joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eae7
Capabilities:
Create process on windows

Disassembly:
push 0x90
mov eax, 0x10031b12
call fcn.10030db7
mov edi, edx
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x68], eax
xor esi, esi
mov eax, dword [ebp + 0x24]
mov ebx, esi
mov dword [ebp - 0x64], eax
call fcn.1003054f
push eax
push ecx
push dword [0x10038130]
lea ecx, [ebp - 0x7c]
call fcn.1003054f
push 7
mov dword [ebp - 4], esi
xor eax, eax
pop ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], ecx
mov word [ebp - 0x60], ax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 2
call fcn.10021463
test al, al
je 0x1000ebb9
call fcn.1003054f
test al, al
jne 0x1000ebb9
test edi, edi
je 0x1000ec68
cmp word [edi], si
je 0x1000ec68
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1000eb68
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x48]
call fcn.1003054f
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.1003054f
push eax
lea ecx, [ebp - 0x60]
call fcn.1003054f
lea ecx, [ebp - 0x28]
call fcn.1000ccca
cmp dword [ebp - 0x50], 0
je 0x1000ebb9
cmp dword [ebp - 0x4c], 8
lea ebx, [ebp - 0x60]
lea edi, [ebp - 0x48]
cmovae ebx, dword [ebp - 0x60]
cmp dword [ebp - 0x34], 8
cmovae edi, dword [ebp - 0x48]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push esi
push esi
push 0x400
push esi
push esi
push esi
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x1000ec36
lea ecx, [ebp - 0x9c]
call fcn.1003054f
push eax
push ecx
push dword [0x1003812c]
lea ecx, [ebp - 0x24]
call fcn.1003054f
cmp byte [ebp - 0x24], 0
je 0x1000ec36
mov ecx, dword [ebp - 0x14]
call fcn.1003054f
mov edi, eax
test edi, edi
je 0x1000ec36
cmp byte [ebp - 0x1c], 0
je 0x1000ec22
mov ecx, dword [ebp - 0x14]
call fcn.1003054f
test eax, eax
je 0x1000ec22
mov ecx, dword [ebp - 0x18]
mov edx, eax
call fcn.1003054f
push dword [ebp - 0x14]
xor cl, cl
call fcn.1003054f
mov ecx, dword [ebp - 0x20]
mov edx, edi
call fcn.1003054f
xor eax, eax
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0x14], ax
mov edx, 0x851
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], str.Param
push eax
push str.HevCreateProcess_
push ecx
push 0x64
mov ecx, 0x170b0c5
mov dword [ebp - 0x18], esi
call fcn.1003054f
lea ecx, [ebp - 0x48]
call fcn.1000ccca
lea ecx, [ebp - 0x60]
call fcn.1000ccca
cmp byte [ebp - 0x7c], 0
je 0x1000ecbc
mov ecx, dword [ebp - 0x6c]
call fcn.1003054f
mov edi, eax
test edi, edi
je 0x1000ecbc
cmp byte [ebp - 0x74], 0
je 0x1000eca8
mov ecx, dword [ebp - 0x6c]
call fcn.1003054f
test eax, eax
je 0x1000eca8
mov ecx, dword [ebp - 0x70]
mov edx, eax
call fcn.1003054f
push dword [ebp - 0x6c]
xor cl, cl
call fcn.1003054f
mov ecx, dword [ebp - 0x78]
mov edx, edi
call fcn.1003054f
mov eax, esi
call fcn.10030d76
ret 0x20
Function at 0x1001d0a2
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x100323df
call fcn.10030d83
cmp byte [0x100604ac], 0
push dword [0x100604a8]
je 0x1001d0c5
call dword [sym.imp.kernel32.dll_FlsGetValue]
jmp 0x1001d0cb
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001d114
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1001d11c
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
push 8
pop ecx
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.1000ccf7
mov dword [esi], eax
push esi
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [esi]
mov dword [ecx], esi
mov ecx, 0x100604a8
call fcn.1003054f
mov eax, esi
call fcn.10030d61
ret
call fcn.1003054f
int3
Function at 0x1003054f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1003055e
pop dword [ebp - 0x40]
mov eax, 0x1003055e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x692032c9
add dword [ebp - 0x50], 0xe5321282
mov dword [ebp - 0x4c], 0x6622d365
sub dword [ebp - 0x4c], 0x33ef8720
mov dword [ebp - 0x48], 0x13b0faf3
sub dword [ebp - 0x48], 0xc764b6c5
mov dword [ebp - 0x44], 0x3b507a59
sub dword [ebp - 0x44], 0x3b507a59
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe47a0067
add eax, 0x2b89403d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa8d68e17
add dword [ebp - 0x50], 0xcb9bdb3f
mov dword [ebp - 0x4c], 0xbea8b102
sub dword [ebp - 0x4c], 0x7d3c4f8d
mov dword [ebp - 0x48], 0x297b1ec
add dword [ebp - 0x48], 0x60d7ba80
mov dword [ebp - 0x44], 0x338292dc
sub dword [ebp - 0x44], 0x338292dc
