joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b37
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
jne 0x10039d5
push 0x57
pop eax
jmp 0x1003c04
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001624
push edi
call esi
mov dword [0x100b5c8], eax
test eax, eax
je 0x1003bf3
push 0x1001614
push edi
call esi
mov dword [0x100b5cc], eax
test eax, eax
je 0x1003bf3
push 0x1001608
push edi
call esi
mov dword [0x100b5d0], eax
test eax, eax
je 0x1003bf3
push 0x10015f8
push edi
call esi
mov dword [0x100b5d8], eax
test eax, eax
je 0x1003bf3
push 0x10015e4
push edi
call esi
mov dword [0x100b5d4], eax
test eax, eax
je 0x1003bf3
push 0x10015cc
push edi
call esi
mov dword [0x100b5dc], eax
test eax, eax
je 0x1003bf3
push 0x10015b4
push edi
call esi
mov dword [0x100b5e0], eax
test eax, eax
je 0x1003bf3
push 0x100159c
push edi
call esi
mov dword [0x100b5e4], eax
test eax, eax
je 0x1003bf3
push 0x1001588
push edi
call esi
mov dword [0x100b5ec], eax
test eax, eax
je 0x1003bf3
push 0x1001570
push edi
call esi
mov dword [0x100b5f0], eax
test eax, eax
je 0x1003bf3
push 0x100155c
push edi
call esi
mov dword [0x100b5f8], eax
test eax, eax
je 0x1003bf3
push 0x1001550
push edi
call esi
mov dword [0x100b5fc], eax
test eax, eax
je 0x1003bf3
push 0x1001538
push edi
call esi
mov dword [0x100b600], eax
test eax, eax
je 0x1003bf3
push 0x1001520
push edi
call esi
mov dword [0x100b604], eax
test eax, eax
je 0x1003bf3
push 0x1001514
push edi
call esi
mov dword [0x100b608], eax
test eax, eax
je 0x1003bf3
push 0x10014fc
push edi
call esi
mov dword [0x100b614], eax
test eax, eax
je 0x1003bf3
push 0x10014e4
push edi
call esi
mov dword [0x100b618], eax
test eax, eax
je 0x1003bf3
push 0x10014d0
push edi
call esi
mov dword [0x100b61c], eax
test eax, eax
je 0x1003bf3
push 0x10014bc
push edi
call esi
mov dword [0x100b620], eax
test eax, eax
je 0x1003bf3
push 0x10014a8
push edi
call esi
mov dword [0x100b5e8], eax
test eax, eax
je 0x1003bf3
push 0x1001498
push edi
call esi
mov dword [0x100b60c], eax
test eax, eax
je 0x1003bf3
push 0x1001484
push edi
call esi
mov dword [0x100b610], eax
test eax, eax
je 0x1003bf3
push 0x100146c
push edi
call esi
mov dword [0x100b5f4], eax
test eax, eax
je 0x1003bf3
push 0x1001454
push edi
call esi
mov dword [0x100b624], eax
test eax, eax
je 0x1003bf3
push 0x1001438
push edi
call esi
mov dword [0x100b62c], eax
test eax, eax
je 0x1003bf3
push 0x1001420
push edi
call esi
mov dword [0x100b630], eax
test eax, eax
je 0x1003bf3
push 0x100140c
push edi
call esi
mov dword [0x100b634], eax
test eax, eax
jne 0x1003bfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x100b5c4], edi
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1003fa6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
xor eax, eax
mov dword [0x100b5c8], eax
mov dword [0x100b5cc], eax
mov dword [0x100b5d0], eax
mov dword [0x100b5d8], eax
mov dword [0x100b5d4], eax
mov dword [0x100b5e4], eax
mov dword [0x100b5ec], eax
mov dword [0x100b5f8], eax
mov dword [0x100b608], eax
mov dword [0x100b5dc], eax
mov dword [0x100b5e0], eax
mov dword [0x100b600], eax
mov dword [0x100b614], eax
mov dword [0x100b618], eax
mov dword [0x100b604], eax
mov dword [0x100b5fc], eax
mov dword [0x100b61c], eax
mov dword [0x100b620], eax
mov dword [0x100b5e8], eax
mov dword [0x100b624], eax
mov dword [0x100b634], eax
ret

