joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6101cd15
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov ebx, ecx
jne 0x6101cd35
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x6101cdd2
call fcn.6101c2e1
test eax, eax
je 0x6101cdd2
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push 0x6100468c
push dword [ebx + 0x10]
mov dword [ebp - 4], esi
call edi
cmp eax, esi
jne 0x6101cdc5
cmp dword [ebp - 4], 1
jbe 0x6101cdc5
add dword [ebp - 4], 4
push dword [ebp - 4]
call fcn.6102b86a
cmp eax, esi
pop ecx
mov dword [ebp - 8], eax
je 0x6101cdd2
push dword [ebp - 4]
push esi
push eax
call fcn.6102b300
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
push esi
push 0x6100468c
push dword [ebx + 0x10]
call edi
test eax, eax
push dword [ebp - 8]
je 0x6101cda9
call fcn.6102abeb
pop ecx
jmp 0x6101cdd2
mov ecx, dword [ebp + 8]
call fcn.6100d8e9
push dword [ebp - 8]
call fcn.6102abeb
xor eax, eax
cmp eax, dword [ebp - 4]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101cdce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
jne 0x6101cdd9
xor eax, eax
jmp 0x6101cf20
cmp dword [ebp + 0xc], esi
je 0x6101cd28
mov ecx, ebx
call fcn.6101c2e1
test eax, eax
je 0x6101cdd2
lea eax, [ebp + 8]
push eax
push esi
push esi
push esi
push 0x61004668
push dword [ebx + 0x10]
mov dword [ebp + 8], esi
call edi
cmp eax, esi
jne 0x6101ce66
cmp dword [ebp + 8], 1
jbe 0x6101ce66
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102b86a
cmp eax, esi
pop ecx
mov dword [ebp - 8], eax
je 0x6101cdd2
push dword [ebp + 8]
push esi
push eax
call fcn.6102b300
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push esi
push esi
push 0x61004668
push dword [ebx + 0x10]
call edi
test eax, eax
push dword [ebp - 8]
jne 0x6101cda1
mov ecx, dword [ebp + 0xc]
call fcn.6100d8e9
push dword [ebp - 8]
call fcn.6102abeb
xor eax, eax
cmp eax, dword [ebp + 8]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101ce6f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
je 0x6101cdd2
cmp dword [ebp + 0x10], esi
je 0x6101cd28
mov ecx, ebx
call fcn.6101c2e1
test eax, eax
je 0x6101cdd2
lea eax, [ebp + 8]
push eax
push esi
push esi
push esi
push 0x61003e8c
push dword [ebx + 0x10]
mov dword [ebp + 8], esi
call edi
cmp eax, esi
jne 0x6101cf0c
cmp dword [ebp + 8], 1
jbe 0x6101cf0c
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102b86a
cmp eax, esi
pop ecx
mov dword [ebp + 0xc], eax
je 0x6101cdd2
push dword [ebp + 8]
push esi
push eax
call fcn.6102b300
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x61003e8c
push dword [ebx + 0x10]
call edi
test eax, eax
push dword [ebp + 0xc]
jne 0x6101cda1
mov ecx, dword [ebp + 0x10]
call fcn.6100d8e9
push dword [ebp + 0xc]
call fcn.6102abeb
xor eax, eax
cmp eax, dword [ebp + 8]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101cf15
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
je 0x6101cdd2
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6101d50f
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0x14
mov eax, 0x6103ee57
call fcn.6102aabe
mov dword [ebp - 4], 1
xor edi, edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.6100d224
mov byte [ebp - 4], 2
push 0x61004720
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], edi
call fcn.6100d970
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.61017e7e
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.6100d179
test bl, bl
je 0x6101d57a
mov esi, 0x65b
jmp 0x6101d5fb
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push dword [ebp - 0x14]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
jne 0x6101d5fb
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 8], edi
jbe 0x6101d5d9
lea eax, [ebp - 0x1c]
push eax
call fcn.61017bf6
mov ebx, eax
cmp ebx, edi
jne 0x6101d5b8
push 8
pop esi
jmp 0x6101d5f0
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push ebx
push 7
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
jne 0x6101d5f0
jmp 0x6101d5ee
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, edi
jne 0x6101d5fb
mov ebx, dword [ebp - 0x20]
xor esi, esi
cmp ebx, edi
je 0x6101d5fb
push ebx
call fcn.6102abeb
pop ecx
cmp dword [ebp - 0x10], edi
je 0x6101d609
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d179
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d179
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d179
mov eax, esi
call fcn.6102abaa
ret 0xc
Function at 0x6101d63c
Capabilities:
Delete registry key

Disassembly:
push 0x18
mov eax, 0x6103eeaf
call fcn.6102aabe
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d224
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d224
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.6100d224
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.6100d224
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.6100d224
mov byte [ebp - 4], 5
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.61017dbb
test al, al
je 0x6101d708
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.61017dbb
test al, al
je 0x6101d708
push 0x61004720
lea ecx, [ebp - 0x1c]
call fcn.6100d970
mov byte [ebp - 4], 6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.61017e7e
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.6100d179
test bl, bl
jne 0x6101d708
lea ecx, [ebp - 0x14]
call fcn.610116e0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jne 0x6101d70d
jmp 0x6101d70d
