joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c8cf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1005e7d0]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000c91f
mov bl, byte [0x1005e7cc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
add esp, 0x11c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1005e7d0
call fcn.10024716
add esp, 4
cmp dword [0x1005e7d0], 0xffffffff
jne 0x1000c902
mov eax, dword [0x1005e800]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000ca52
mov bl, 1
cmp byte [0x1005e7fc], 0
jne 0x1000c98b
mov eax, dword [0x1005e808]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000ca8f
cmp byte [0x1005e804], 0
je 0x1000c9a3
mov byte [0x1005e7cc], bl
push 0x1005e7d0
call fcn.100246cc
add esp, 4
jmp 0x1000c902
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.10027f80
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x1000c98b
lea eax, [ebp - 0x128]
mov dword [eax], ebx
push eax
push ebx
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x1000c98b
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
je 0x1000ca04
cmp eax, 6
jne 0x1000ca4b
mov bl, 1
mov eax, dword [ebp - 0x128]
cmp eax, 0x1b
ja 0x1000ca1f
mov ecx, 0xa07f7d0
bt ecx, eax
jb 0x1000c98b
lea ecx, [eax - 0x77]
cmp ecx, 0xb
ja 0x1000ca35
mov edx, 0xccd
bt edx, ecx
jb 0x1000c98b
add eax, 0xffffffba
cmp eax, 0xe
ja 0x1000ca4b
mov ecx, 0x4005
bt ecx, eax
jb 0x1000c98b
xor ebx, ebx
jmp 0x1000c98b
push 0x1005e800
call fcn.10024716
add esp, 4
cmp dword [0x1005e800], 0xffffffff
jne 0x1000c956
push 0x1c
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
setne byte [0x1005e7fc]
push 0x1005e800
call fcn.100246cc
add esp, 4
jmp 0x1000c956
push 0x1005e808
call fcn.10024716
add esp, 4
cmp dword [0x1005e808], 0xffffffff
jne 0x1000c982
xor eax, eax
mov dword [ebp - 0x124], eax
push 0x1100
push eax
push str.MDMRegistration.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x1000caea
push str.IsDeviceRegisteredWithManagement
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000caea
xor esi, esi
lea edi, [ebp - 0x124]
push esi
push esi
push edi
call eax
cmp dword [edi], esi
setne cl
jmp 0x1000cb01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
xor ecx, ecx
test eax, eax
setns al
and al, cl
mov byte [0x1005e804], al
push 0x1005e808
call fcn.100246cc
add esp, 4
jmp 0x1000c982
Function at 0x1000ccce
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.SCODEF
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x1000cd97
mov edi, eax
mov dword [ebp - 0x14], 0
push str.msiso.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000cd1c
mov ecx, 0x82
jmp 0x1000cd30
push str.iertutil.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000cd97
mov ecx, 0x1e0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cd97
mov ecx, eax
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x1c]
mov dword [esi], 0
lea eax, [ebp - 0x14]
push esi
push eax
push edi
call ecx
xor ebx, ebx
test eax, eax
jne 0x1000cd99
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000cd99
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000cd97
mov edi, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push esi
push esi
push esi
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
setne bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000cd99
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000cdad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [esp + 0x20], eax
xor edi, edi
dec edi
lea esi, [esp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
call fcn.1000ccce
mov bl, 1
test al, al
je 0x1000ce81
mov dword [esp], edi
mov dword [esp + 4], edi
xor eax, eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
push ebx
push 0x20119
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ce7f
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x18]
mov dword [edx], edi
lea eax, [esp + 0x1c]
mov dword [eax], 8
push eax
push ebx
mov ebx, ecx
push edx
xor edi, edi
push edi
push str.LatestUpsellAttemptedSessionTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
cmp dword [ecx], 0xb
mov ecx, 0xd
cmove ecx, edi
test eax, eax
cmovne ecx, eax
movzx edi, cx
or edi, 0x80070000
test ecx, ecx
cmovle edi, ecx
test edi, edi
jne 0x1000ce70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
test ebx, ebx
je 0x1000ce7b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1000ce96
xor ebx, ebx
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
setns bl
jmp 0x1000ce81
Function at 0x1000cea7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [esp + 0x20], eax
xor ebx, ebx
call fcn.1000cdad
test al, al
jne 0x1000cf59
lea ecx, [esp + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x10054460]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysReAllocString
call fcn.100043f2
mov ebx, 0
test eax, eax
jne 0x1000cf4a
xor eax, eax
dec eax
lea ecx, [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
call fcn.1000ccce
test al, al
