joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001010
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push str.CLRCreateInstance
push dword [ecx]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100010b6
lea ecx, [ebp - 4]
call fcn.100013a0
push eax
push 0x1001361c
push 0x100135fc
call esi
test eax, eax
js 0x100010b6
mov esi, dword [ebp - 4]
push edi
mov edi, dword [esi]
lea ecx, [ebp - 8]
call fcn.100013a0
push eax
push 0x100135ec
push str.v4.0.30319
push esi
call dword [edi + 0xc]
test eax, eax
js 0x100010b5
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x100010b5
cmp dword [ebp - 0xc], 0
je 0x100010b5
mov esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov edi, dword [esi]
call fcn.100013a0
push eax
push 0x100135dc
push 0x1001360c
push esi
call dword [edi + 0x24]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovns ebx, ecx
pop edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100010ca
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
test edx, edx
je 0x100010d7
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100010e0
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push str.CorBindToRuntime
push dword [ecx]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000112d
mov ecx, dword [ebp + 8]
call fcn.100013a0
push eax
push 0x100135dc
push 0x1001360c
push 0x10013510
push str.v2.0.50727
call esi
movzx ecx, bl
test eax, eax
mov edx, 1
cmovns ecx, edx
pop esi
movzx eax, cl
pop ebx
pop ebp
ret
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x100011b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
push 1
push 0
push 0xc
mov esi, ecx
call edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
mov ecx, 0x2008
push eax
push 0
push 8
mov dword [ebp - 4], eax
mov word [ebp - 0x20], cx
call edi
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], eax
jle 0x1000122e
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push dword [ebx + eax*4]
call edi
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 4]
jl 0x10001213
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 0xc], 0
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x40
mov esi, ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000164d
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov byte [esi], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100017e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x100161e4
cmp byte [esi - 0x104], 0
lea eax, [esi - 0x104]
je 0x10001912
cmp byte [esi], 0
je 0x10001912
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x1000184d
lea eax, [esi - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x1000184d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi - 0x104]
push ecx
push eax
push ebx
push str.____Patch_index__d_error__d_loading_library__s_n
call fcn.10001f35
add esp, 0x10
jmp 0x100018ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10001882
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
lea ecx, [esi - 0x104]
push ecx
push eax
push ebx
push str.____Patch_index__d_error__d_getting_proc_address_for:__s__s_n
call fcn.10001f35
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100018ff
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x100]
push 0x40
push dword [esi + 0x104]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100018b3
push ebx
push str.____Patch_index__d_error_setting_memory_protection_n
jmp 0x100018f7
push dword [esi + 0x104]
lea eax, [esi + 0x108]
push eax
mov eax, dword [esi + 0x100]
add eax, edi
push eax
call fcn.10009c00
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov eax, dword [esi + 0x100]
push dword [esi + 0x104]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100018ff
push ebx
push str.____Patch_index__d_error_re_setting_memory_protection_n
call fcn.10001f35
add esp, 8
add esi, 0x270
inc ebx
cmp esi, 0x10016ba4
jl 0x100017f0
push 0x9c0
push 0
push str.ThisIsThePatchData
call fcn.10002530
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100019e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x100178cc]
mov eax, dword [0x100178c4]
push edi
mov edi, ecx
test edx, edx
je 0x10001a14
push esi
mov esi, dword [0x100178c8]
test esi, esi
je 0x10001a13
cmp eax, edx
jae 0x10001a13
mov ecx, eax
and ecx, 3
inc eax
mov cl, byte [ecx + edi + 4]
xor byte [esi + eax - 1], cl
cmp eax, edx
jb 0x10001a01
pop esi
pop edi
ret
Function at 0x10009858
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100152c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10005559
mov dword [ebp - 0x14], eax
cmp dword [0x1001789c], edi
jne 0x10009949
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100098d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10009a29
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10009a29
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009a29
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1001789c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x100178a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x100178a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100178ac], eax
test eax, eax
je 0x10009946
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100178a8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000996e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10009961
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10009983
push 4
pop eax
jmp 0x10009a2b
cmp dword [ebp - 0x14], edi
je 0x10009983
push dword [0x1001789c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10009968
mov eax, dword [0x100178a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100099e1
cmp dword [0x100178ac], esi
je 0x100099e1
push eax
call ebx
push dword [0x100178ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100099e1
test eax, eax
je 0x100099e1
call ecx
test eax, eax
je 0x100099d6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100099d6
test byte [ebp - 8], 1
jne 0x100099e1
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10009a11
mov eax, dword [0x100178a0]
cmp eax, esi
je 0x10009a0e
push eax
call ebx
test eax, eax
je 0x10009a0e
call eax
mov edi, eax
test edi, edi
je 0x10009a0e
mov eax, dword [0x100178a4]
cmp eax, esi
je 0x10009a0e
push eax
call ebx
test eax, eax
je 0x10009a0e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1001789c]
call ebx
test eax, eax
je 0x10009a29
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10009a2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001baf
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040bbb3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040bbb3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040bbb3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040bbb3
mov dword [0x41203c], eax
call fcn.0040bbb3
test eax, eax
jge 0x402550
push 8
call fcn.0040bbb3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040bbb3
pop ecx
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040bbb3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040bbb3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040bbb3
jmp 0x402495

Function at 0x40bbb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40bbc2
pop dword [ebp - 0x20]
mov eax, 0x1d30d8ca
sub eax, 0x1cf01d08
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x34a29
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xb5d47c2e
sub ecx, 0xb5d4477d
xor edi, edi
add edi, eax
mov ebx, 0xf07c7f74
add ebx, 0xfc4bc50
add ebx, dword [ebp - 0x20]
mov esi, 0xd3615c19
add dword [ebp - 0x10], 0x5f7fcbbb
mov edx, dword [ebx]
sub dword [ebp - 0x1c], eax
add edx, esi
add dword [ebp - 0x1c], 0x796ad829
mov dword [edi], edx
xor dword [ebp - 0xc], ecx
add edi, 0x437832d3
sub edi, 0x437832cf
add ebx, 0xa9acdf52
sub ebx, 0xa9acdf4e
loop 0x40bc18
add eax, 0xeea3bc5b
add eax, 0x115d093c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10004cc0
Capabilities:
Query environment variable

Disassembly:
push 0x80
push 0x10029f98
push str.WLSDKIniFileName
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10004d14
push esi
push 0x104
push 0x10029f98
push 0x10023ed8
mov esi, 0x10023efc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [eax*2 + 0x10029f92]
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
add esi, 2
test ax, ax
jne 0x10004d04
pop esi
mov eax, 0x10029f98
ret

Function at 0x10004d20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4104
call fcn.10014090
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
mov esi, edx
push esi
mov edi, ecx
call ebx
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push edi
mov dword [ebp - 4], eax
call ebx
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov cl, byte [esi]
mov ebx, eax
xor eax, eax
test cl, cl
je 0x10004d74
nop
mov edx, dword [ebp - 4]
movsx cx, cl
mov word [edx + eax*2], cx
mov cl, byte [eax + esi + 1]
inc eax
test cl, cl
jne 0x10004d60
mov esi, dword [ebp - 4]
xor ecx, ecx
mov word [esi + eax*2], cx
mov cl, byte [edi]
xor eax, eax
test cl, cl
je 0x10004da1
jmp 0x10004d90
movsx dx, cl
mov word [ebx + eax*2], dx
mov cl, byte [eax + edi + 1]
inc eax
test cl, cl
jne 0x10004d90
xor ecx, ecx
mov word [ebx + eax*2], cx
call fcn.10004cc0
push eax
push 0x2000
lea edx, [ebp - 0x4104]
push edx
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x10004e12
lea edx, [ebp - 0x104]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10004dd1
lea edi, [ebp - 0x104]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10004de2
mov ecx, 0x15
mov esi, 0x10023f08
rep movsd dword es:[edi], dword [esi]
push 0x10
push 0x10023f60
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x104]
push eax
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x4104]
lea edx, [eax + 2]
jmp 0x10004e20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004e20
mov ecx, dword [ebp + 8]
push 0
push 0
sub eax, edx
push 0x2000
push ecx
sar eax, 1
inc eax
push eax
lea edx, [ebp - 0x4104]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, eax
call fcn.10004cc0
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x7d0
push eax
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x10004ef1
lea edx, [ebp - 0x200]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10004ea6
push edi
lea edi, [ebp - 0x200]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ec0
mov ecx, 0x2b
mov esi, str._definition_not_found_in_WinLicenseSDK.ini._nPlease__update_your_WinLicenseSDK.ini_file
rep movsd dword es:[edi], dword [esi]
push 0x10
push str.WinLicenseSDK_ERROR
lea edx, [ebp - 0x200]
push edx
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004f00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
push edi
mov edi, eax
push 0x104
lea eax, [ebp - 0x30c]
push eax
push 0x10023ed8
mov esi, 0x10023efc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp + eax*2 - 0x312]
sub ecx, esi
lea ebx, [ebx]
movzx eax, word [esi]
mov word [ecx + esi], ax
add esi, 2
test ax, ax
jne 0x10004f40
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push eax
push 0
call ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [ebp - 4], eax
call esi
push eax
push 0
call ebx
mov cl, byte [edi]
mov ebx, eax
xor eax, eax
test cl, cl
je 0x10004f94
jmp 0x10004f80
movsx dx, cl
mov ecx, dword [ebp - 4]
mov word [ecx + eax*2], dx
mov cl, byte [eax + edi + 1]
inc eax
test cl, cl
jne 0x10004f80
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
xor edx, edx
mov word [edi + eax*2], dx
mov cl, byte [esi]
xor eax, eax
test cl, cl
je 0x10004fc1
jmp 0x10004fb0
movsx cx, cl
mov word [ebx + eax*2], cx
mov cl, byte [eax + esi + 1]
inc eax
test cl, cl
jne 0x10004fb0
xor edx, edx
mov word [ebx + eax*2], dx
call fcn.10004cc0
push eax
push 0xdeadbeef
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0xdeadbeef
jne 0x10005032
lea edx, [ebp - 0x104]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10004ff1
lea edi, [ebp - 0x104]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005002
mov ecx, 0x15
mov esi, 0x10023f08
rep movsd dword es:[edi], dword [esi]
push 0x10
push 0x10023f60
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x104]
push eax
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ecx
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005ea0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.10014430
add esp, 0xc
xor eax, eax
push 0x104
lea ecx, [ebp - 0x464]
push ecx
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x464]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10005f07
xor al, al
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10005fa0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push esi
push edi
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
mov dword [ebp - 0x54], 0
call fcn.10014430
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x464]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x464]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005fe0
mov dx, word [0x10024710]
mov eax, dword [ebp + 8]
mov word [edi], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005ff7
lea edi, [ebp - 0x464]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10006007
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x200
push 0
push 0
push 0
lea edx, [ebp - 0x464]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
jne 0x10006053
xor al, al
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100062a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push 0x10024884
xor bl, bl
push SysReAllocStringLen
mov byte [eax], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006315
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0xc]
push edx
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push ecx
mov dword [ebp - 8], 3
call edi
test eax, eax
jne 0x10006309
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push esi
push edx
call edi
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0xc
push ebx
lea edx, [ebp - 4]
push edx
push 1
xor eax, eax
push eax
push str.SoftwareWinLicenseWLdebugTrial
push SysReAllocStringLen
xor bl, bl
mov word [ecx], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006398
mov edx, dword [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push esi
push edx
mov dword [ebp - 8], 3
call edi
test eax, eax
jne 0x1000638c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push esi
push eax
call edi
mov bl, 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100063b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x10024884
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10006416
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100063e5
sub eax, esi
inc eax
push eax
mov eax, dword [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x10006420
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
push str.SoftwareWinLicenseWLdebugTrial
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000648f
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006455
mov ecx, dword [ebp + 8]
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [ebp - 4]
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov esp, ebp
pop ebp
ret 8