joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e278
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.100493f0
xor al, 1
je 0x1003e2b3
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.100493f8
push eax
mov eax, ebx
call fcn.1000b0a4
lea eax, [esp + 8]
call fcn.10049414
lea eax, [esp + 8]
call fcn.100493f0
xor al, 1
jne 0x1003e288
pop ebx
ret 8

Function at 0x1004669c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
call fcn.1000a8e0
mov dword [esp + 4], eax
push dword [esp + 0x28]
lea eax, [esp + 8]
call fcn.1000aa04
push dword [esp + 0x2c]
push dword [esp + 0x2c]
lea eax, [esp + 0x1c]
call fcn.100516b4
lea eax, [esp + 0x14]
call fcn.1005171c
xor al, 1
je 0x100466fc
lea eax, [esp + 0x14]
call fcn.10051734
push eax
lea eax, [esp + 8]
call fcn.1000c094
lea eax, [esp + 0x14]
call fcn.10051818
lea eax, [esp + 0x14]
call fcn.1005171c
xor al, 1
jne 0x100466d3
lea eax, [esp + 4]
call fcn.1000aa40
add esp, 0x24
ret 8

Function at 0x10046c7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.10051ee4
xor al, 1
je 0x10046cb7
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.10051eec
push eax
mov eax, ebx
call fcn.1000b0a4
lea eax, [esp + 8]
call fcn.10051f08
lea eax, [esp + 8]
call fcn.10051ee4
xor al, 1
jne 0x10046c8c
pop ebx
ret 8

Function at 0x10047380
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x1c]
mov dword [esp], ebx
mov ebx, edx
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
and esi, 0xfffffffc
mov dword [esp + 8], edi
add esi, edx
cmp edx, esi
mov dword [esp + 0xc], eax
je 0x100473dc
mov ecx, dword [ebx]
add ebx, 4
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul edx, ecx, 0x1b873593
mov ecx, edx
xor dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
cmp ebx, esi
mov dword [esp + 0xc], edx
jne 0x100473a8
mov edx, dword [esp + 0x18]
mov eax, edx
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x1004740a
cmp eax, 2
je 0x10047401
cmp eax, 3
je 0x100473fa
jmp 0x1004742a
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx esi, byte [ebx + 1]
shl esi, 8
xor ecx, esi
movzx edi, byte [ebx]
xor ecx, edi
imul eax, ecx, 0xcc9e2d51
mov esi, eax
mov ecx, eax
rol esi, 0xf
mov ecx, esi
imul edi, ecx, 0x1b873593
mov ecx, edi
xor dword [esp + 0xc], ecx
xor dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
movsx ebx, word [esp + 0xe]
and ebx, 0xffff
xor dword [esp + 0x10], ebx
imul eax, dword [esp + 0x10], 0x85ebca6b
mov dword [esp + 0x10], eax
shr eax, 0xd
xor dword [esp + 0x10], eax
imul esi, dword [esp + 0x10], 0xc2b2ae35
mov dword [esp + 0x10], esi
movsx edi, word [esp + 0x12]
and edi, 0xffff
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
ret 8
Function at 0x1004a354
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x1004a57d
push edx
mov edx, 0x10071680
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x134
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x144], 0x64
mov dword [ebp - 0x148], edx
call fcn.1001dbd4
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], edx
call fcn.10037668
push dword [ebp + 0x10]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x120]
push dword [ebp + 0xc]
call fcn.100201c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
call fcn.10020398
mov edi, eax
lea eax, [ebp - 0x124]
push eax
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
push edx
push ecx
push 0
push edi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
cmp eax, 0xea
jne 0x1004a474
lea ecx, [ebp - 0x130]
mov edx, 0x10071680
push ecx
push dword [ebp - 0x124]
push edx
call fcn.100189d0
lea eax, [ebp - 0x120]
call fcn.10020398
mov edi, eax
lea eax, [ebp - 0x124]
push eax
mov edx, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
push edx
push ecx
push 0
push edi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
add esp, 0xc
push esi
mov ecx, 0x1004a5a8
xor ebx, ebx
push ecx
mov edi, 0x1003e8d0
mov eax, 0x2c7
push ebx
push edi
push 0x16
call fcn.10049e90
mov edx, dword [ebp - 0x128]
cmp edx, dword [ebp - 0x18]
sete cl
mov edx, 0x1004a5f0
push ecx
xor ebx, ebx
push edx
push ebx
call fcn.1000c6ac
mov eax, dword [ebp - 0x128]
cmp eax, 3
je 0x1004a4b8
jmp 0x1004a4e9
lea esi, [ebp - 0x130]
mov ecx, 0x10071680
push esi
push dword [ebp - 0x124]
push ecx
call fcn.100189d0
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
mov dword [ebx], eax
mov dword [ebx + 4], edx
add esp, 0xc
jmp 0x1004a521
mov edi, 0x10082bd0
push edi
call fcn.1001e334
add esp, 4
mov esi, 0x1004a32c
push esi
mov ebx, eax
mov ecx, 0x1003e8d0
push 0x27
mov eax, 0x16
push ecx
push eax
mov eax, ebx
push 0x2d3
push 0
call fcn.1003e83c
push eax
call fcn.10019b14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x10085ff0
call fcn.1001d55c
add esp, 0xc
call fcn.1004a545
jmp 0x1004a558
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004a658
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x1004a7a7
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x12c
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
mov dword [ecx], 0
mov dword [ecx + 4], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x12c], 8
push dword [ebp + 0xc]
call fcn.100201c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x12c]
push edx
lea ebx, [ebp - 0x130]
lea eax, [ebp - 0x120]
push dword [ebp + 8]
push ebx
push 0
call fcn.10020398
push eax
push dword [ebp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ecx, 0x1004a7b4
xor esi, esi
push eax
mov edx, 0x1003e8d0
mov eax, 0x2a5
push ecx
push esi
push edx
push 0x16
call fcn.10049e90
mov dword [ebp - 4], 0xffffffff
call fcn.1004a71c
jmp 0x1004a728
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x18]
sete bl
mov edx, 0x1004a7c0
push ebx
xor esi, esi
push edx
push esi
call fcn.1000c6ac
mov eax, dword [ebp - 0x130]
cmp eax, 0xb
je 0x1004a782
mov ecx, 0x1004a628
mov edx, 0x1003e8d0
mov ebx, 0x16
push ecx
mov esi, 0x10082bd0
push 0x2f
push edx
push ebx
push 0x2b0
push 0
push esi
call fcn.1001e334
add esp, 4
call fcn.1003e83c
push eax
call fcn.10019b14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004a828
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x1004a982
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x12c
mov dword [ebp - 0x13c], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
mov dword [ecx], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x12c], 4
push dword [ebp + 0xc]
call fcn.100201c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x12c]
push edx
lea ebx, [ebp - 0x130]
lea eax, [ebp - 0x120]
push dword [ebp + 8]
push ebx
push 0
call fcn.10020398
push eax
push dword [ebp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ecx, 0x1004a98c
xor esi, esi
push eax
mov edx, 0x1003e8d0
mov eax, 0x281
push ecx
push esi
push edx
push 0x16
call fcn.10049e90
mov dword [ebp - 4], 0xffffffff
call fcn.1004a8e5
jmp 0x1004a8f1
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x18]
sete bl
mov edx, 0x1004a998
push ebx
xor esi, esi
push edx
push esi
call fcn.1000c6ac
mov eax, dword [ebp - 0x130]
cmp eax, 4
je 0x1004a95d
cmp eax, 5
je 0x1004a91e
jmp 0x1004a929
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
bswap ecx
mov dword [edx], ecx
jmp 0x1004a95d
mov ebx, 0x1004a7f8
mov edx, 0x1003e8d0
mov esi, 0x16
push ebx
mov eax, 0x10082bd0
push 0x2f
push edx
push esi
push 0x297
push 0
push eax
call fcn.1001e334
add esp, 4
call fcn.1003e83c
push eax
call fcn.10019b14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004ad28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x1004afbd
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x13c
mov dword [ebp - 0x148], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x150], ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x14c], esi
lea esi, [ebp - 0x144]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x124]
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x130], 8
push dword [ebp + 0xc]
call fcn.100201c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x124]
call fcn.10020398
lea ecx, [ebp - 0x134]
lea ecx, [ebp - 0x130]
lea edx, [ebp - 0x144]
push ecx
push edx
lea edx, [ebp - 0x134]
push edx
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xea
jne 0x1004ae2f
push dword [ebp - 0x130]
mov ecx, 0x100715c0
push ecx
call fcn.1001dbd4
mov esi, edx
lea eax, [ebp - 0x124]
call fcn.10020398
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x134]
push esi
push edx
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x1c], eax
add esp, 8
push dword [ebp - 0x1c]
mov edx, 0x1004afc8
xor ebx, ebx
push edx
mov ecx, 0x1003e8d0
mov eax, 0x221
push ebx
push ecx
push 0x16
call fcn.10049e90
mov edx, dword [ebp - 0x134]
cmp edx, dword [ebp - 0x18]
sete cl
mov edx, 0x1004afd4
push ecx
xor ebx, ebx
push edx
push ebx
call fcn.1000c6ac
mov ebx, dword [ebp - 0x134]
cmp ebx, 0xb
ja case.0x1004ae77.0
jmp dword [ebx*4 + 0x10086070]
mov dword [ebp - 0x138], esi
mov ecx, dword [ebp - 0x130]
shr ecx, 1
mov dword [ebp - 0x13c], ecx
cmp dword [ebp - 0x13c], 0
je 0x1004aed3
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + edx*2]
mov eax, dword [ebp - 0x13c]
cmp word [ecx - 2], 0
jne 0x1004aed3
lea ebx, [ebp - 0x13c]
mov edx, 0x10086f40
push ebx
mov eax, dword [ebp - 0x13c]
lea esi, [eax - 1]
push esi
push edx
call fcn.100234d4
add esp, 0xc
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
call fcn.10052f78
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x1004af61
mov eax, dword [ebp - 0x144]
call fcn.100102e4
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x1004af61
mov eax, dword [ebp - 0x144]
bswap eax
call fcn.100102e4
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x1004af61
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call fcn.10052f8c
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x1004af61
mov ecx, 0x10082bd0
push ecx
call fcn.1001e334
add esp, 4
mov edi, 0x1004a32c
push edi
mov ebx, eax
mov edx, 0x1003e8d0
push 0x27
mov eax, 0x16
push edx
push eax
mov eax, ebx
push 0x247
push 0
call fcn.1003e83c
push eax
call fcn.10019b14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x100860a0
call fcn.1001d55c
add esp, 0xc
call fcn.1004af85
jmp 0x1004af98
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x148]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004b7d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x1004b9da
push edx
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ebx
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], eax
push dword [eax + 8]
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [ebp - 0x18]
push 0
push 1
mov ecx, dword [ebp - 0x18]
inc dword [eax + 0x30]
push dword [ecx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
mov esi, dword [eax]
call dword [esi + 0x1c]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov edx, dword [ebp - 0x18]
push dword [edx + 0xc]
call sub.KERNEL32.DLL_WaitForSingleObject
mov esi, eax
cmp eax, 0x102
sete cl
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], cl
lea ecx, [edx + 0x14]
push ecx
call sub.KERNEL32.DLL_EnterCriticalSection
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
mov edi, dword [edx + 0x34]
test edi, edi
je 0x1004b8c9
cmp byte [ebp - 0x1c], 0
je 0x1004b888
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x1004b881
mov edx, dword [ebp - 0x18]
xor edi, edi
dec dword [edx + 0x30]
jmp 0x1004b888
mov dword [ecx + 0x2c], 1
mov ecx, dword [ebp - 0x18]
dec dword [ecx + 0x34]
mov edx, dword [ecx + 0x34]
test edx, edx
jne 0x1004b910
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x30], 0
je 0x1004b8b3
push 0
push 1
mov edx, dword [ebp - 0x18]
push dword [edx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
xor edi, edi
jmp 0x1004b910
mov edx, dword [ebp - 0x18]
mov ebx, dword [edx + 0x2c]
test ebx, ebx
je 0x1004b910
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x2c], 0
jmp 0x1004b910
mov ecx, dword [ebp - 0x18]
inc dword [ecx + 0x2c]
mov edx, dword [ecx + 0x2c]
cmp edx, 0x3fffffff
jne 0x1004b910
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push dword [ecx + 8]
call sub.KERNEL32.DLL_WaitForSingleObject
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x2c]
push 0
mov edx, dword [ebp - 0x18]
mov esi, eax
sub dword [edx + 0x30], ecx
push 1
mov ecx, dword [ebp - 0x18]
push dword [ecx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov edx, dword [ebp - 0x18]
mov esi, eax
mov dword [edx + 0x2c], 0
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + 0x14]
push edx
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp edi, 1
jne 0x1004b94c
test ebx, ebx
jle 0x1004b939
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push dword [ecx + 0xc]
call sub.KERNEL32.DLL_WaitForSingleObject
dec ebx
mov esi, eax
test ebx, ebx
jg 0x1004b925
push 0
push 1
mov ebx, dword [ebp - 0x18]
push dword [ebx + 8]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
jmp 0x1004b961
test edi, edi
je 0x1004b961
push 0
push 1
mov eax, dword [ebp - 0x18]
push dword [eax + 0xc]
call sub.KERNEL32.DLL_ReleaseSemaphore
mov esi, eax
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
movsx eax, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov esp, ebp
xor al, 1
pop ebp
ret 4
Function at 0x1004c790
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
push eax
mov eax, 1
push 0
call fcn.100536dc
xor al, 1
je 0x1004c7ba
call fcn.100249c4
mov eax, 1
push ebx
push 0
call fcn.100536dc
xor al, 1
jne 0x1004c7a4
pop ebx
ret

