joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010ad70
Capabilities:
Get disk information

Disassembly:
mov eax, 0x122c
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x1228], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.10116880
xor eax, eax
xor edx, edx
add esp, 0xc
mov word [esp + 0x10], dx
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
test ebx, ebx
je 0x1010adc9
mov byte [ebx], al
lea edx, [esp + 0x10]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1010add1
push edi
lea edi, [esp + 0x14]
add edi, 0xfffffffe
jmp 0x1010adf0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1010adf0
mov eax, dword [0x1014aa30]
mov dword [edi], eax
xor eax, eax
jmp 0x1010ae10
movzx ecx, word [eax + str.._]
mov word [esp + eax + 0x28], cx
add eax, 2
test cx, cx
jne 0x1010ae10
lea eax, [esp + 0x14]
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1010ae30
lea edi, [esp + 0x28]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1010ae44
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
jmp 0x1010ae70
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1010ae70
mov ecx, dword [0x101545e8]
push str.fmifs.dll
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Chkdsk
push str.fmifs.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
pop edi
test esi, esi
jne 0x1010aed7
test ebx, ebx
je 0x1010aebf
push str.Could_not_located_FMIFS_entry_points.
push ebx
call fcn.1010d6a8
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1228]
xor ecx, esp
call fcn.1010d699
add esp, 0x122c
ret
push 0x800
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x800
lea eax, [esp + 0xa44]
push eax
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1010af40
test ebx, ebx
je 0x1010af28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_query_volume
push ebx
call fcn.1010d6a8
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1228]
xor ecx, esp
call fcn.1010d699
add esp, 0x122c
ret
push 1
push 0x1010ac90
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0x1010aca0
push 0
push 0
push 0
push 0
push 0
push 1
lea edx, [esp + 0x248]
push edx
lea eax, [esp + 0x30]
push eax
call esi
mov ecx, dword [esp + 0x122c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1010d699
add esp, 0x122c
ret
Function at 0x1010b350
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016f048
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1010b49e
mov byte [ebx], 0
mov dword [ebp - 0x20], 0x104
push str.CSUUID
lea eax, [ebp - 0x20]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100315c0
cmp byte [ebx], 0
jne 0x1010b49e
push 0
push 0
push 0x1010b210
call fcn.1010d93f
add esp, 0xc
cmp eax, 0xffffffff
je 0x1010b423
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x24], eax
call esi
sub eax, dword [ebp - 0x24]
cmp eax, 0x1770
jae 0x1010b423
mov dword [ebp - 0x20], 0x104
push str.CSUUID
lea eax, [ebp - 0x20]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100315c0
cmp byte [ebx], 0
jne 0x1010b49e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1010b3e4
push str.FFFFEFEF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x1010b444
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push str.None
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x1010b465
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0
je 0x1010b475
mov esi, ebx
call fcn.1010b180
test eax, eax
je 0x1010b49e
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1010b49e
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
Function at 0x1010d699
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1017455c]
jne 0x1010d6a3
repz ret
jmp fcn.10116a01

Function at 0x1011337b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x101133ac
call fcn.101124e0
mov dword [eax], esi
call fcn.101124cd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1010e35b
add esp, 0x14
push 0x16
pop eax
jmp 0x10113401
test dword [ebp + 0xc], 0xfffffff9
jne 0x10113388
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101133d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.101124f3
pop ecx
call fcn.101124cd
mov eax, dword [eax]
jmp 0x10113401
test al, 0x10
jne 0x101133ff
test al, 1
je 0x101133ff
test byte [ebp + 0xc], 2
je 0x101133ff
call fcn.101124e0
mov dword [eax], 5
call fcn.101124cd
mov dword [eax], 0xd
jmp 0x101133d0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10124dc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10117b76
and dword [ebp - 4], 0
cmp dword [0x1018ee80], 0
mov ebx, eax
jne 0x10124e71
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10124f22
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10124f22