Function at 0x100425f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 0
push 0x10
call fcn.01006afe
mov edi, eax
test edi, edi
je 0x10042c7
push esi
push dword [ebp + 8]
mov esi, dword [edi + 8]
call fcn.01005de7
push dword [ebp + 0xc]
mov dword [esi], eax
call fcn.01005de7
push dword [ebp + 0x10]
mov dword [esi + 4], eax
call fcn.01005de7
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
mov dword [esi + 8], eax
test ecx, ecx
je 0x10042a8
cmp dword [esi + 4], 0
je 0x10042a8
test eax, eax
je 0x10042a8
mov eax, edi
jmp 0x10042c6
push ecx
call fcn.01005662
push dword [esi + 4]
call fcn.01005662
push dword [esi + 8]
call fcn.01005662
push edi
call fcn.01006b5f
xor eax, eax
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x10043a8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x100b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push esi
mov dword [ebp - 0x154], edi
call fcn.01006ad2
mov dword [ebp - 0x144], eax
cmp eax, esi
je 0x1004575
lea eax, [ebp - 0x130]
push eax
push 0x20019
push esi
push 0x100184c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004561
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push esi
push dword [ebp - 0x130]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], 0x94
call edi
mov ebx, 0x103
jmp 0x1004547
cmp eax, esi
jne 0x1004517
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.01005f23
test eax, eax
je 0x1004517
lea eax, [ebp - 0x13c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10044ff
lea eax, [ebp - 0x150]
push eax
push 0x1001834
push dword [ebp - 0x13c]
call fcn.01006c17
lea eax, [ebp - 0x148]
push eax
push 0x1001824
push dword [ebp - 0x13c]
call fcn.01006d7b
test eax, eax
jne 0x10044f3
push dword [ebp - 0x150]
push dword [ebp - 0x148]
push dword [ebp - 0x140]
push dword [ebp - 0x14c]
call fcn.01004255
cmp eax, esi
je 0x10044e7
push eax
push dword [ebp - 0x144]
call fcn.01006a93
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
inc dword [ebp - 0x138]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x138]
mov dword [ebp - 0x134], 0x94
push dword [ebp - 0x130]
call edi
cmp eax, ebx
jne 0x100443a
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x154]
push 0x10042e1
push dword [edi]
call fcn.01006bd7
mov eax, dword [ebp - 0x144]
mov dword [edi], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003217
leave
ret 8
Function at 0x1006210
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x10061a7
push 0x1002358
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
push edi
push 0
call fcn.01006ad2
mov edi, dword [ebp + 8]
mov dword [edi], eax
test eax, eax
jne 0x10061c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006229
push ebx
push esi
mov esi, dword [ebp + 0xc]
jmp 0x1006207
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.01004226
mov ebx, eax
test ebx, ebx
je 0x100622e
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x10061fc
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push 0x100232c
push 0xc
push eax
call fcn.0100368a
add esp, 0x18
push ebx
push dword [edi]
call fcn.01006a93
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x10061c7
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x1006225
push 0x1002310
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006227
Function at 0x1006327
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x100625a
push 0x1002388
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
push dword [esi + 0x44]
lea eax, [edi + 0x44]
push eax
call fcn.0100600c
test eax, eax
jne 0x1006414
mov word [esi + 0x148], ax
lea eax, [esi + 0x48]
push eax
call fcn.01005de7
mov dword [edi + 0x48], eax
test eax, eax
jne 0x10062fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006414
mov eax, dword [esi + 0x14c]
mov dword [edi + 0x4c], eax
xor eax, eax
mov word [esi + 0x356], ax
lea eax, [esi + 0x150]
push eax
call fcn.01005de7
mov dword [edi + 0x50], eax
test eax, eax
je 0x10062f1
xor eax, eax
mov word [esi + 0x55e], ax
lea eax, [esi + 0x358]
push eax
call fcn.01005de7
mov dword [edi + 0x54], eax
test eax, eax
je 0x10062f1
push dword [esi + 0x560]
lea eax, [edi + 0x58]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x564]
lea eax, [edi + 0x5c]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
mov eax, dword [esi + 0x568]
mov dword [edi + 0x60], eax
push dword [esi + 0x56c]
lea eax, [edi + 0x64]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x570]
lea eax, [edi + 0x68]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x574]
lea eax, [edi + 0x6c]
push eax
call fcn.01006188
test eax, eax
jne 0x1006414
mov eax, dword [esi + 0x578]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x57c]
mov dword [edi + 0x74], eax
xor eax, eax
mov word [esi + 0x77e], ax
lea eax, [esi + 0x580]
push eax
call fcn.01005de7
mov dword [edi + 0x78], eax
test eax, eax
je 0x10062f1
mov eax, dword [esi + 0x784]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x788]
mov dword [edi + 0x80], eax
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x1006412
push 0x1002374
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x1006395
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x100625a
push 0x1002388
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
push dword [esi + 0x44]
lea eax, [edi + 0x44]
push eax
call fcn.0100600c
test eax, eax
jne 0x1006414
mov word [esi + 0x148], ax
lea eax, [esi + 0x48]
push eax
call fcn.01005de7
mov dword [edi + 0x48], eax
test eax, eax
jne 0x10062fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006414
mov eax, dword [esi + 0x14c]
mov dword [edi + 0x4c], eax
xor eax, eax
mov word [esi + 0x356], ax
lea eax, [esi + 0x150]
push eax
call fcn.01005de7
mov dword [edi + 0x50], eax
test eax, eax
je 0x10062f1
xor eax, eax
mov word [esi + 0x55e], ax
lea eax, [esi + 0x358]
push eax
call fcn.01005de7
mov dword [edi + 0x54], eax
test eax, eax
je 0x10062f1
push dword [esi + 0x560]
lea eax, [edi + 0x58]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x564]
lea eax, [edi + 0x5c]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
mov eax, dword [esi + 0x568]
mov dword [edi + 0x60], eax
push dword [esi + 0x56c]
lea eax, [edi + 0x64]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x570]
lea eax, [edi + 0x68]
push eax
call fcn.010060e0
test eax, eax
jne 0x1006414
push dword [esi + 0x574]
lea eax, [edi + 0x6c]
push eax
call fcn.01006188
test eax, eax
jne 0x1006414
mov eax, dword [esi + 0x578]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x57c]
mov dword [edi + 0x74], eax
xor eax, eax
mov word [esi + 0x77e], ax
lea eax, [esi + 0x580]
push eax
call fcn.01005de7
mov dword [edi + 0x78], eax
test eax, eax
je 0x10062f1
mov eax, dword [esi + 0x784]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x788]
mov dword [edi + 0x80], eax
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x1006412
push 0x1002374
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x100655f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100b018]
and dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x100646d
push 0x10023b8
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
mov eax, dword [ebp + 8]
and dword [eax], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push esi
push edi
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1006563
mov ebx, 0x81
jmp 0x1006490
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
push 0x230
call fcn.0100641f
mov esi, eax
test esi, esi
je 0x1006586
mov eax, dword [edi]
test eax, eax
je 0x10064c0
push eax
push 0x11
push esi
call fcn.01006a47
test eax, eax
jne 0x100657f
jmp 0x10064c5
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 4]
test eax, eax
je 0x10064e1
push eax
push ebx
lea eax, [esi + 0x22]
push eax
call fcn.01006a47
test eax, eax
jne 0x100657f
jmp 0x10064e7
xor eax, eax
mov word [esi + 0x22], ax
mov eax, dword [edi + 8]
test eax, eax
je 0x1006502
push eax
push ebx
lea eax, [esi + 0x124]
push eax
call fcn.01006a47
test eax, eax
jne 0x100657f
jmp 0x100650b
xor eax, eax
mov word [esi + 0x124], ax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x228], eax
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x1006533
push dword [edi + 4]
push dword [edi]
push 0x100227c
push 0xc
push eax
call fcn.0100368a
add esp, 0x14
mov eax, dword [ebp + 8]
and dword [esi + 0x22c], 0
cmp dword [eax], 0
jne 0x1006546
mov dword [eax], esi
jmp 0x100654f
mov eax, dword [ebp - 4]
mov dword [eax + 0x22c], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100648d
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x100657d
push 0x10023a0
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100657f

Function at 0x10066e5
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100b018]
and dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x1006699
push 0x10023ec
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
mov eax, dword [ebp + 8]
and dword [eax], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [eax]
jmp 0x1006714
mov ebx, dword [edi + 8]
push 0x204
call fcn.0100641f
mov esi, eax
test esi, esi
je 0x100673b
test ebx, ebx
je 0x10066d2
push ebx
push 0x100
push esi
call fcn.01006a47
test eax, eax
jne 0x1006734
jmp 0x10066d7
xor eax, eax
mov word [esi], ax
and dword [esi + 0x200], 0
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x10066f9
push ebx
push 0x10022d4
push 0xc
push eax
call fcn.0100368a
add esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1006705
mov dword [eax], esi
jmp 0x100670e
mov eax, dword [ebp - 4]
mov dword [eax + 0x200], esi
mov edi, dword [edi + 4]
mov dword [ebp - 4], esi
test edi, edi
jne 0x10066a9
mov eax, dword [0x100b018]
cmp eax, 0xffffffff
je 0x1006732
push 0x10023d4
push 0xc
push eax
call fcn.0100368a
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006734
Function at 0x10070a8
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [eax]
push edi
mov dword [ebp - 0xc], 2
test esi, esi
je 0x1007012
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp + 0x14], 1
jne 0x1006fe8
push dword [esi + 8]
call edi
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*2 + 2]
jmp 0x1007003
mov ebx, dword [esi + 8]
push dword [ebx + 4]
call edi
push dword [ebx]
mov dword [ebp - 0x10], eax
call edi
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + ecx*2 + 6]
mov esi, dword [esi + 4]
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x1006fd4
cmp eax, 2
jne 0x1007019
mov dword [ebp - 0xc], 4
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1007033
push 8
pop eax
jmp 0x10070fb
mov ecx, dword [ebp - 0xc]
shr ecx, 1
cmp dword [ebp - 0xc], 4
mov dword [ebp - 8], ecx
jne 0x100704f
xor ecx, ecx
mov word [eax + 2], cx
mov word [eax], cx
jmp 0x10070da
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx]
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10070d2
mov esi, 0x100
cmp dword [ebp + 0x14], 1
push esi
jne 0x1007075
mov eax, dword [ebx + 8]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
jmp 0x10070b2
mov edi, dword [ebx + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [edi]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01005a25
test eax, eax
jl 0x1007102
add dword [ebp - 4], 2
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 2
sub dword [ebp - 8], 2
push 0x3d
pop eax
mov word [ecx], ax
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01005a25
test eax, eax
jl 0x1007102
add dword [ebp - 4], 2
mov ebx, dword [ebx + 4]
dec dword [ebp - 8]
test ebx, ebx
jne 0x1007060
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov word [edx], cx
push dword [ebp - 0xc]
push eax
push 7
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
movzx esi, ax
jmp 0x10070f0
Function at 0x100756c
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
xor ebx, ebx
push ebx
call esi
push 1
mov edi, eax
call esi
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 8], edi
jle 0x1007563
sub edi, dword [ebp - 8]
add dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jge 0x100756b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 4], esi
jle 0x1007576
sub esi, dword [ebp - 4]
add dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jge 0x100757e
mov dword [ebp - 0xc], ebx
push 5
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x3190c87
Capabilities:
Encode data using xor

Disassembly:
call fcn.0319d8a8
mov edx, 0x28d9420d
adc byte [edi + ecx + 0x522ec13], dh
xchg ebx, eax
in al, 0xe6
sbb dword [edx], ebp
clc
and eax, 0x861d9aac
insb byte es:[edi], dx
mov ecx, 0xff1c65e8
movsd dword es:[edi], dword [esi]
nop
xor dword [esi], 0x810b538c
call dword [edx + 0x15]
pop es
cmp ecx, esp
salc
loope 0x3190c9d
nop
ficomp dword [edx + edx]
sbb dh, dl
xchg ebx, eax
imul edx, ebx, 0x973369a0
pushal
adc bh, byte [ebp + 0x47]
shr dword [esi], 0xf7
outsd dx, dword [esi]
adc eax, 0x982bf886
pushal
mov edx, 0x7833d0d
shr dword [edi - 0x4070bbe3], 0xae
fidiv word [ecx - 0x16e15b14]
dec ebx
rol ah, 1
retf

Function at 0x3191a94
Capabilities:
Authenticate hmac

Disassembly:
push esp
lea esp, [esp + 0x30]
ja 0x31a085e
cmc
sub ebx, edi
sal edi, 0x16
neg al
add ebx, esp
pushfd
add di, 0x8a76
or edi, esi
add di, bx
mov edi, ebx
bt di, bx
sbb al, bh
rcl al, cl
sar al, 5
mov al, 0x2e
pushal
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebx
lea esp, [esp + 0x24]
jne 0x3249b12
lahf
cwde
mov byte [edi - 1], 0
not ah
pushal
lahf
movsx ax, bl
mov dword [esp + 0x1c], ebx
bswap eax
sete ah
lea eax, [0x31919cc]
pushfd
call fcn.0319c713
sal dword [esi], 0x58
mov cl, 0x36
adc byte [ebp + edx*2 + 0x7b99be89], dh
fidivr dword [ebx + 0x78]
mov edx, 0xe6ac5b89
push esi
push ecx
hlt

Function at 0x319c713
Capabilities:
Encode data using xor

Disassembly:
push esp
mov dword [esp + 0x24], 0x3252e4c
call fcn.0318ee98
pop ss
cmp byte [ebx + 0x25], dh
in al, 0x10
mov ah, 0xc1
push esp
xor dword [ebp - 0x39], ecx
jl 0x319c775
jno 0x319c784
add dl, byte [ebx - 0x38d29914]
push esp
jle 0x319c762
outsd dx, dword [esi]
cld
cmpsb byte [esi], byte es:[edi]
jmp 0xe4140d3d
salc
imul edi, esi, 0xffc7d6a
invalid
sbb dh, 0x44
loop 0x319c7e0
xor eax, 0x739d593d
or al, 0x1b
popal
test byte [esi + 0x212b3adc], bl
fdivr qword [edx]
sub esp, dword [ecx]
cmpsd dword [esi], dword es:[edi]
pop eax
invalid
fimul word [ebp + 0xf282464]
xchg dword [edi], esp
ror dword [edx], cl
add ch, dh