mov esi, 0x65b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.6100d179
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.6100d179
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.6100d179
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d179
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d179
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d179
mov eax, esi
call fcn.6102abaa
ret 4

Function at 0x6101d764
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov esi, ecx
push edi
mov dword [ebp - 8], esi
jne 0x6101d78b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
cmp eax, 4
jne 0x6101d79c
mov dword [ebp - 4], 0x61003a9c
jmp 0x6101d7c4
cmp eax, 9
jne 0x6101d7aa
mov dword [ebp - 4], 0x6100461c
jmp 0x6101d7c4
cmp eax, 0xa
jne 0x6101d7b8
mov dword [ebp - 4], 0x610019dc
jmp 0x6101d7c4
cmp eax, 8
jne 0x6101d782
mov dword [ebp - 4], 0x610045e8
call fcn.6101c2e1
test eax, eax
je 0x6101d782
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp + 8], ebx
push dword [esi + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x6101d782
cmp dword [ebp + 8], 1
jbe 0x6101d782
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102b86a
mov edi, eax
cmp edi, ebx
pop ecx
je 0x6101d782
push dword [ebp + 8]
push ebx
push edi
call fcn.6102b300
add esp, 0xc
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push edi
push ebx
push ebx
push dword [ebp - 4]
push dword [eax + 0x10]
call esi
test eax, eax
push edi
je 0x6101d831
call fcn.6102abeb
pop ecx
jmp 0x6101d782
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.610199de
push edi
call fcn.6102abeb
xor eax, eax
cmp dword [esi + 8], ebx
pop ecx
setne al
jmp 0x6101d784
Function at 0x6101db1b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x6103ef47
call fcn.6102aabe
mov dword [ebp - 4], 1
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], edi
call fcn.6100d224
mov byte [ebp - 4], 2
push 0x61004720
lea ecx, [ebp - 0x10]
call fcn.6100d970
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.61017e7e
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.6100d179
test bl, bl
je 0x6101db85
mov dword [ebp - 0x10], 0x65b
jmp 0x6101dc35
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push dword [ebp - 0x1c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x6101dc35
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call ebx
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x6101dbd6
cmp eax, 2
jne 0x6101dc35
mov dword [ebp - 0x10], 0x490
jmp 0x6101dc35
add dword [ebp - 0x14], 4
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
jne 0x6101dbf4
mov dword [ebp - 0x10], 8
jmp 0x6101dc2a
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call ebx
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x6101dc2a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
shr eax, 1
mov word [esi + eax*2 - 4], di
mov eax, dword [ebp - 0x14]
shr eax, 1
push esi
mov word [esi + eax*2 - 2], di
call fcn.610199de
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x6101dc35
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x18], edi
je 0x6101dc43
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.6100d179
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d179
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d179
mov eax, dword [ebp - 0x10]
call fcn.6102abaa
ret 0xc

Function at 0x6101ec05
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push 0x104
mov ecx, esi
mov dword [ebp - 8], ebx
call fcn.61011c47
push 0x20019
push 2
push ebx
push 1
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
je 0x6101ec76
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push ebx
push ebx
push 0x61004b94
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6101ec6f
cmp dword [ebp - 4], ebx
jbe 0x6101ec6f
mov dword [ebp - 8], 1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
mov ecx, esi
call fcn.61011701
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 8
Function at 0x610211eb
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push 0x28
mov eax, 0x6103ff14
call fcn.6102aabe
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x10]
push 0xe0000000
push edi
push edi
mov dword [ebp - 0x10], 1
mov dword [eax], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x6102138a
push 0x80010020
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x61021367
mov eax, dword [ebp + 0xc]
cmp eax, 2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x6102125f
cmp eax, 3
je 0x6102125f
cmp eax, 4
je 0x6102125f
cmp eax, 1
jne 0x610212ad
lea eax, [ebp - 0x34]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x61021285
call edi
push eax
push dword [ebp + 8]
push 0x61005bb8
push 3
call fcn.6101b077
add esp, 0x10
push ebx
lea ebx, [ebp - 0x34]
call fcn.61024f73
test eax, eax
jne 0x610212ad
push dword [ebp + 8]
push 0x61005b80
push 2
call fcn.6101b077
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x61021347
push dword [ebp + 8]
push 0x61005b48
push 1
call fcn.6101b077
add esp, 0xc
push dword [ebp - 0x14]
call esi
xor edi, edi
cmp dword [ebp + 0xc], 2
je 0x610212ea
cmp dword [ebp + 0xc], 3
mov dword [ebp + 0xc], 6
jne 0x610212f1
mov dword [ebp + 0xc], 3
push 0x80000000
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
inc edi
test ebx, ebx
je 0x61021383
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebx
call esi
cmp edi, dword [ebp + 0xc]
jne 0x61021335
push 0x61005a70
push 2
call fcn.6101b077
