joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10349d7
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push 0x1009124
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1034a3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1034a08
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034b88
test byte [eax + 0x1c], 2
je 0x1034b88
push 0x10090b0
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
jmp 0x1034b88
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x1009104
push eax
call esi
push 0x10090e4
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
je 0x1034b54
cmp eax, ebx
je 0x1034b54
push 0x44
pop edi
push edi
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x64], edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [ebp - 4]
test eax, eax
je 0x1034b29
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x10
push 1
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov esi, 0x10090b0
jne 0x1034af8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1034ad1
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034b08
test byte [eax + 0x1c], 2
je 0x1034b08
push dword [ebp + 8]
push esi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
jmp 0x1034b08
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0xc]
call dword [ebp - 0x10]
test eax, eax
jne 0x1034b7d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034b4d
test byte [eax + 0x1c], 2
je 0x1034b4d
push esi
push 0x10
jmp 0x1034b42
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034b4d
test byte [eax + 0x1c], 2
je 0x1034b4d
push 0x10090b0
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
mov ebx, 0x80004005
jmp 0x1034b7d
mov ebx, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034b7d
test byte [eax + 0x1c], 2
je 0x1034b7d
push 0x10090b0
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1034b94
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
call fcn.0103490e
test eax, eax
je 0x1034c1d
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, edi
jne 0x1034be8
mov eax, dword [section..data]
cmp eax, section..data
je 0x1034c1c
test byte [eax + 0x1c], 2
je 0x1034c1c
push 0x10090b0
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141a1
jmp 0x1034c1c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1009140
mov word [ebp - 0x20c], di
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010349d7
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.010356d1
leave
ret
Function at 0x10356aa
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1050328
call fcn.010360f4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1055568
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1035458
cmp eax, esi
jne 0x103544b
xor esi, esi
inc esi
mov ebx, esi
jmp 0x103545b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1035432
xor esi, esi
inc esi
mov eax, dword [0x1055564]
cmp eax, esi
jne 0x103546e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x103549d
mov eax, dword [0x1055564]
test eax, eax
jne 0x1035497
mov dword [0x1055564], esi
push 0x100163c
push 0x1001630
call fcn.01035397
pop ecx
pop ecx
test eax, eax
je 0x103549d
jmp 0x10355c5
mov dword [0x1054624], esi
mov eax, dword [0x1055564]
cmp eax, esi
jne 0x10354c1
push 0x100162c
push 0x1001618
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1055564], 2
test ebx, ebx
jne 0x10354cd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1055578], 0
je 0x10354f1
push 0x1055578
call fcn.0103606b
pop ecx
test eax, eax
je 0x10354f1
push 0
push 2
push 0
call dword [0x1055578]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x103554d
test al, al
je 0x103550b
cmp dword [ebp - 0x1c], 0
jne 0x103554d
mov al, byte [esi]
test al, al
je 0x103551b
cmp al, 0x20
ja 0x103551b
inc esi
mov dword [ebp - 0x20], esi
jmp 0x103550b
test byte [ebp - 0x3c], 1
je 0x1035527
movzx eax, word [ebp - 0x38]
jmp 0x103552a
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1054620], eax
cmp dword [0x1054614], 0
jne 0x10355a1
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x103555c
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x103556f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10354f8
cmp dword [0x1054624], 0
jne 0x10355b0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1054620]
jmp 0x10355d1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01036139
ret
call fcn.01036236
jmp 0x10353f8

Function at 0x1035fe0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1035ff3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1035fef
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x1036020
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x103605f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1036055
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1036061
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1036045
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1037882
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x10378b1
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.010358e2
add esp, 0x14
jmp 0x103798d
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x103798d
test al, 0x40
jne 0x103798d
test al, 2
je 0x10378d3
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x103798d
or eax, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
je 0x1037893
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 4], eax
je 0x103797d
cmp eax, 0xffffffff
je 0x103797d
test byte [esi + 0xc], 0x82
jne 0x1037953
push esi
call edi
cmp eax, 0xffffffff
pop ecx
je 0x103793e
push esi
call edi
cmp eax, 0xfffffffe
pop ecx
je 0x103793e
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x1037943
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x1037953
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x1037970
mov eax, dword [esi + 0xc]
test al, 8
je 0x1037970
test ax, 0x400
jne 0x1037970
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x1037990
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1039023
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x1039052
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.010358e2
add esp, 0x14
jmp 0x103913a
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x103913a
test al, 0x40
jne 0x103913a
test al, 2
je 0x1039074
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x103913a
or eax, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
je 0x1039034
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 4], eax
je 0x103912a
cmp eax, 1
je 0x103912a
cmp eax, 0xffffffff
je 0x103912a
test byte [esi + 0xc], 0x82
jne 0x10390fd
push esi
call edi
cmp eax, 0xffffffff
pop ecx
je 0x10390e8
push esi
call edi
cmp eax, 0xfffffffe
pop ecx
je 0x10390e8
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x10390ed
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x10390fd
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x103911a
mov eax, dword [esi + 0xc]
test al, 8
je 0x103911a
test ax, 0x400
jne 0x103911a
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x103913f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1039155
Capabilities:
Check os version
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x174]
mov esi, 0x100
push eax
mov dword [ebp - 0x310], esi
call fcn.0103be40
push esi
lea eax, [ebp - 0x118]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x103928d
push dword [ebp - 0x310]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0103bf00
lea eax, [ebp - 0x324]
push eax
call fcn.0104d421
test eax, eax
jne 0x10391f6
push 0x14
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0103bf00
push 0x25
push 0x1009644
lea eax, [ebp - 0x174]
push eax
call fcn.0103bf00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0103c010
lea eax, [ebp - 0x174]
push eax
call fcn.0103be40
push dword [ebp + 0x10]
lea eax, [ebp - 0x174]
push ebx
push eax
call fcn.0103bf00
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0103bf00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0103c010
dec esi
jne 0x1039219
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x30c]
push eax
call fcn.0103bd3d
push 0x40
pop ecx
lea esi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 0xc
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x208], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10391d1
cmp dword [ebp - 0x1f8], 2
jne 0x10391d1
cmp dword [ebp - 0x204], 5
jb 0x10391d1
xor eax, eax
jmp 0x103927c
Function at 0x10394fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [eax]
mov dword [ebp - 0x218], eax
push ebx
push 0x1000000
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
mov dword [ebp - 0x21c], eax
jne 0x103959b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103955d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10396db
test byte [eax + 0x1c], 2
je 0x10396db
push edi
push 0x1009b70
push 0x1009b60
push 0x10099ac
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103935d
jmp 0x10396db
push 0x5c
push ebx
call sub.msvcrt.dll_wcsrchr
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x10396d6
cmp word [edi], 0x5c
jne 0x10396d6
cmp edi, ebx
jbe 0x10396d6
lea eax, [ebp - 0x210]
push eax
push 0x20019
inc edi
push 0
inc edi
mov esi, edi
push 0x1009ae0
sub esi, ebx
push reloc.OLEAUT32.dll_SysReAllocString
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x103962e
mov eax, dword [section..data]
cmp eax, section..data
je 0x1039617
test byte [eax + 0x1c], 2
je 0x1039617
push ebx
push 0x1009a98
push 0x10099ac
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
test ebx, ebx
jle 0x1039627
and ebx, 0xffff
or ebx, 0x80070000
mov edi, ebx
jmp 0x10396db
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x100769c
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x1039678
mov eax, dword [section..data]
cmp eax, section..data
je 0x1039617
test byte [eax + 0x1c], 2
je 0x1039617
push ebx
push 0x1009a48
push 0x10099ac
push 0xd
jmp 0x103960c
mov ebx, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebx]
sub eax, dword [ebp - 0x21c]
push eax
push edi
call fcn.010183fd
mov edi, eax
test edi, edi
jge 0x10396c6
mov eax, dword [section..data]
cmp eax, section..data
je 0x10396db
test byte [eax + 0x1c], 2
je 0x10396db
push edi
push 0x1009a2c
push 0x10099ac
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e76
jmp 0x10396db
mov eax, dword [ebp - 0x214]
shr eax, 1
lea eax, [eax + esi + 1]
mov dword [ebx], eax
jmp 0x10396db
mov edi, 0x8007007a
cmp dword [ebp - 0x210], 0
je 0x10396f0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010356d1
leave
ret 8
Function at 0x1039ea1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
jne 0x1039edc
mov eax, dword [section..data]
cmp eax, section..data
je 0x1039f35
test byte [eax + 0x1c], 2
je 0x1039f35
push 0x1009a14
push 0x1009c48
push 0x5b
jmp 0x1039f2a
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x1039f03
mov eax, dword [section..data]
cmp eax, section..data
je 0x1039f35
test byte [eax + 0x1c], 2
je 0x1039f35
push 0x1009da0
push 0x1009c48
push 0x5c
jmp 0x1039f2a
cmp dword [ebp + 8], edi
mov dword [ecx], edi
mov dword [eax], edi
jne 0x1039f3e
mov eax, dword [section..data]
cmp eax, section..data
je 0x1039f35
test byte [eax + 0x1c], 2
je 0x1039f35
push 0x1009d90
push 0x1009c48
push 0x5d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
mov dword [ebp - 4], 0x80070057
jmp 0x1039fb7
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x1009d7c
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call esi
cmp eax, edi
je 0x1039f75
jle 0x1039f70
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1039fb5
cmp dword [ebp - 0xc], edi
je 0x1039fb5
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x1009d50
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1039fac
cmp dword [ebp - 0xc], edi
jne 0x1039fb5
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x10
Function at 0x1039fc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x1039ffb
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a061
test byte [eax + 0x1c], 2
je 0x103a061
push 0x1009e04
push 0x1009c48
push 0x5e
jmp 0x103a056
mov edx, dword [ebp + 0x14]
cmp edx, edi
jne 0x103a022
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a061
test byte [eax + 0x1c], 2
je 0x103a061
push 0x1009da0
push 0x1009c48
push 0x5f
jmp 0x103a056
mov ecx, dword [ebp + 0x10]
cmp ecx, 2
jbe 0x103a0fd
cmp dword [ebp + 8], edi
mov word [eax], di
mov dword [edx], edi
jne 0x103a06b
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a061
test byte [eax + 0x1c], 2
je 0x103a061
push 0x1009d90
push 0x1009c48
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
mov edi, 0x80070057
jmp 0x103a0fd
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push 0x1009df0
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x103a09d
jle 0x103a099
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x103a0fc
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], ebx
jne 0x103a0d6
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x1009dc0
push dword [ebp + 8]
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x103a0cf
cmp dword [ebp - 8], edi
jne 0x103a0fb
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x103a0fb
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a0fb
test byte [eax + 0x1c], 2
je 0x103a0fb
push edi
push 0x1009c48
push 0x61
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040e4a
pop ebx
pop esi
mov eax, edi
pop edi
leave
ret 0x14
Function at 0x103a109
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x103a149
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a1cb
test byte [eax + 0x1c], 2
je 0x103a1cb
push 0x1009e84
push 0x1009c48
push 0x62
jmp 0x103a1c0
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x103a170
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a1cb
test byte [eax + 0x1c], 2
je 0x103a1cb
push 0x1009da0
push 0x1009c48
push 0x63
jmp 0x103a1c0
cmp dword [ebp + 0x14], ebx
jne 0x103a195
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a1cb
test byte [eax + 0x1c], 2
je 0x103a1cb
push 0x1009e6c
push 0x1009c48
push 0x64
jmp 0x103a1c0
cmp dword [ebp + 8], ebx
mov dword [ecx], 6
mov dword [eax], ebx
jne 0x103a1d2
mov eax, dword [section..data]
cmp eax, section..data
je 0x103a1cb
test byte [eax + 0x1c], 2
je 0x103a1cb
push 0x1009d90
push 0x1009c48
push 0x65
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
mov eax, 0x80070057
jmp 0x103a244
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1009e54
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp eax, ebx
je 0x103a206
jle 0x103a242
and eax, 0xffff
or eax, 0x80070000
jmp 0x103a242
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1009e20
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x103a237
cmp dword [ebp - 8], ebx
jne 0x103a240
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x103bbf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x103bd2b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x103bd00
test eax, eax
jne 0x103bd00
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x103bc40
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x103bd2b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x103bd00
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x103be40
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1054a6c], 0
push ebx
jne 0x103bebd
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x103beb1
cmp dword [ebp - 8], 0x660
jae 0x103beb1
xor eax, eax
mov eax, dword [eax*4 + 0x1054048]
mov dword [0x1054a6c], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4