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xde055f07
sub eax, 0xce021e83
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x42092
push 0
call eax
mov ecx, 0x4ac7
mov esi, eax
mov edi, 0x7b355450
add edi, 0x94d133b0
add edi, dword [ebp - 0x40]
mov edx, 0x32410b08
xor dword [ebp - 8], esi
mov ebx, dword [edi]
mov dword [ebp - 0xc], 0xbc9d499b
xor ebx, edx
xor dword [ebp - 0x10], 0xdf5f6dcd
mov dword [esi], ebx
sub dword [ebp - 0x24], 0x575c314
add esi, 0x19a27d81
sub esi, 0x19a27d7d
add edi, 0xb414b1c4
add edi, 0x4beb4e40
loop 0x1003066f
add eax, 0x185af8a3
add eax, 0xe7a6254c
xor ebx, ebx
add ebx, eax
add eax, 0x8a9fd04d
add eax, 0x75602fb8
mov ecx, 0x6eb0f5de
add ecx, 0xa14f0a22
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x4c2f0db1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x76b56255
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4057ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4057eb
invalid
invalid

Function at 0x405909
Capabilities:
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x405919
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00403755
sahf
out dx, ax
dec esi
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00403755
and byte [ebx - 0x74b6e140], dl
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405942
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405942
call fcn.00403755
xchg esi, eax
add edi, dword [eax - 0xc]
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00403755
test byte [ecx + 0x75ffe4b3], 8
push dword [ebp + 4]
push dword [ebp]
call fcn.00403f55
sbb eax, 0x755c0042
or ebp, dword [eax + 0x14]
mov al, byte [0xe8570040]
mov ebp, 0x57000007
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405a76
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405b04
cmp byte [eax], 0
je 0x4059e6
cmp byte [ebp - 0x1c], 0
je 0x4059e6
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4059fc
mov al, byte [esi + 1]
test al, al
je 0x405a55
cmp al, 0x2e
jne 0x4059fc
cmp byte [esi + 2], 0
je 0x405a55
push esi
push ebx
call fcn.00406141
test byte [ebp - 0x14c], 0x10
je 0x405a21
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405a55
push dword [ebp + 0xc]
push edi
call fcn.00405909
jmp 0x405a55
push dword [ebp - 4]
push edi
call 0x4058c1
test eax, eax
jne 0x405a4d
cmp dword [ebp - 4], eax
je 0x405a45
push edi
push 0xfffffffffffffff1
call fcn.00405268
push 0
push edi
call fcn.00405f20
jmp 0x405a55
inc dword [0x4247c8]
jmp 0x405a55
push edi
push 0xfffffffffffffff2
call fcn.00405268
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4059c4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405a80
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405ad2
cmp dword [ebp - 0xc], esi
jne 0x405a94
inc dword [0x4247c8]
jmp 0x405ad2
push edi
call fcn.00406444
test eax, eax
je 0x405ad2
push edi
call fcn.00405ad9
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call 0x4058c1
test eax, eax
jne 0x405aca
cmp dword [ebp - 4], esi
je 0x405a8c
push edi
push 0xfffffffffffffff1
call fcn.00405268
push esi
push edi
call fcn.00405f20
jmp 0x405ad2
push edi
push 0xffffffffffffffe5
call fcn.00405268
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10007ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10007ad9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10007aef
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007ae6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10007b22
nop
cmp esi, ecx
jae 0x10007ae6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10007b10
cmp esi, ecx
jae 0x10007ae6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10007b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10007c71
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007c71
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007c71
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10007bf7
cmp esi, ecx
jae 0x10007c71
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10007be1
cmp esi, ecx
jae 0x10007c71
movzx eax, word [esi]
test ax, ax
je 0x10007c71
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x10007c7a
mov eax, dword [ebx]
mov edx, 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x10007c3d
push edi
mov ecx, ebx
call fcn.100080f0
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x10007c7a