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov dword [eax], 1
jmp 0x61021340
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, dword [ebp + 0xc]
jb 0x610212f1
jmp 0x61021383
and dword [ebp - 0x10], 0
call edi
push eax
push dword [ebp + 8]
push 0x610059f8
push 3
call fcn.6101b077
add esp, 0x10
push dword [ebp - 0x14]
call esi
jmp 0x61021383
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x61005968
push 3
call fcn.6101b077
add esp, 0x10
push dword [ebp - 0x18]
call esi
jmp 0x610213a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x610058c8
push 3
call fcn.6101b077
add esp, 0xc
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d179
mov eax, dword [ebp - 0x10]
call fcn.6102abaa
ret 0xc
Function at 0x61024773
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x6102478d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x61024788
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x61024772
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x6102477a
cmp edx, ebx
jne 0x610248c8
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x61024749
add eax, dword [eax + 4]
jmp 0x61024736
mov dword [ebp + 0xc], ebx
jmp 0x61024798
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x610247b0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x610247ce
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x6102482c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x61024813
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6102481c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x61024826
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x61024808
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x61024792
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x61024879
dec eax
je 0x61024870
sub eax, 3
je 0x61024867
mov dword [ebp - 4], 0x40
jmp 0x61024896
mov dword [ebp - 4], 4
jmp 0x6102487c
mov dword [ebp - 4], 0x20
jmp 0x6102487c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x610248c8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x61024848
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.610240d9
out 0x68, eax
jnp 0x610248b0
sub byte [ebx], al
invalid
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x610248d4
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x61024f73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sar ah, 0xff
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.610240d9
jno 0x61024ff5
push esi
adc eax, dword [eax - 0x22f5b]
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.610240b7
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.610240e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6102409e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.610240d9
push cs
movsd dword es:[edi], dword [esi]
das
and dword [eax + 4], ebp
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
invalid
Function at 0x61029eea
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x61047110]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.61029e2b
mov eax, 0x61000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.6102b300
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x61029f5d
cmp dword [ebp - 0x94], 5
jb 0x61029f7e
jmp 0x61029f7a
cmp dword [ebp - 0x88], 1
jne 0x61029f7e
cmp dword [ebp - 0x94], 4
ja 0x61029f7a
jne 0x61029f7e
cmp dword [ebp - 0x90], 0
jbe 0x61029f7e
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x6100a7b0
call fcn.61029cc2
test eax, eax
jge 0x61029f9f
mov byte [0x610483c4], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6102aaaa
leave
ret

Function at 0x6102a249
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x61047110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
push edi
jne 0x6102a34a
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x6102a28e
xor eax, eax
jmp 0x6102a3e5
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x6102a2a9
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x61048720], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x61048728], esi
mov dword [0x6104872c], ecx
mov dword [0x61048730], edx
mov dword [0x61048724], eax
call fcn.6102d994
test eax, eax
pop ecx
je 0x6102a287
call fcn.6102d02e
test eax, eax
jne 0x6102a2f5
call fcn.6102d9f9
jmp 0x6102a287
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6104a398], eax
call fcn.6102d7f6
mov dword [0x61048704], eax
call fcn.6102d1b2
test eax, eax
jge 0x6102a31a
call fcn.6102cccf
jmp 0x6102a2ee
call fcn.6102d736
test eax, eax
jl 0x6102a343
call fcn.6102d444
test eax, eax
jl 0x6102a343
push 0
call fcn.6102c9e7
test eax, eax
pop ecx
jne 0x6102a343
inc dword [0x61048700]
jmp 0x6102a3e2
call fcn.6102d3f1
jmp 0x6102a313
xor edi, edi
cmp eax, edi
jne 0x6102a385
cmp dword [0x61048700], edi
jle 0x6102a287
dec dword [0x61048700]
cmp dword [0x6104875c], edi
jne 0x6102a36f
call fcn.6102cb53
cmp dword [ebp + 0x10], edi
jne 0x6102a3e2
call fcn.6102d3f1
call fcn.6102cccf
call fcn.6102d9f9
jmp 0x6102a3e2
cmp eax, 2
jne 0x6102a3d6
call fcn.6102cca0
push 0x214
push 1
call fcn.6102c6d3
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x6102a287
push esi
push dword [0x610471c0]
push dword [0x6104876c]
call fcn.6102cc27
pop ecx
call eax
test eax, eax
je 0x6102a3ca
push edi
push esi
call fcn.6102cd11
pop ecx
jmp 0x6102a3e1
push esi
call fcn.6102aef1
pop ecx
jmp 0x6102a287
cmp eax, 3
jne 0x6102a3e2
push edi
call fcn.6102cfbb
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6102aaaa
leave
ret 0xc