427b5b
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00427b5b
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret