joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020c90
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1020d02
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020ce1
test byte [eax + 0x1c], 1
je 0x1020ce1
cmp byte [eax + 0x19], 2
jb 0x1020ce1
push esi
push 0x10088b4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x112
push 0x10088c4
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
pop esi
leave
ret 0x14

Function at 0x102104b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
sub esp, 0x20
cmp dword [eax + 0x18], 8
jb 0x1021064
mov eax, dword [eax + 4]
jmp 0x1021067
add eax, 4
push esi
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10210d0
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x10210af
test byte [eax + 0x1c], 1
je 0x10210af
cmp byte [eax + 0x19], 2
jb 0x10210af
push esi
push 0x10088b4
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0xd4
push 0x10088c4
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
pop esi
leave
ret 0xc

Function at 0x10210da
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
sub esp, 0x20
cmp dword [eax + 0x18], 8
jb 0x10210f3
mov eax, dword [eax + 4]
jmp 0x10210f6
add eax, 4
push esi
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x102115f
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x102113e
test byte [eax + 0x1c], 1
je 0x102113e
cmp byte [eax + 0x19], 2
jb 0x102113e
push esi
push 0x10088b4
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0xe5
push 0x10088c4
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
pop esi
leave
ret 0xc

Function at 0x1021285
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
push dword [esi + 0x20]
lea ecx, [esi + 8]
call fcn.010211e5
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0xc]
push 0
push 0
push 0
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, 0x103
cmp eax, ecx
jne 0x10212c8
mov eax, ecx
jmp 0x10212d2
test eax, eax
jne 0x10212d2
inc dword [esi + 4]
mov dword [esi + 0x18], edi
pop edi
pop esi
leave
ret
Function at 0x10214c3
Capabilities:
Query or enumerate registry key

Disassembly:
and dword [ecx + 4], 0
jmp fcn.01021285

Function at 0x10214d1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1029008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x210]
push edx
lea edx, [ebp - 0x20c]
push edx
push ecx
push 0
push eax
push ebx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x210], 0x208
call edi
mov ecx, eax
mov dword [ebp - 0x21c], ecx
cmp ecx, 2
je 0x1021645
test ecx, ecx
jne 0x1021566
push eax
push dword [ebp - 0x210]
mov ecx, esi
call fcn.010024a5
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 4]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1021604
cmp ecx, 0xea
jne 0x1021608
push 0
push dword [ebp - 0x210]
mov ecx, esi
call fcn.010024a5
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp - 0x218]
push 0
push dword [ebp - 0x214]
push ebx
call edi
mov edi, eax
test edi, edi
je 0x10215f5
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x10215ce
test byte [eax + 0x1c], 1
je 0x10215ce
cmp byte [eax + 0x19], 2
jb 0x10215ce
push edi
push 0x10088b4
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x98
push 0x10088c4
push edi
lea ecx, [ebp - 0x23c]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x23c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0
push dword [ebp - 0x210]
mov ecx, esi
call fcn.010024a5
mov al, 1
jmp 0x1021647
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1021633
test byte [eax + 0x1c], 1
je 0x1021633
cmp byte [eax + 0x19], 2
jb 0x1021633
push ecx
push 0x10088b4
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x9d
push 0x10088c4
push dword [ebp - 0x21c]
jmp 0x10215d9
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01004e68
leave
ret 0x10

Function at 0x10226f4
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1001ac9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10011a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1001b15
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x1001b21
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x10011ec
call fcn.01001ac9
test eax, eax
je 0x1001b52
xor eax, eax
jmp 0x1001b89
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x260]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0x254], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
call fcn.01003d98
leave
ret

Function at 0x1001cac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100124c
push ebx
mov dword [edi + 0x18], ebx
call esi
test eax, eax
mov dword [edi], eax
je 0x1001d19
push 0x1001244
push ebx
call esi
test eax, eax
mov dword [edi + 4], eax
je 0x1001d19
push 0x1001238
push ebx
call esi
test eax, eax
mov dword [edi + 8], eax
je 0x1001d19
push 0x1001220
push ebx
call esi
test eax, eax
mov dword [edi + 0xc], eax
je 0x1001d19
push 0x1001210
push ebx
call esi
test eax, eax
mov dword [edi + 0x10], eax
je 0x1001d19
push 0x1001204
push ebx
call esi
test eax, eax
mov dword [edi + 0x14], eax
jne 0x1001d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x10021ff
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [0x10055f4], eax
je 0x100223b
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x100206b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x10055f0], eax
jne 0x1002243
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x10023e8
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10055b4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push 0x400
push esi
push 0
push 0x3100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jbe 0x1002455
add eax, eax
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push eax
push 0
mov dword [0x1005610], esi
call sub.NETAPI32.dll_NetMessageBufferSend
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
call fcn.01003d98
leave
ret

Function at 0x10024f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0x1005608], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x100250f
push esi
push esi
push esi
push esi
call edi
mov dword [0x1005608], eax
cmp dword [0x100560c], esi
jne 0x1002522
push esi
push esi
push esi
push esi
call edi
mov dword [0x100560c], eax
cmp dword [0x1005604], esi
jne 0x100253f
push esi
push esi
push esi
push 0x1002464
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005604], eax
pop edi
pop esi
ret

Function at 0x1002b27
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10055b4]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push 0x28
xor ebx, ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x60]
push eax
push 0x1001260
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1002baf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0x54]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x58], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1002baf
lea eax, [ebp - 0x50]
push eax
call sub.POWRPROF.dll_GetPwrCapabilities
test al, al
je 0x1002ba3
cmp byte [ebp - 0x49], bl
je 0x1002ba3
push 0xffffffffffffffff
push 0xd
jmp 0x1002ba7
push 0xffffffffffffffff
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01003d98
leave
ret
Function at 0x100303b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1003109
push esi
push edi
mov eax, dword [ebp + 8]
mov esi, dword [eax]
cmp esi, ebx
je 0x1003107
cmp dword [ebp + 0xc], ebx
je 0x100306c
cmp dword [esi + 0x18], 1
jne 0x10030fd
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x100307a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 4]
push eax
push 1
push ebx
push dword [esi + 4]
lea edi, [esi + 0x14]
push dword [esi]
mov dword [esi + 0x10], ebx
mov dword [edi], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10030fd
push edi
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030f2
mov eax, dword [edi]
cmp eax, ebx
jbe 0x10030f2
mov ecx, dword [esi + 0xc]
cmp ecx, dword [ebp - 8]
jne 0x10030f2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x10030f2
push edi
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10030f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0x10], ebx
mov dword [edi], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [ebp + 8], 4
jne 0x1003050
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1003113
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1003179
push esi
mov esi, dword [ebx]
test esi, esi
je 0x1003178
cmp dword [esi + 0x10], 0
je 0x1003173
cmp dword [ebp + 0xc], 1
je 0x1003139
cmp dword [esi + 0x18], 1
jne 0x1003173
lea eax, [ebp + 8]
push eax
push 2
push 0
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100316f
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push eax
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi + 0x18], 0
add ebx, 4
jne 0x1003121
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10032df
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x1005024], ebx
je 0x100334e
push esi
push edi
mov edi, 0x1005024
mov esi, 0x1005028
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [esi - 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003342
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push dword [esi]
push 1
push ebx
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
lea edi, [esi - 4]
cmp dword [edi], ebx
jne 0x10032fd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003a01
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push 2
push edi
push edi
push edi
push 0x1001698
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003b75
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003886
mov esi, 0x1001254
push esi
call fcn.010035c3
push 1
call fcn.010035de
push edi
call fcn.0100362f
push 2
call fcn.0100364a
push edi
call fcn.01003665
push esi
call fcn.01003680
push 1
call fcn.0100369b
push 0x7f
call fcn.010036b6
push edi
call fcn.010036ec
push 0xb4
call fcn.01003707
lea eax, [ebp - 8]
push eax
call fcn.0100347f
test eax, eax
jne 0x1003b3d
cmp dword [ebp - 8], edi
je 0x1003b3d
push esi
call fcn.01003557
push esi
call fcn.01003572
lea eax, [ebp - 0xc]
push eax
call fcn.01003371
test eax, eax
jne 0x1003ad0
test byte [ebp - 0xc], 0x80
je 0x1003ad0
push 1
jmp 0x1003ad1
push edi
call fcn.01003665
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push 0x1001630
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003b68
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
mov esi, 0x100199c
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x1003b32
cmp dword [ebp - 0x14], 4
jne 0x1003b32
push dword [ebp - 0x18]
call fcn.0100364a
push 1
call fcn.0100362f
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003b68
push esi
call fcn.01003557
push esi
call fcn.01003572
push 0x1001990
call fcn.0100358d
push 0x7e
call fcn.010035a8
push 5
call fcn.010035f9
push 0x78
call fcn.01003614
push 1
call fcn.010038aa
call fcn.01003866
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1003bf7
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10055b4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor esi, esi
mov word [ebp - 0x20c], si
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x210], esi
stosw word es:[edi], ax
call fcn.01003955
lea eax, [ebp - 0x214]
push eax
push 1
push esi
push 0x1001698
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003c5f
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003c73
call fcn.010038e0
call fcn.010032df
call fcn.01003a01
call fcn.01003b7e
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push 0x10019d8
push eax
call edi
mov ebx, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x10019c8
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x20c]
push 0x10019d8
push eax
call edi
lea eax, [ebp - 0x20c]
push 0x10019b4
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x218]
push eax
push 0x20006
push 0
push 0x1001630
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop edi
pop esi
pop ebx
jne 0x1003d10
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
call fcn.01003d98
leave
ret
Function at 0x1003eb0
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001a48
call fcn.01004068
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1003eeb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003eeb
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003f03
cmp eax, 0x20b
je 0x1003ef0
mov dword [ebp - 0x1c], edi
jmp 0x1003f17
cmp dword [ecx + 0x84], 0xe
jbe 0x1003eeb
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1003f11
cmp dword [ecx + 0x74], 0xe
jbe 0x1003eeb
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100565c], 0xffffffff
or dword [0x1005660], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100562c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1005628]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1005664], eax
call fcn.0100405e
cmp dword [0x10055b8], edi
jne 0x1003f72
push fcn.0100405e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01004047
push 0x1005010
push 0x100500c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1005624]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1005620]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1005008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002ada
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1003fe9
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100401e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010040a3
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d008]
jne 0x40100a
repz ret
jmp fcn.00401720