je 0x1000cf44
movsd xmm0, qword [esp + 4]
lea eax, [esp + 0x18]
movsd qword [eax], xmm0
push 8
push eax
push 0xb
push 0
push str.LatestUpsellAttemptedSessionTime
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000cf48
xor ebx, ebx
jmp 0x1000cf4a
mov bl, 1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000cf59
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.10025727
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x1000cfc7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
mov dword [edi], esi
push edi
push 0x20119
push esi
push str.SoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000d022
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x1000d07c
xor eax, eax
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x14]
push edi
push 0x20119
push eax
push str.SoftwareMicrosoftEdgeIEToEdge
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000d050
mov ebx, eax
jmp 0x1000d07c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
mov edi, ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test edi, edi
je 0x1000d07c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], ecx
mov edi, 0x65e
cmove edi, eax
test ebx, ebx
cmovne edi, ebx
test esi, esi
je 0x1000d09c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d0be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 0xffffffff
mov ecx, str.DisabledPendingAutoUpdateConsent
mov edx, 4
push 4
push eax
call fcn.1000cfc7
add esp, 8
test eax, eax
jne 0x1000d0ff
xor esi, esi
cmp dword [ebp - 0x1c], 0
jne 0x1000d1ee
mov ebx, 0xffffffe8
xor esi, esi
lea edi, [ebp - 0x14]
mov eax, dword [ebx + 0x10054994]
mov ecx, dword [ebx + str.RedirectionMode]
mov dword [ebp - 0x14], esi
push edi
push 0x20119
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000d12f
xor edi, edi
jmp 0x1000d18e
mov ecx, edi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebx + 0x10054998]
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 4
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x20]
push edx
push ecx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 4
mov ecx, eax
mov edx, 0xd
cmovne ecx, edx
test eax, eax
cmovne ecx, eax
movzx edx, cx
or edx, 0x80070000
test ecx, ecx
cmovle edx, ecx
xor eax, eax
cmp dword [ebp - 0x20], esi
setne cl
test edx, edx
je 0x1000d1b1
xor esi, esi
mov al, 1
test edi, edi
je 0x1000d19f
push edi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
test al, al
je 0x1000d1bc
add ebx, 0xc
lea edi, [ebp - 0x14]
jne 0x1000d109
jmp 0x1000d1c1
mov al, cl
mov dword [ebp - 0x24], eax
xor eax, eax
xor esi, esi
jmp 0x1000d190
mov esi, dword [ebp - 0x24]
jmp 0x1000d1ee
mov dword [ebp - 0x14], 0xffffffff
mov ecx, str.RedirectionMode
mov edx, 4
push 4
push edi
call fcn.1000cfc7
add esp, 8
mov esi, dword [ebp - 0x14]
xor ecx, ecx
inc ecx
cmp esi, 3
cmovae esi, ecx
test eax, eax
cmovne esi, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d202
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
push ebx
push 0x20119
push esi
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000d23c
xor ebx, ebx
inc ebx
jmp 0x1000d296
mov edi, dword [ebp - 0x14]
xor ecx, ecx
lea eax, [ebp - 0x1c]
mov dword [eax], ecx
lea esi, [ebp - 0x18]
mov dword [esi], 0xffffffff
mov dword [ebp - 0x14], 4
push ebx
push eax
push esi
push ecx
xor ebx, ebx
push str.LastCustomerType
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esi], 4
mov ecx, 0xd
cmove ecx, ebx
test eax, eax
cmovne ecx, eax
movzx ebx, cx
or ebx, 0x80070000
test ecx, ecx
cmovle ebx, ecx
lea eax, [ebp - 0x1c]
mov esi, dword [eax]
test edi, edi
je 0x1000d296
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, 2
cmovae esi, eax
test ebx, ebx
cmovne esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000d2b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
sub esp, 0x1c
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x10054460]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysReAllocString
call fcn.100043f2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1000d33c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ecx], eax
mov eax, 4
push eax
push ecx
push eax
push 0
push str.LastCustomerType
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000d34a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x14
pop esi
pop ebp
ret
Function at 0x1000d5b5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
xor esi, esi
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax - 4], 0xc
push esi
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1000d689
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test eax, eax
jne 0x1000d680
push 2
call fcn.1000def1
add esp, 4
test al, al
je 0x1000d680
lea ebx, [ebp - 0xa8]
mov ecx, ebx
push 2
push 0x2fa
push str..._.._third_party_ie_to_edge_bho_ie_to_edge_util.cc
call fcn.1000df3a
push 0x1e
push str.Failed_to_create_mutex_named:
push ebx
call fcn.10005eef
add esp, 0xc
mov ebx, eax
push edi
call fcn.10036a95
add esp, 4
push eax
push edi
push ebx
call fcn.10005eef
add esp, 0xc
push 8
push str._Error:
push eax
call fcn.10005eef
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
push eax
call fcn.10002170
lea ecx, [ebp - 0xa8]
call fcn.1000e1da
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1005e7e8]
mov ecx, dword [0x1005dbfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000d73a
mov esi, dword [0x1005e7e4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1005e7e8
call fcn.10024716
add esp, 4
cmp dword [0x1005e7e8], 0xffffffff
jne 0x1000d720
mov esi, 0xffffffe8
xor edi, edi
mov eax, dword [esi + 0x10054ca4]
mov ecx, dword [esi + str.InternetExplorerIntegrationLevel]
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x14]
push edx
push 0x20119
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000d7da
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [esi + 0x10054ca8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 4
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 4
mov ecx, eax
mov edx, 0xd
cmovne ecx, edx
test eax, eax
cmovne ecx, eax
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
je 0x1000d7e7
test ebx, ebx
je 0x1000d7da
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
jne 0x1000d757
xor esi, esi
jmp 0x1000d807
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 2
sete cl
add ecx, ecx
cmp eax, 1
cmove ecx, eax
mov esi, ecx
test ebx, ebx
je 0x1000d807
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1005e7e4], esi
push 0x1005e7e8
call fcn.100246cc
add esp, 4
jmp 0x1000d720
Function at 0x1000e1da
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add eax, ecx
add eax, 0x1c
lea ebx, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.10001166
mov ecx, ebx
push 0x1005eda4
call fcn.1001f00e
mov edx, dword [eax]
mov ecx, eax
push 0xa
call dword [edx + 0x2c]
mov edi, eax
mov ecx, ebx
call fcn.1000117a
movzx eax, di
mov ecx, esi
push eax
call fcn.10002710
mov ecx, esi
call fcn.10001ca0
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea edi, [esi + 4]
mov ecx, edi
push ebx
call fcn.1000801e
mov eax, dword [0x1005e8c4]
test al, 0x10
je 0x1000e277
movzx eax, byte [ebp - 0x11]
test al, al
cmovs eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmovns ecx, ebx
push eax
push ecx
push 0x1005ea78
call fcn.10005eef
add esp, 0xc
mov eax, dword [0x1005e8c4]
test al, 0x20
je 0x1000e2b6
cmp dword [0x1005e850], 0
je 0x1000e2b6
lea ecx, [ebp - 0x1c]
movzx eax, byte [ecx + 0xb]
test al, al
cmovs eax, dword [ecx + 4]
cmovs ecx, dword [ecx]
push eax
push ecx
push 0x1005e80c
call fcn.10005eef
add esp, 0xc
cmp dword [esi + 0x88], 2
jl 0x1000e2b6
mov ecx, 0x1005e80c
call fcn.10001ca0
test byte [0x1005e8c4], 0x40
je 0x1000e2d9
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000e2d9
cmp byte [ebp - 0x11], 0
jns 0x1000e2d2
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x88], 3
jne 0x1000e2e8
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp byte [ebp - 0x11], 0
jns 0x1000e2f9
push dword [ebp - 0x1c]
call fcn.10024829
add esp, 4
lea ebx, [esi + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x10051f04
mov dword [esi + 4], 0x10051f10
cmp byte [esi + 0x2f], 0
jns 0x1000e320
push dword [esi + 0x24]
call fcn.10024829
add esp, 4
mov ecx, edi
call fcn.10001220
mov ecx, edi
call fcn.10001c90
mov ecx, ebx
call fcn.100011ee
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000f5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x1005edb4
call fcn.1001f00e
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x35], al
cmp dword [esi + 0x2c], 9
jge 0x1000f5b6
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.1001ab45
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1000f6c2

Function at 0x1000f5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1000f6c2
Function at 0x1000f8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x1005edbc
call fcn.1001f00e
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x33], al
cmp dword [esi + 0x2c], 9
jge 0x1000f896
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.1001ab45
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1000f9a6

Function at 0x1000f8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1000f9a6

Function at 0x1000fb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.10035e25
add esp, 0x10
cmp eax, esi
jne 0x1000fbd3
cmp ebx, 1
je 0x1000fb75
cmp ebx, 2
mov esi, 0xffffffff
je 0x1000fbd6
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.10034f41
add esp, 4
neg eax
sbb esi, esi
jmp 0x1000fbd6
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000fbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x1000fc14
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.10035e25
add esp, 0x14
jmp 0x1000fc43
test esi, esi
jle 0x1000fc3c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x1000fc3e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1000fc1d
mov edi, esi
jmp 0x1000fc3e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8