mov dword [ecx - 0xc], edi
mov eax, 1
mov ecx, dword [ebx]
mov byte [edi + ecx], 0
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.10008330
int3
Function at 0x10007c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.10042e6b
mov ebx, eax
test ebx, ebx
jne 0x10007cb0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10007d97
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007d97
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007d97
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10007d18
cmp esi, ecx
jae 0x10007d97
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10007d02
cmp esi, ecx
jae 0x10007d97
movzx eax, word [esi]
test ax, ax
je 0x10007d97
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x10007da2
mov ebx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x10007d61
push edi
mov ecx, ebx
call fcn.100080f0
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10007da2
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10008330
int3
Function at 0x10007db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x10007ebf
test eax, 0xffff0000
jne 0x10007ebf
push ebx
push edi
movzx edi, ax
push edi
call fcn.10042e6b
mov ebx, eax
test ebx, ebx
je 0x10007ebb
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10007ebb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007ebb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007eba
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10007e49
cmp esi, ecx
jae 0x10007eba
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10007e33
cmp esi, ecx
jae 0x10007eba
movzx eax, word [esi]
test ax, ax
je 0x10007eba
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x10007ec7
mov ebx, dword [ebp - 4]
mov ecx, 1
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x10007e92
push edi
mov ecx, ebx
call fcn.100080f0
mov edx, dword [ebx]
movzx eax, word [esi]
push 0
push 0
push edi
push edx
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10007ec7
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10008330
int3
Function at 0x1003b860
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.1003cc70

Function at 0x1003bc20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b08b8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1022be34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
push 2
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1003bc8d
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2001f
push 0
push 0x10206f70
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003bcd9
mov eax, dword [ebp + 0x10]
mov edi, dword [eax - 0xc]
lea esi, [edi + edi]
test esi, esi
js 0x1003bd52
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x1003bcbb
push esi
lea ecx, [ebp + 0x10]
call fcn.100080f0
mov eax, dword [ebp + 0x10]
lea ecx, [edi + edi]
push ecx
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bcfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bd18
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1003bd37
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10177bf5
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10008330
int3
Function at 0x1003bd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b091a
mov eax, dword fs:[0]
push eax
mov eax, 0x13a0
call fcn.10178910
mov eax, dword [0x1022be34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x13a0], edi
mov dword [ebp - 0x13ac], edi
mov dword [ebp - 0x13a8], 0
mov dword [ebp - 4], 3
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov dword [edi], 0
push eax
call fcn.10008400
add eax, 0x10
add esp, 4
mov dword [edi], eax
lea eax, [ebp - 0x13a4]
mov dword [ebp - 0x13a8], 1
push eax
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 0x13a0], 0x1389
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003be3f
lea eax, [ebp - 0x13a0]
push eax
lea eax, [ebp - 0x139c]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x13a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003be33
lea eax, [ebp - 0x139c]
push eax
push 0x102056c4
push edi
call fcn.10007820
add esp, 0xc
push dword [ebp - 0x13a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003be60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003be7e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1003be9a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10177bf5