Function at 0x40829b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004034fe
and dword [ebp - 4], 0
cmp dword [0x41f1c0], 0
mov ebx, eax
jne 0x40834c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4083fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4083fd
push eax
call fcn.0040348c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41f1c0], eax
call esi
push eax
call fcn.0040348c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41f1c4], eax
call esi
push eax
call fcn.0040348c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41f1c8], eax
call esi
push eax
call fcn.0040348c
pop ecx
mov dword [0x41f1d0], eax
test eax, eax
je 0x40834c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040348c
pop ecx
mov dword [0x41f1cc], eax
mov eax, dword [0x41f1cc]
cmp eax, ebx
je 0x4083a4
cmp dword [0x41f1d0], ebx
je 0x4083a4
push eax
call fcn.00403507
push dword [0x41f1d0]
mov esi, eax
call fcn.00403507
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083a4
test edi, edi
je 0x4083a4
call esi
test eax, eax
je 0x40839b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40839b
test byte [ebp - 0xc], 1
jne 0x4083a4
or dword [ebp + 0x10], 0x200000
jmp 0x4083dd
mov eax, dword [0x41f1c4]
cmp eax, ebx
je 0x4083dd
push eax
call fcn.00403507
pop ecx
test eax, eax
je 0x4083dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083dd
mov eax, dword [0x41f1c8]
cmp eax, ebx
je 0x4083dd
push eax
call fcn.00403507
pop ecx
test eax, eax
je 0x4083dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41f1c0]
call fcn.00403507
pop ecx
test eax, eax
je 0x4083fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4083ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp ebx, 0x182
jne 0x418cec
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x418cfc
cmp ebx, 0x19f
jne 0x418cfc
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
xor edi, edi
test ebx, ebx
jle 0x418d2e
push esi
jmp 0x418d10
lea esi, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00418cc0
mov cl, byte [ebp - 4]
mov eax, dword [ebp + 8]
xor byte [edi + eax], cl
inc edi
cmp edi, ebx
jl 0x418d10
pop esi
pop edi
cmp ebx, 0x2d
jne 0x418d48
mov dword [0x514ea0], 0xa62e7790
mov dword [0x514ea4], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x418d50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x514d6c]
push ebx
push esi
mov esi, dword [0x514bb4]
mov ebx, eax
cmp eax, 0x5dd
jne 0x418d8a
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41df70]
call fcn.00418c90
cmp dword [0x514d6c], 0x2f
jne 0x418da5
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00418cd0
add esp, 4
cmp dword [0x514d6c], 0x568
pop esi
pop ebx
jne 0x418dd7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x808]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret