joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x468d00b2
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x393f2828
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1000689b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10232300]
jne 0x100068a5
repz ret
jmp fcn.10009f12

Function at 0x1000a8f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100043af
and dword [ebp - 4], 0
cmp dword [0x10233ea4], 0
mov ebx, eax
jne 0x1000a9a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000aa57
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000aa57
push eax
call fcn.1000433d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10233ea4], eax
call esi
push eax
call fcn.1000433d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10233ea8], eax
call esi
push eax
call fcn.1000433d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10233eac], eax
call esi
push eax
call fcn.1000433d
pop ecx
mov dword [0x10233eb4], eax
test eax, eax
je 0x1000a9a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000433d
pop ecx
mov dword [0x10233eb0], eax
mov eax, dword [0x10233eb0]
cmp eax, ebx
je 0x1000a9fe
cmp dword [0x10233eb4], ebx
je 0x1000a9fe
push eax
call fcn.100043b8
push dword [0x10233eb4]
mov esi, eax
call fcn.100043b8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000a9fe
test edi, edi
je 0x1000a9fe
call esi
test eax, eax
je 0x1000a9f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000a9f5
test byte [ebp - 0xc], 1
jne 0x1000a9fe
or dword [ebp + 0x10], 0x200000
jmp 0x1000aa37
mov eax, dword [0x10233ea8]
cmp eax, ebx
je 0x1000aa37
push eax
call fcn.100043b8
pop ecx
test eax, eax
je 0x1000aa37
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000aa37
mov eax, dword [0x10233eac]
cmp eax, ebx
je 0x1000aa37
push eax
call fcn.100043b8
pop ecx
test eax, eax
je 0x1000aa37
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10233ea4]
call fcn.100043b8
pop ecx
test eax, eax
je 0x1000aa57
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000aa59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1023190c], 0
mov byte [0x10231910], 0
mov dword [0x10231908], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000b7d6
mov eax, dword [0x10231900]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1000b808
mov eax, 0x1fdd
xor ecx, ecx
mov dword [0x10231908], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1000b808
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10231900], 0x1fdd
mov eax, dword [0x10231908]
add eax, 1
mov dword [0x10231908], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000b7d6
jmp 0x1000b7bd
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
add ecx, 0xfffff6b9
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10231914], 0
mov edi, dword [0x1023190c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10231914], esi
mov dword [0x10231904], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x1023190c], edx
mov dword [0x10231900], ecx
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ebx + ecx]
mov byte [0x10231910], cl
mov dword [0x10231904], 0xe30
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x10231904]
add ecx, 0xfffffd81
mov dword [0x10231900], ecx
mov cl, byte [0x10231910]
mov edx, dword [0x1023190c]
mov byte [ebx + edx], cl
mov edx, dword [0x10231908]
add edx, 1
mov dword [0x10231908], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1000b7ad
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c9b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10231900], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1000ca11
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1000c9e4
mov eax, dword [ebp - 0x18]
mov dword [0x10231904], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1000ca79
jmp 0x1000ca3e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000caa5
xor eax, eax
mov dword [0x10231904], 0x1864
mov dword [ebp - 0x20], eax
jmp 0x1000ca60
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000ca94
jmp 0x1000ca3e
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000ca2f
jmp 0x1000ca3e
mov dword [0x10231904], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000ca4f
jmp 0x1000ca3e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000ca68
jmp 0x1000ca3e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1000ca60
jmp 0x1000ca3e
Function at 0x1000cea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10231908], 0
mov dword [0x1023190c], 0
mov dword [0x10231918], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1000d00d
jmp 0x1000cfdb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x10231900], 0x1e8a
add edx, 1
mov edi, ecx
add edi, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x10231908], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1023190c], edx
mov dword [0x10231900], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10231910], cl
mov dword [0x10231904], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10231910]
mov edx, dword [0x1023190c]
mov byte [ebx + edx], cl
mov edx, dword [0x10231908]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1023190c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10231918], ecx
mov dword [0x10231900], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x10231904], 0xbad
mov dword [0x10231900], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1000d00b
jmp 0x1000cfef
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1000ceef
mov eax, dword [0x10231908]
mov ecx, dword [0x1023190c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
jmp 0x1000ceef
jmp 0x1000d00d
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d020
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x10231900], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000b900
lea ecx, [0x1000b670]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x48], edx
mov dword [esp + 0x38], 0x159200
mov edx, dword [0x102318ec]
mov dword [esp + 0x74], edx
mov edx, dword [0x102318f0]
mov dword [esp + 0x60], edx
mov edx, dword [0x102318f4]
mov dword [esp + 0x44], edx
mov edx, dword [0x102318f8]
mov dword [esp + 0x64], edx
mov edx, dword [0x102318fc]
mov dword [esp + 0x78], edx
mov dword [0x10231900], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1000d0da
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000d0da
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1000d0eb
jmp 0x1000d0ac
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1000d0c0
jmp 0x1000d0ac
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x84], ecx
mov dword [0x10231904], 0x1fcc
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x6c], eax
call fcn.1000c9b0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x1000d155
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000c2d0
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10231900], 0x1ed4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4fd00a65
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x262a06bb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6f54590e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x33611010
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x4015f4
Capabilities:
Accept command line arguments
Check for unmoving mouse cursor

Disassembly:
cmp dword [ebp - 0x1c], 0x4e
jne fcn.004010a6
and eax, edi
adc edx, ecx
neg ecx
jmp fcn.004010a6
cmp dword [ebp - 0x34], 0x42
jne 0x4012ee
mov ebx, 0x4141
inc ebx
adc esi, ecx
jmp fcn.004010a6
test edi, 0x20000000
jne 0x4012ff
jmp fcn.004010a6
cmp edx, 0
je 0x40109c
neg edx
jmp fcn.004010a6
xor eax, eax
dec eax
push eax
shl eax, 0x10
shr eax, 0x10
pop ecx
sub ecx, eax
push ecx
jne 0x4015fe
pop eax
push 0x65
jmp 0x4016a7
push esi
push ecx
push ecx
call fcn.00401410
cmp dword [ebp - 0x38], 0x6a61
jne 0x4016cd
and edx, 0x3365
mov ebx, 0x766a
inc ecx
jmp fcn.004010a6
test dword [ebp - 0x38], 4
jne 0x4016df
jmp fcn.004010a6
cmp dword [ebp - 0x38], 0x6258
je 0x4012d7
jmp 0x4012cc
Function at 0x10009550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c6bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1002704c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x100095c9
push 0x1001f390
lea ecx, [ebp - 0x28]
call fcn.100046b0
mov dword [ebp - 4], 0
push 0x1001f394
lea ecx, [ebp - 0x28]
call fcn.100053f0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.100053f0
lea ecx, [ebp - 0x28]
call fcn.100094f0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018f68
mov esp, ebp
pop ebp
ret

Function at 0x100095f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c6fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1002704c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x10009669
push 0x1001f39c
lea ecx, [ebp - 0x28]
call fcn.100048e0
mov dword [ebp - 4], 0
push str._x32_
lea ecx, [ebp - 0x28]
call fcn.10005410
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10005410
lea ecx, [ebp - 0x28]
call fcn.10001fd0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100016d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018f68
mov esp, ebp
pop ebp
ret

Function at 0x100112a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100112c4
xor eax, eax
jmp 0x10011344
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100112db
xor eax, eax
jmp 0x10011344
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10011327
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10011327
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100112fe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10011333
xor eax, eax
jmp 0x10011344
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10011341
xor eax, eax
jmp 0x10011344
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10015180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d2b1
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x208
mov eax, dword [0x1002704c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x130]
call fcn.10004730
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x150]
call fcn.10014e60
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
push ecx
lea ecx, [ebp - 0x180]
call fcn.10014050
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x180]
call fcn.100051e0
test eax, eax
je 0x1001528f
push 0x104
push 0
lea edx, [ebp - 0x118]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x158], 0x104
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0
push str.DLLPathEx
lea ecx, [ebp - 0x180]
call fcn.100051e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jne 0x1001528f
lea edx, [ebp - 0x118]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
jbe 0x1001528f
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.10014490
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
call fcn.10014360
jmp 0x10015390
mov dword [ebp - 4], 0
jmp 0x100153a0
lea ecx, [ebp - 0x130]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100045f0
mov edx, dword [ebp - 0x14c]
or edx, 1
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.10004f10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10018f68
mov esp, ebp
pop ebp
ret 8
Function at 0x10016e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10016e99
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10016edc
mov eax, dword [ebp - 8]
jmp 0x10016f42
cmp dword [ebp - 0xc], 1
je 0x10016eef
cmp dword [ebp - 0xc], 2
je 0x10016eef
mov eax, 0xd
jmp 0x10016f42
cmp dword [ebp + 0xc], 0
je 0x10016f36
cmp dword [ebp - 4], 0
je 0x10016f25
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x10016f1c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x10016f23
mov eax, 0xd
jmp 0x10016f42
jmp 0x10016f36
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403158
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x403194
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4031b4
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405650
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403488
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004053e0
test esi, esi
jne 0x4034be
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004054d0
jmp 0x4034dc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040338c
mov edi, eax
test esi, esi
je 0x4034dc
cmp dword [ebx], 0
je 0x4034dc
dec esi
jmp 0x4034c5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4042d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d3020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404370
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404350
xor eax, eax
push ebp
push 0x404349
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40438c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404350
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4d3020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d3020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40518c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4db04c], 0
je 0x4051ed
cmp word [0x4db220], 0xd7b2
jne 0x4051b5
cmp dword [0x4db228], 0
jbe 0x4051b5
mov eax, 0x4db21c
call dword [0x4db238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405214
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d302c], 0
jne 0x405209
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405364
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4d3034], 0
je 0x40538a
mov edx, esi
mov eax, ebx
call dword [0x4d3034]
jmp 0x405399
mov eax, 8
call fcn.00402f50
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4db04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40532c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc