joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7268
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4b7368
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004b6960
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x4b732e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a89c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b76d0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a780
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b7744
jmp 0x4b7340
xor edx, edx
mov eax, ebx
call fcn.004b76d0
xor edx, edx
mov eax, ebx
call fcn.004b7744
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b736f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb4
ret

Function at 0x4bd64c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x148]
mov edx, ebx
mov eax, edi
call fcn.004bd870
mov esi, eax
mov dword [edi + 0x148], esi
and esi, 0xff
add dword [edi + 0x14c], esi
imul esi, dword [edi + 0x14c], 0x8088405
inc esi
mov dword [edi + 0x14c], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x150]
mov eax, edi
call fcn.004bd870
mov dword [edi + 0x150], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4bd6c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4bd6e5
inc esi
mov eax, edi
call fcn.004bd6a4
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004bd64c
inc ebx
dec esi
jne 0x4bd6cf
pop edi
pop esi
pop ebx
ret
Function at 0x4bd774
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4bd7e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004bd6ec
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004bd6a4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004bd64c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4bd7b4
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd7f0
lea eax, [ebp - 4]
call fcn.00404c90
ret
Function at 0x4be288
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4be458
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4be414
mov eax, dword [ebp - 4]
call fcn.004bfb84
cmp ebx, eax
jge 0x4be414
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
mov edx, ebx
call fcn.004b6094
mov edx, dword [0x4b6c70]
call fcn.00403f2c
mov esi, eax
mov eax, esi
call fcn.004b7664
test al, al
je 0x4be40a
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x4be3fe
xor eax, eax
push ebp
push 0x4be3f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004be9c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
call fcn.00421944
mov dword [ebp - 0x10], eax
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0x22]
movzx eax, word [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0x14]
movzx esi, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004052dc
mov eax, dword [ebp - 8]
call fcn.004051a8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004be5e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be442
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4be3f6
mov eax, dword [ebp - 4]
call fcn.004bea4c
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040ac6c
jmp 0x4be442
mov eax, dword [ebp - 8]
call fcn.00404c90
jmp 0x4be442
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.0040a1a4
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x41b68c]
call fcn.0040e410
call fcn.0040460c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be45f
lea eax, [ebp - 0x4c]
call fcn.00404c90
ret
Function at 0x4c3df0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c3e1e
mov eax, ebx
call fcn.004c48a4
cmp dword [ebx + 0x40], 0
je 0x4c3e17
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c3e8f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c3e81
cmp dword [ebx + 8], 0
je 0x4c3e40
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c3e52
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c3e81
cmp dword [ebx + 8], 0
je 0x4c3e33
cmp eax, 3
je 0x4c3e65
dec eax
jne 0x4c3e33
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c3e33
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c3e33
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c3ead
cmp dword [ebx + 0x14], 0xcc
je 0x4c3ead
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c3eb8
pop ebx
ret

Function at 0x4d5bd8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004d5b94
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d5c4c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x54702c], eax
mov ebx, 0x4d5b20
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4d5c4c
xor eax, eax
push ebp
push 0x4d5c45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5c4c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d5c54
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004d5b94
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d5cbf
mov ebx, dword [0x54702c]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4d5cbf
xor eax, eax
push ebp
push 0x4d5cb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5cbf
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d6788
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
push ebx
push 0x4d67a8
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
pop ebx
ret
Function at 0x4ec61c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ec686
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.0040ac6c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.004ec5d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec68d
lea eax, [ebp - 0x104]
call fcn.00404c90
ret

Function at 0x4ec694
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ec728
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c90
mov eax, 0xc8
call fcn.0040ac80
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ec70b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0xc8
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ac6c
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.004ec5d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec712
mov eax, dword [ebp - 4]
call fcn.0040accc
ret

Function at 0x4ed9c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov byte [0x54710c], 0
push edi
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5437a8]
mov eax, dword [eax]
call fcn.0046acec
cmp byte [0x54710c], 0
jne 0x4ed9fb
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x4ed9d5
pop edi
pop esi
pop ebx
ret

Function at 0x4edfa8
Capabilities:
Stop service

Disassembly:
push ebx
push esi
mov esi, eax
lea eax, [esi + 0x40]
push eax
push 1
mov eax, dword [esi + 0x34]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4edfd3
mov edx, 0x4edfec
mov eax, esi
call fcn.004edd8c
jmp 0x4edfdf
mov edx, 0x4ee004
mov eax, esi
call fcn.004edd8c
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4ee188
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, eax
mov dword [esp], 0x64
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040ac6c
add esp, 0x68
pop ebx
ret
Function at 0x4ee4a0
Capabilities:
Enumerate services

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4ee4c1
call fcn.004028a0
xor eax, eax
mov dword [esi + 0x70], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 0
mov eax, dword [esi + 0x70]
push eax
push 3
mov eax, dword [esi + 0x34]
push eax
call sub.advapi32.dll_EnumDependentServicesA
mov eax, dword [esp]
call fcn.00409608
mov ebx, eax
mov dword [esi + 0x70], ebx
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ebx
push 3
mov eax, dword [esi + 0x34]
push eax
call sub.advapi32.dll_EnumDependentServicesA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x4ee53e
mov eax, dword [esp + 4]
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x4eda78]
call fcn.00406360
add esp, 4
mov ecx, dword [esp + 4]
shl ecx, 2
lea ecx, [ecx + ecx*8]
mov edx, dword [edi]
mov eax, dword [esi + 0x70]
call fcn.00402b9c
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4fe398
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fe410
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 8]
mov eax, dword [esi + 0x30]
call fcn.004099b0
mov eax, dword [ebp - 8]
mov esi, dword [0x542ed8]
mov esi, dword [esi]
mov edx, dword [ebx]
call esi
test eax, eax
je 0x4fe3f1
mov edx, eax
dec edx
mov eax, ebx
call fcn.004052dc
jmp 0x4fe3fa
mov eax, ebx
xor edx, edx
call fcn.004052dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe417
lea eax, [ebp - 8]
call fcn.00404c90
ret

Function at 0x506d98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x506df2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00506d8c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00503440
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0050305c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506df9
lea eax, [ebp - 4]
call fcn.00404c90
ret
Function at 0x51aff4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51b0be
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x487924]
call fcn.00406360
add esp, 4
mov eax, edi
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, edi
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov eax, edi
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
mov eax, edi
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
mov eax, esi
call fcn.004061a4
mov edi, eax
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x487924]
call fcn.00406360
add esp, 4
mov edx, edi
dec edx
test edx, edx
jl 0x51b0a2
inc edx
xor eax, eax
mov ecx, eax
and ecx, 0x80000003
jns 0x51b090
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 4]
mov cl, byte [edi + ecx]
xor cl, byte [esi + eax]
mov edi, dword [ebx]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x51b081
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b0c5
lea eax, [ebp - 4]
mov edx, dword [0x487924]
call fcn.00406480
ret
Function at 0x536990
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor edx, edx
push ebp
push 0x536a33
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x1c]
push eax
push 0x536a40
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x5369f5
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
pop dword fs:[0]
add esp, 8
push 0x536a3a
cmp dword [ebp - 8], 0xff
jae 0x536a12
mov ebx, dword [ebp - 8]
jmp 0x536a24
cmp byte [ebp - 1], 0
je 0x536a1f
mov ebx, 2
jmp 0x536a24
mov ebx, 8
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
ret
Function at 0x100010f0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push str.SOFTWARERISINGlockie
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10001143
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10001138
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10001150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push str.SOFTWARERISINGlockie
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100011ae
lea ecx, [esp + 8]
push ecx
push edi
lea edx, [esp + 0x14]
push edx
mov eax, 4
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000119f
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100011bd
push ebx
call fcn.100010f0
add esp, 4
mov dword [edi], 0
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x10001270
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10027070]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x430]
push edi
lea ecx, [esp + 4]
push ecx
push 0xf003f
xor edi, edi
push edi
push eax
push SysReAllocString
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100012da
mov eax, dword [esp + 4]
push edi
push edi
push edi
push edi
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100012f2
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.100090c2
add esp, 0x42c
ret
mov dword [esp + 8], edi
cmp dword [esp + 0xc], edi
ja 0x1000131f
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.100090c2
add esp, 0x42c
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ebp
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x23a]
push ecx
mov word [esp + 0x23c], ax
call fcn.10010490
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x244]
push eax
push edi
push ecx
mov dword [esp + 0x40], 0x104
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], ebp
call ebx
test eax, eax
jne 0x10001434
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.10010490
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x240]
push edx
call fcn.100011d0
add esp, 0x14
test eax, eax
jbe 0x10001434
cmp dword [esp + 0x14], 0
je 0x10001434
push str.ENABLE
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
je 0x10001465
push str.start
lea ecx, [esp + 0x2c]
push ecx
call esi
test eax, eax
je 0x10001476
push str.DOLOCK
lea edx, [esp + 0x2c]
push edx
call esi
test eax, eax
je 0x10001487
push str.setopen
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
je 0x10001465
push str.almp
lea ecx, [esp + 0x2c]
push ecx
call esi
test eax, eax
je 0x10001476
push str.upzi
lea edx, [esp + 0x2c]
push edx
call esi
test eax, eax
je 0x10001487
inc edi
cmp edi, dword [esp + 0x18]
jb 0x10001333
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x438]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.100090c2
add esp, 0x42c
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
jmp 0x1000144c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
jmp 0x1000144c
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
jmp 0x1000144c
Function at 0x10001c30
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x10001c5a
pop edi
pop esi
pop ecx
ret
cmp esi, edi
je 0x10001cd8
cmp eax, 2
jne 0x10001cd8
mov eax, dword [esi + 4]
push str.hao.rising.cn
push eax
call fcn.100094a3
add esp, 8
test eax, eax
jne 0x10001ccc
mov eax, dword [esi + 4]
push 0x10024604
push eax
call fcn.100094a3
add esp, 8
test eax, eax
jne 0x10001ccc
mov eax, dword [esi + 4]
push str.daohang.qq.com
push eax
call fcn.100094a3
add esp, 8
test eax, eax
jne 0x10001ccc
mov eax, dword [esi + 4]
push str.www.hao123.com
push eax
call fcn.100094a3
add esp, 8
test eax, eax
jne 0x10001ccc
mov eax, dword [esi + 4]
push str.hao.duba.com
push eax
call fcn.100094a3
add esp, 8
test eax, eax
je 0x10001cd1
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10001ce0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub eax, 0
je 0x10001d7a
sub eax, 1
jne 0x10001da8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_DisableThreadLibraryCalls]
push str.Global3D2AC132_95D2_446f_9AA4_DFE2F9DC04BC
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
test eax, eax
je 0x10001d27
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x10001da8
call fcn.10001b40
test eax, eax
je 0x10001d64
call fcn.10001c30
test eax, eax
je 0x10001d64
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x100018d0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10001d64
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.10001b40
test eax, eax
je 0x10001da8
call fcn.10002260
mov eax, 1
ret 0xc
cmp dword [0x100294f0], 0
je 0x10001da8
call fcn.100185d0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call fcn.10018e20
push 0x10002220
push 0x100294f0
call fcn.10019960
call fcn.10018830
mov eax, 1
ret 0xc