Function at 0x1004e894
Capabilities:
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
pop ecx
ret

Function at 0x1004eca8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ecx
ret
Function at 0x10052780
Capabilities:
Resume thread

Disassembly:
sub esp, 0x14
mov dword [esp + 0xc], edi
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0xc]
push ecx
sub esp, 4
call sub.KERNEL32.DLL_GetCurrentThreadId
add esp, 4
pop ecx
cmp ecx, eax
je 0x100527e7
push dword [edi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x100527e7
mov eax, edi
call fcn.10024998
xor al, 1
je 0x100527d8
mov eax, edi
call fcn.10024c18
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x14
ret
mov edx, 0x10052768
xor eax, eax
push edx
push 0x17
call fcn.1002bacc
movsx ebx, byte [edi + 0x4c]
xor bl, 1
je 0x100527f8
mov ecx, dword [edi + 0x48]
mov esi, dword [ecx]
mov dword [ecx + 4], esi
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ecx, 8
xor eax, eax
add edi, 0x54
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x14
ret

Function at 0x10052fa0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.10037668
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
je 0x10053004
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x100818b0
call fcn.100234d4
mov eax, dword [ebx]
call fcn.10037668
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
jne 0x10052fec
jmp 0x10053004

Function at 0x10053048
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.10037668
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
je 0x100530ac
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x100818b0
call fcn.100234d4
mov eax, dword [ebx]
call fcn.10037668
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
jne 0x10053094
jmp 0x100530ac
Function at 0x10054dd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.10009924
xor al, 1
je 0x10054dfb
inc ebx
lea eax, [esp + 8]
call fcn.10009948
lea eax, [esp + 8]
call fcn.10009924
xor al, 1
jne 0x10054de4
mov eax, ebx
pop ebx
ret 8