push eax
call fcn.10117b04
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1018ee80], eax
call esi
push eax
call fcn.10117b04
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1018ee84], eax
call esi
push eax
call fcn.10117b04
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1018ee88], eax
call esi
push eax
call fcn.10117b04
pop ecx
mov dword [0x1018ee90], eax
test eax, eax
je 0x10124e71
push 0x1013aa2c
push edi
call esi
push eax
call fcn.10117b04
pop ecx
mov dword [0x1018ee8c], eax
mov eax, dword [0x1018ee8c]
cmp eax, ebx
je 0x10124ec9
cmp dword [0x1018ee90], ebx
je 0x10124ec9
push eax
call fcn.10117b7f
push dword [0x1018ee90]
mov esi, eax
call fcn.10117b7f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10124ec9
test edi, edi
je 0x10124ec9
call esi
test eax, eax
je 0x10124ec0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10124ec0
test byte [ebp - 0xc], 1
jne 0x10124ec9
or dword [ebp + 0x10], 0x200000
jmp 0x10124f02
mov eax, dword [0x1018ee84]
cmp eax, ebx
je 0x10124f02
push eax
call fcn.10117b7f
pop ecx
test eax, eax
je 0x10124f02
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10124f02
mov eax, dword [0x1018ee88]
cmp eax, ebx
je 0x10124f02
push eax
call fcn.10117b7f
pop ecx
test eax, eax
je 0x10124f02
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1018ee80]
call fcn.10117b7f
pop ecx
test eax, eax
je 0x10124f22
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10124f24
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409250
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
dec ebx
mov eax, dword [esi]
adc byte [edx + 0x57], al
mov edi, ebx
pop edx
mov ch, 0xff
xor eax, eax
mov esi, dword [ebp + 8]
repne scasb al, byte es:[edi]
dec esi
rol dword [ecx + 0xaef9], 1
add byte [ecx + 0x6b76104d], cl
mov eax, 0xfa800153
cmp dh, byte [ebp - 0x52]
mov ch, dh
add bh, byte [edi + ebp]
je 0x409285
cmp al, 0xaa
jne 0x40929f
push 0xac4100e0
push esi
call dword [0x45f177]
push esp
invalid
mov al, byte [ebx]
cmp al, 0x75
je 0x4092a9
out 0xac, eax
cmp eax, 0x2ffa806d
cmp dl, 0x2f
jb 0x4092b3
sub byte [edi - 0x7fda8aa4], 0x7b
invalid
cmp byte [ebx + 0xf], 0x3f
ja 0x4092dd
lodsb al, byte [esi]
jmp 0x10cfb7a
lea eax, [ebx + 0xc]
lea ecx, [ebp + 0x10]
push eax
push esi
outsb dx, byte [esi]
push ebx
call 0x40a9a0
test eax, eax
jnp 0x409301
cmp eax, 0x961178
jne 0x409351
js 0x409357
mov eax, 0x1700000d
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
jp 0x40931c
aas
or bl, byte [edi + 0x5e]
mov eax, 0x26
pop ebx
pop ebp
ret
das
add byte [ebp + 5], dh
mov word [esi], 0x52
mov ax, word [esi + 2]
cmp dword [ecx - 0x3f9499fe], 0x75
jmp 0x13a05368
pop ebx
add byte [eax], al
adc ah, byte [edi]
or al, byte [eax + ebx*8 - 0x17a97c70]
outsd dx, dword [esi]
test al, bl
nop
adc dword [esi - 0x18], 0x6f
pop ds
add byte [eax], al
mov eax, dword [ebx]
add dword [esi + 0x18], eax
sahf
add byte [eax], al
add byte [esi], al
adc dword [edx + 0x3d], ebx
add byte [eax], al
int3

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10002360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ab05
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100d0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x1d0]
test ecx, ecx
je 0x1000241b
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push 0x100bb744
push ecx
call dword [eax]
test eax, eax
js 0x1000241b
mov dword [ebp + 8], 0
mov byte [ebp - 4], 1
lea edx, [ebp + 8]
mov eax, dword [ebp - 0x10]
push edx
push 0x100bb9c8
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
js 0x1000240a
xorps xmm0, xmm0
mov eax, 3
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x20], ax
xor eax, eax
test edi, edi
lea edi, [ebp - 0x20]
push edi
setne al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ecx, dword [esi + 0x10]
push dword [ecx + 0x30]
push eax
call edx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000241b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [esi + 0xc]
test edi, edi
je 0x10002483
test esi, esi
je 0x1000248e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000248e
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xfffffffffffffffc
push dword [esi + 4]
push 0x8027
call dword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x100d5554], 0
mov eax, dword [esi + 0x2b4]
mov eax, dword [eax + 4]
mov byte [eax + 0x4e9], 1
je 0x1000248e
push 0x1330684
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x100d5554], 0
jmp 0x1000248e
test esi, esi
je 0x1000248e
mov ecx, esi
call fcn.10028b60
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100024a2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10003430
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.10005790
Function at 0x100044f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 8], 0
lea edx, [ebp - 0x14]
push esi
push edi
xorps xmm0, xmm0
mov edi, ecx
movups xmmword [ebp - 0x14], xmm0
push edx
je 0x100045b5
push dword [edi + 0x30]
mov eax, 3
lea esi, [edi + 0x218]
mov word [ebp - 0x14], ax
mov eax, dword [edi + 0x1f0]
mov ecx, eax
shr ecx, 0x13
movzx eax, al
and ecx, 2
and eax, 1
or ecx, eax
mov eax, dword [edi + 0x164]
or ecx, 0xfc000000
mov dword [ebp - 0xc], ecx
mov dword [esi], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [0x100d55b4], 7
lea ecx, [ebp + 8]
push ecx
push 0x20106
mov eax, 0x100d55a0
cmova eax, dword [0x100d55a0]
push 0
push eax
push reloc.d2d1.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004607
cmp dword [0x100d556c], 7
mov eax, 0x100d5558
push 4
cmova eax, dword [0x100d5558]
push esi
push 4
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x164]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
js 0x10004607
cmp word [ebp - 0x14], 3
jne 0x10004607
mov esi, dword [edi + 0x1f0]
mov eax, esi
and eax, 0xfffffffe
or esi, 1
test byte [ebp - 0xc], 1
cmove esi, eax
test byte [ebp - 0xc], 2
je 0x100045fb
or esi, 0x100000
mov dword [edi + 0x1f0], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
and esi, 0xffefffff
mov dword [edi + 0x1f0], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10005790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
lea esi, [ecx + 0x1dc]
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
test byte [ecx + 0x1f2], 1
jne 0x10005807
cmp dword [0x100d55b4], 7
lea ecx, [ebp + 8]
push ecx
push 0x20106
mov eax, 0x100d55a0
cmova eax, dword [0x100d55a0]
push 0
push eax
push reloc.d2d1.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005807
cmp dword [0x100d5584], 7
mov eax, 0x100d5570
push 0x10
cmova eax, dword [0x100d5570]
push esi
push 3
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 4
Function at 0x10006b40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.10003d00
test eax, eax
je 0x10006d39
mov eax, dword [ebx + 0x1f0]
mov edi, dword [ebp + 8]
and eax, 0xffffefff
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebx + 0x1f0], eax
shr eax, 0xf
test al, 1
je 0x10006b97
cmp edi, 0x14
jne 0x10006b97
push edi
call esi
test ax, ax
jle 0x10006b97
and dword [ebx + 0x1f0], 0xffff7fff
push edi
call fcn.100056f0
cmp dword [ebx + 0x170], 0
je 0x10006bb7
cmp edi, 0x14
jne 0x10006bb7
push edi
call esi
test ax, ax
jns 0x10006bb7
or dword [ebx + 0x1f0], 0x8000
mov ecx, ebx
call fcn.10018570
lea esi, [ebx + 0x44]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
xor eax, eax
mov dword [esp + 0xc], edx
cmp byte [esi + 0x10], al
jge 0x10006be0
mov edx, 0x10000
mov dword [esp + 0xc], edx
mov eax, edx
test byte [esi + 0x14], 1
je 0x10006bf4
mov edx, eax
or edx, 0x20000
mov dword [esp + 0xc], edx
mov eax, edx
cmp byte [esi + 0x11], 0
jge 0x10006c08
mov edx, eax
or edx, 0x40000
mov dword [esp + 0xc], edx
mov eax, edx
cmp byte [esi + 0x12], 0
jge 0x10006c1c
mov edx, eax
or edx, 0x80000
mov dword [esp + 0xc], edx
mov eax, edx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jns 0x10006c2f
mov edx, eax
or edx, 0x40000000
mov dword [esp + 0xc], edx
cmp edi, 0x14
jne 0x10006c52
test ecx, ecx
js 0x10006c52
mov ecx, edx
movzx edx, dx
xor ecx, 0x20000
and ecx, 0xffff0000
or edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
push ecx
mov ecx, edi
call fcn.100066a0
add esp, 4
test eax, eax
je 0x10006c71
mov edi, dword [ebp + 0xc]
and edx, 0xffff0000
movzx esi, ax
or esi, edx
jmp 0x10006cbf
push 0
push 0
push 8
push 0x100d572c
mov ecx, 0x40
mov edi, 0x100d5740
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
push 0x100d5740
push edi
push dword [ebp + 8]
mov word [0x100d5751], 0
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x10006d30
mov esi, dword [esp + 0xc]
movzx eax, word [0x100d572c]
and esi, 0xffff0000
or esi, eax
mov ecx, dword [ebx + 0x18c]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], esi
call fcn.1001afc0
cmp byte [ebp + 0x14], 0
mov ecx, dword [ebp + 0x10]
movzx eax, al
mov dword [ecx], eax
jne 0x10006d39
test eax, eax
jne 0x10006d39
mov eax, dword [ebx + 0x1f0]
shr eax, 2
test al, 1
jne 0x10006d39
test edi, edi
js 0x10006d39
movzx edi, si
push edi
call fcn.1006c660
add esp, 4
test eax, eax
je 0x10006d39
test esi, 0xc0000
jne 0x10006d39
mov eax, dword [ebp + 0x10]
or dword [ebx + 0x1f0], 0x20000
mov dword [ebx + 0x20c], edi
mov dword [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov esi, 0x100bb978
mov edi, 0xc
mov dword [ebx], 0
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1000719d
add edx, 4
add esi, 4
sub edi, 4
jae 0x10007150
mov esi, dword [ebp + 8]
pop edi
mov edx, dword [esi + 0x1e0]
mov ecx, edx
mov eax, edx
shr ecx, 0x12
or edx, 0x200000
and eax, 0xffdfffff
test cl, 1
cmove edx, eax
xor edx, 0x40000
xor eax, eax
mov dword [esi + 0x1e0], edx
pop esi
mov dword [ebx], 1
pop ebx
pop ebp
ret 0x10
mov edx, ecx
mov esi, 0x100bb998
mov edi, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10007284
add edx, 4
add esi, 4
sub edi, 4
jae 0x100071b0
mov esi, dword [ebp + 8]
xor dword [esi + 0x1e0], 0x10000
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x14]
mov dl, byte [eax + 0x1f2]
mov eax, dword [ecx + 0xc]
and dl, 1
mov byte [eax + 0x4e8], dl
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x100071fa
mov byte [eax + 0x2b0], dl
test byte [esi + 0x1e2], 1
jne 0x100072be
cmp dword [0x100d55b4], 7
lea ecx, [ebp + 8]
push ecx
push 0x20119
mov eax, 0x100d55a0
cmova eax, dword [0x100d55a0]
push 0
push eax
push reloc.d2d1.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100072be
cmp dword [0x100d5584], 7
lea eax, [ebp + 0x14]
push eax
lea eax, [esi + 0x1cc]
mov dword [ebp + 0x14], 0x10
push eax
push 0
mov ecx, 0x100d5570
cmova ecx, dword [0x100d5570]
push 0
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov dword [ebx], 1
xor eax, eax
pop ebx
pop ebp
ret 0x10
mov edx, 0x100bb968
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100072c4
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10007290
mov ecx, dword [ebp + 8]
xor dword [ecx + 0x1e0], 1
cmp dword [ecx + 0x154], 0
je 0x100072be
push 1
add ecx, 0xfffffff0
call fcn.100044f0
mov dword [ebx], 1
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x1000b020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100d0040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
mov ebx, ecx
lea eax, [ebp - 0x238]
push 0
mov dword [ebp - 0x240], ebx
push eax
mov dword [ebp - 0x240], ebx
call fcn.10062d50
movups xmm0, xmmword [str.SoftwareRimeWeasel]
mov ax, word [0x100bb868]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 8], ax
movups xmm0, xmmword [0x100bb850]
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x248], 0
movq xmm0, qword [0x100bb860]
movq qword [ebp - 0x10], xmm0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
mov dword [ebp - 0x23c], eax
call edi
push eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x1000b0d6
lea ecx, [ebp - 0x248]
push ecx
call eax
lea eax, [ebp - 0x244]
push eax
push 0x101
push 0
lea eax, [ebp - 0x30]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b18d
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], 0x208
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
push str.WeaselRoot
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x244]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000b14d
push dword [ebp - 0x248]
call esi
test edi, edi
jne 0x1000b18d
cmp dword [ebp - 0x23c], 1
jne 0x1000b18d
cmp word [ebp - 0x238], di
je 0x1000b18d
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], edi
lea edx, [ecx + 2]
mov dword [ebx + 0x14], edi
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b180
jmp 0x1000b1bb
xorps xmm0, xmm0
lea ecx, [ebp - 0x238]
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
lea edx, [ecx + 2]
mov dword [ebx + 0x14], 0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b1b0
sub ecx, edx
lea eax, [ebp - 0x238]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10003260
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cfa2
mov esp, ebp
pop ebp
ret
Function at 0x10016470
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x100d0040]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], 0x100
lea ecx, [esp + 0xc]
mov eax, edx
push ecx
push eax
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100164c5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.1005cfa2
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
xor esi, esi
lea eax, [esp + 0x14]
push esi
push esi
push esi
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x10016530
nop word [eax + eax]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
mov byte [esp + 0x11f], 0
call fcn.10016470
mov esi, eax
test esi, esi
jne 0x10016530
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x100164f0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1001654b
push dword [esp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov ecx, dword [esp + 0x124]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005cfa2
mov esp, ebp
pop ebp
ret