mov esp, ebp
pop ebp
ret
Function at 0x1003c200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1022be34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi], eax
test eax, eax
je 0x1003c356
cmp byte [eax + 0x44], 0
je 0x1003c27c
mov eax, dword [eax + 8]
push 0x87
push 0x4e
call eax
mov eax, dword [esi]
cmp byte [eax + 0x44], 0
je 0x1003c27c
mov eax, dword [eax + 8]
push 0x87
push 0x4e
call eax
mov eax, dword [esi]
cmp byte [eax + 0x44], 0
je 0x1003c27c
mov eax, dword [eax + 8]
push 7
push 0x4e
call eax
mov eax, dword [esi]
cmp byte [eax + 0x44], 0
je 0x1003c27c
mov eax, dword [eax + 8]
push 0xb
push 0x4f
call eax
mov eax, dword [esi]
cmp byte [eax + 0x44], 0
je 0x1003c27c
mov eax, dword [eax + 8]
push 0x60
push 0x4e
call eax
mov eax, dword [esi]
xor bh, bh
mov byte [ebp - 5], bh
cmp byte [eax + 0x44], bh
je 0x1003c296
mov eax, dword [eax + 4]
lea ecx, [ebp - 5]
push 0x4f
push ecx
call eax
mov eax, dword [esi]
mov bh, byte [ebp - 5]
cmp byte [eax + 0x44], 0
je 0x1003c2a7
mov eax, dword [eax + 8]
push 0x61
push 0x4e
call eax
mov eax, dword [esi]
xor bl, bl
mov byte [ebp - 6], bl
cmp byte [eax + 0x44], bl
je 0x1003c2d2
mov eax, dword [eax + 4]
lea ecx, [ebp - 6]
push 0x4f
push ecx
call eax
mov eax, dword [esi]
mov bl, byte [ebp - 6]
cmp byte [eax + 0x44], 0
je 0x1003c2d2
mov eax, dword [eax + 8]
push 0x30
push 0x4e
call eax
mov eax, dword [esi]
xor cl, cl
mov byte [ebp - 7], cl
cmp byte [eax + 0x44], cl
je 0x1003c2ec
mov eax, dword [eax + 4]
lea ecx, [ebp - 7]
push 0x4f
push ecx
call eax
mov eax, dword [esi]
mov cl, byte [ebp - 7]
or cl, 1
cmp byte [eax + 0x44], 0
mov byte [ebp - 0xb], cl
je 0x1003c313
mov eax, dword [eax + 8]
push 0x30
push 0x4e
call eax
mov eax, dword [esi]
cmp byte [eax + 0x44], 0
je 0x1003c313
push dword [ebp - 0xb]
mov eax, dword [eax + 8]
push 0x4f
call eax
movzx edx, bh
movzx eax, bl
shl edx, 8
add edx, eax
mov eax, esi
mov dword [esi + 4], edx
mov dword [esi + 8], edx
lea ecx, [edx + 1]
mov dword [esi + 0xc], ecx
lea ecx, [edx + 2]
mov dword [esi + 0x10], ecx
lea ecx, [edx + 4]
mov dword [esi + 0x14], ecx
lea ecx, [edx + 5]
mov dword [esi + 0x18], ecx
lea ecx, [edx + 6]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10177bf5
mov esp, ebp
pop ebp
ret 4
push 0
call fcn.10182611
int3
Function at 0x1003cc70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1022be34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10235c44]
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
jne 0x1003ccad
push str.GlobalAccess_EC
push eax
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [0x10235c44], eax
test eax, eax
je 0x1003cd90
push ebx
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [ebp + 0xc]
nop dword [eax]
mov ecx, dword [esi]
mov byte [ebp - 5], 0
cmp byte [ecx + 0x44], 0
je 0x1003cda2
movzx eax, word [esi + 8]
push eax
lea eax, [ebp - 5]
push eax
mov eax, dword [ecx + 4]
call eax
cmp byte [ebp - 5], 0xff
jne 0x1003cda2
mov ecx, dword [esi]
cmp byte [ecx + 0x44], 0
je 0x1003ccff
push dword [ebp + 8]
movzx eax, word [esi + 8]
push eax
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [esi]
xor al, al
mov byte [ebp - 6], al
cmp byte [ecx + 0x44], al
je 0x1003cd1a
movzx eax, word [esi + 8]
push eax
lea eax, [ebp - 6]
push eax
mov eax, dword [ecx + 4]
call eax
mov al, byte [ebp - 6]
cmp al, byte [ebp + 8]
jne 0x1003ccc0
mov ecx, dword [esi]
cmp byte [ecx + 0x44], 0
je 0x1003cd34
movzx eax, word [esi + 0xc]
push ebx
push eax
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [esi]
xor al, al
mov byte [ebp - 7], al
cmp byte [ecx + 0x44], al
je 0x1003cd4f
movzx eax, word [esi + 0xc]
push eax
lea eax, [ebp - 7]
push eax
mov eax, dword [ecx + 4]
call eax
mov al, byte [ebp - 7]
cmp al, bl
jne 0x1003ccc0
mov ecx, dword [esi]
cmp byte [ecx + 0x44], 0
je 0x1003cd83
push dword [ebp + 0x10]
movzx eax, word [esi + 0x10]
push eax
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [esi]
cmp byte [ecx + 0x44], 0
je 0x1003cd83
movzx eax, word [esi + 8]
push 0xff
push eax
mov eax, dword [ecx + 8]
call eax
push dword [0x10235c44]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10177bf5
mov esp, ebp
pop ebp
ret 0xc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3e8
jle 0x1003ccc0
jmp 0x1003cd83