Function at 0x10056460
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.10009924
xor al, 1
je 0x1005649b
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.1000992c
push eax
mov eax, ebx
call fcn.1005ad94
lea eax, [esp + 8]
call fcn.10009948
lea eax, [esp + 8]
call fcn.10009924
xor al, 1
jne 0x10056470
pop ebx
ret 8

Function at 0x100583d4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov dword [esp + 4], esi
mov dword [esp + 8], edi
call fcn.1005c344
lea esi, [esp + 0x38]
lea edi, [esp + 0x1c]
mov dword [esp + 0xc], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
call fcn.100582a8
xor al, 1
je 0x1005842d
lea eax, [esp + 0x1c]
call fcn.10058270
push edx
push eax
lea eax, [esp + 0x14]
call fcn.1005c37c
lea eax, [esp + 0x1c]
call fcn.100582bc
lea eax, [esp + 0x1c]
call fcn.100582a8
xor al, 1
jne 0x10058403
lea eax, [esp + 0xc]
call fcn.1005c5a8
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x34
ret 0x18

Function at 0x1005c6e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.1005f15c
xor al, 1
je 0x1005c71b
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.1005f164
push eax
mov eax, ebx
call fcn.1000b0a4
lea eax, [esp + 8]
call fcn.1005f180
lea eax, [esp + 8]
call fcn.1005f15c
xor al, 1
jne 0x1005c6f0
pop ebx
ret 8
Function at 0x100601cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.10044264
xor al, 1
je 0x100601f3
inc ebx
lea eax, [esp + 8]
call fcn.10044274
lea eax, [esp + 8]
call fcn.10044264
xor al, 1
jne 0x100601dc
mov eax, ebx
pop ebx
ret 0x44

Function at 0x10062264
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.10044264
xor al, 1
je 0x1006229b
lea eax, [esp + 8]
call fcn.1004426c
push eax
mov eax, ebx
call fcn.1000c094
lea eax, [esp + 8]
call fcn.10044274
lea eax, [esp + 8]
call fcn.10044264
xor al, 1
jne 0x10062274
pop ebx
ret 0x44

Function at 0x10064d44
Capabilities:
Create thread
Resume thread

Disassembly:
push eax
push eax
push ebx
push esi
push edi
mov dword [0x1008c564], 1
push 0x1008c56c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor ebx, ebx
mov eax, dword [0x10092c6c]
cmp dword [eax + ebx*4], 0
je 0x10064d74
inc ebx
cmp ebx, 0x400
jb 0x10064d60
cmp ebx, 0x400
jne 0x10064d8a
push 0xb
call fcn.10068444
xor ebx, ebx
jmp 0x10064e23
push 1
push 0x2a8
call fcn.10065bdc
add esp, 8
mov esi, eax
test eax, eax
jne 0x10064daa
push 0xc
call fcn.10068444
xor ebx, ebx
jmp 0x10064e23
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x28]
or edx, 4
push ecx
push edx
push dword [esp + 0x2c]
push 0x10064e38
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test eax, eax
jne 0x10064de9
push esi
call fcn.10063694
call fcn.10068dfc
xor ebx, ebx
add esp, 4
jmp 0x10064e23
test dword [esp + 0x28], 4
mov ecx, dword [0x10092c6c]
mov dword [ecx + ebx*4], esi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0x1c], edi
jne 0x10064e21
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ebx, edi
push 0x1008c56c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x100670f8
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x10067155
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x10067155
lea ecx, [edi + 1]
push ecx
call fcn.10063c3c
add esp, 4
mov ebx, eax
test eax, eax
je 0x10067155
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x10067142
push ebx
call fcn.10063694
xor ebx, ebx
add esp, 4
jmp 0x10067155
push ebx
push esi
call fcn.1006b184
add esp, 4
push eax
call fcn.10067008
add esp, 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret