joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x50ec6c]
cmp byte [eax + 0x17], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
jne 0x489c0f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call fcn.0049a72e
imul esi, edi
add esp, 0x10
sub dword [0x50ec7a], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x50edac]
cmp byte [eax], 1
jne 0x489c40
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
imul ecx, edi
push edx
push eax
push ecx
call fcn.00489a20
add esp, 0x10
test eax, eax
je 0x489c67
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
mov edx, esi
imul edx, edi
push eax
push ecx
push edx
call fcn.004898f0
add esp, 0x10
test eax, eax
je 0x489c67
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
sub dword [0x50ec7a], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48aeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push edi
mov edi, dword [0x50ec6c]
je 0x48aec9
cmp byte [edi + 0x331], 0
jmp 0x48aed0
cmp byte [edi + 0x332], 0
je 0x48af2c
mov ecx, dword [ebp + 8]
mov eax, ecx
push esi
lea esi, [eax + 1]
jmp 0x48aee0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x48aee0
sub eax, esi
cmp byte [edi + 0x332], 0
lea edx, [eax - 1]
je 0x48af2b
test edx, edx
jle 0x48af2b
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x48af2b
mov edi, dword [ebp + 0xc]
push ebx
xor eax, eax
test edx, edx
jle 0x48af24
lea ebx, [ebx]
movzx ebx, byte [eax + ecx]
xor byte [esi + edi], bl
movzx ebx, byte [eax + ecx + 1]
xor byte [eax + ecx], bl
inc eax
cmp eax, edx
jl 0x48af10
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x48af04
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x48b250
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
call fcn.0049ec82
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.0049efbe
add esp, 0x28
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944f9
mov esp, ebp
pop ebp
ret
Function at 0x48c6c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00493f80
push 0x104
lea ecx, [ebp - 0x108]
push 0
push ecx
call fcn.00493f80
mov al, 0x3a
add esp, 0x18
cmp byte [ebx + 1], al
je 0x48c784
cmp byte [esi + 1], al
je 0x48c789
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0049ec82
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x48c7e2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48c755
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x48c7e2
lea edi, [ebp - 0x108]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48c770
mov dx, word [0x4cd950]
mov word [edi], dx
jmp 0x48c7e2
cmp byte [esi + 1], al
jne 0x48c7e2
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0049ec82
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x48c7e2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48c7b1
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x48c7e2
lea edi, [ebp - 0x108]
dec edi
jmp 0x48c7d0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48c7d0
mov cx, word [0x4cd950]
mov word [edi], cx
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48c7e6
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48c7f6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004abf4f
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004944f9
mov esp, ebp
pop ebp
ret

Function at 0x48e8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test ecx, ecx
je 0x48e8ee
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4f8d28]
inc edx
dec ecx
jne 0x48e8d4
pop edi
not eax
mov dword [esi], eax
pop esi
pop ebp
ret

Function at 0x48e900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
test edx, edx
je 0x48e949
push ebx
push esi
mov esi, dword [ebp + 8]
movzx ecx, word [esi]
mov ebx, ecx
xor ebx, eax
shr eax, 8
and ebx, 0xff
xor eax, dword [ebx*4 + 0x4f8d28]
shr ecx, 8
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4f8d28]
add esi, 2
dec edx
jne 0x48e915
pop esi
pop ebx
not eax
mov dword [edi], eax
pop edi
pop ebp
ret
Function at 0x48e950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x48e97b
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4f8d28]
inc edx
dec ecx
jne 0x48e961
pop esi
mov ecx, dword [ebp + 0x10]
not eax
mov word [ecx], ax
pop ebp
ret

Function at 0x48e990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
test ecx, ecx
je 0x48e9bb
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4f8d28]
inc edx
dec ecx
jne 0x48e9a1
pop esi
mov ecx, dword [ebp + 0x10]
not eax
mov dword [ecx], eax
pop ebp
ret
Function at 0x4944f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f9590]
jne 0x494503
repz ret
jmp fcn.004a464c

Function at 0x49490b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x494933
call fcn.0049daf8
and dword [eax], 0
call fcn.0049dae5
mov dword [eax], 0x16
call fcn.004a274c
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x494950
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0049db0b
pop ecx
jmp 0x49492e
test byte [ebp + 0xc], 0x80
je 0x49495b
and eax, 0xfffffffe
jmp 0x49495e
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x494941
xor eax, eax
pop ebp
ret

Function at 0x4abed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4abef7
call fcn.0049daf8
mov dword [eax], esi
call fcn.0049dae5
push 0x16
pop esi
mov dword [eax], esi
call fcn.004a274c
mov eax, esi
jmp 0x4abf4c
test dword [ebp + 0xc], 0xfffffff9
jne 0x4abedd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4abf24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0049db0b
pop ecx
call fcn.0049dae5
mov eax, dword [eax]
jmp 0x4abf4c
test al, 0x10
jne 0x4abf4a
test al, 1
je 0x4abf4a
test byte [ebp + 0xc], 2
je 0x4abf4a
call fcn.0049daf8
mov dword [eax], 5
call fcn.0049dae5
mov dword [eax], 0xd
jmp 0x4abf1b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4b3fae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a40f1
and dword [ebp - 0x14], 0
cmp dword [0x5127c8], 0
mov dword [ebp - 0x18], eax
jne 0x4b4061
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b4109
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4b4109
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5127c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5127cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5127d0], eax
call edi
push eax
call esi
mov dword [0x5127d8], eax
test eax, eax
je 0x4b4061
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5127d4], eax
mov eax, dword [0x5127d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4b40ba
cmp dword [0x5127d8], ecx
je 0x4b40ba
push eax
call esi
push dword [0x5127d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4b40ba
test ebx, ebx
je 0x4b40ba
call edi
test eax, eax
je 0x4b40b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4b40b1
test byte [ebp - 8], 1
jne 0x4b40ba
or dword [ebp + 0x10], 0x200000
jmp 0x4b40ed
mov eax, dword [0x5127cc]
cmp eax, dword [ebp - 0x18]
je 0x4b40ed
push eax
call esi
test eax, eax
je 0x4b40ed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b40ed
mov eax, dword [0x5127d0]
cmp eax, dword [ebp - 0x18]
je 0x4b40ed
push eax
call esi
test eax, eax
je 0x4b40ed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5127c8]
call esi
test eax, eax
je 0x4b4109
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4b410b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004944f9
leave
ret

Function at 0x4b84f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x40161a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 8]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x4016da
lea eax, [ebp - 0x14]
push edi
push eax
push esi
push esi
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1fe
call edi
test eax, eax
jne 0x4016a6
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 8]
call fcn.0040161a
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x4016a6
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x1fe
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 8]
jmp 0x40166b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
pop edi
jl 0x4016d2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, esi
je 0x4016d2
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
cmp eax, 5
jne 0x4016e8
mov dword [ebp - 4], 0x80070005
jmp 0x4016d2
cmp eax, 2
jne 0x4016c5
mov dword [ebp - 4], 1
jmp 0x4016d2
Function at 0x401a4c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
cmp dword [0x40486c], eax
je 0x401a98
push eax
push eax
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0xffffffffffffffff
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x401a93
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x401aa1
or eax, 0xffffffff
jmp 0x401aa1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
leave
ret 4

Function at 0x401aa5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [0x40486c], 0
je 0x401af1
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401aed
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push 0xffffffffffffffff
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x401afd
xor eax, eax
jmp 0x401afd
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
leave
ret 8

Function at 0x401b01
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [0x40486c], 0
je 0x401b4d
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x401b49
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push 0xffffffffffffffff
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x401b59
xor eax, eax
jmp 0x401b59
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
leave
ret 8
Function at 0x401b5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
xor eax, eax
cmp dword [0x40486c], eax
je 0x401bdd
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 4], 0x104
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x401bd8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
test al, 7
mov dword [ecx], eax
je 0x401bd2
push dword [esi]
lea eax, [ebp - 0x108]
push dword [ebp + 0x18]
push 0xffffffffffffffff
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401bd5
push 1
pop ebx
jmp 0x401bd5
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop esi
mov eax, ebx
pop ebx
jmp 0x401c2b
cmp dword [ebp + 0xc], 0
je 0x401c15
lea eax, [ebp - 0x310]
push 0x104
and word [ebp - 0x310], 0
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401c0f
push 1
pop eax
jmp 0x401c2b
lea eax, [ebp - 0x310]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
leave
ret 0x18

Function at 0x401c2f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
xor eax, eax
cmp dword [0x40486c], eax
je 0x401c9a
push esi
push 1
pop esi
lea ecx, [ebp - 0x104]
push eax
push eax
push 0x104
push ecx
push 0xffffffffffffffff
push dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x401c95
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, esi
pop esi
jmp 0x401ce5
cmp dword [ebp + 0xc], eax
je 0x401ccf
lea ecx, [ebp - 0x30c]
push 0x104
push ecx
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov word [ebp - 0x30c], ax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401cc9
push 1
pop eax
jmp 0x401ce5
lea eax, [ebp - 0x30c]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
leave
ret 0x18
Function at 0x100662d
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1006d08
call fcn.01006814
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10083ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1006442
cmp eax, esi
jne 0x1006435
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1006445
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100641c
xor esi, esi
inc esi
mov eax, dword [0x10083a8]
cmp eax, esi
jne 0x1006458
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006493
mov eax, dword [0x10083a8]
test eax, eax
jne 0x100648d
mov dword [0x10083a8], esi
push 0x1001284
push 0x1001278
call fcn.01006399
pop ecx
pop ecx
test eax, eax
je 0x1006493
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100655d
mov dword [0x100806c], esi
mov eax, dword [0x10083a8]
cmp eax, esi
jne 0x10064b7
push 0x1001274
push 0x100126c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10083a8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10064c4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10083b0], ebx
je 0x10064e5
push 0x10083b0
call fcn.01006789
pop ecx
test eax, eax
je 0x10064e5
push ebx
push 2
push ebx
call dword [0x10083b0]
push dword [0x1008054]
push dword [0x1008058]
push dword [0x1008050]
call fcn.0100264c
add esp, 0xc
mov dword [0x1008068], eax
cmp dword [0x100805c], ebx
jne 0x1006543
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100806c], ebx
jne 0x1006551
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1008068]
call fcn.01006859
ret
call fcn.01006961
jmp 0x10063fa

Function at 0x40b9e0
Capabilities:
Encode data using xor

Disassembly:
bound edi, qword [ecx + 0x6e]
pop esp
out 0x39, eax
push ds
paddusb mm5, qword [ebp - 0x579de716]
invalid

Function at 0x40e588
Capabilities:
Encode data using xor

Disassembly:
dec ecx
test eax, 0xd70c0db5
xor esp, dword [ebx*2 - 0x4e886bbd]
push 5
Function at 0x210039e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0x18], 0
je 0x21003a03
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x21003a1d
xor eax, eax
jmp 0x21003a6d
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x21003a60
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x21003a60
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x2100b07b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.21053c40
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebp
ret 0xc
Function at 0x2100c20a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x2100c239
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
je 0x2100c248
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
cmp dword [0x2108afc8], 0
je 0x2100c258
mov dword [ebp + 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 0xc], 0
je 0x2100c294
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x2100c294
mov dword [ebp - 0x114], 0
jmp 0x2100c29e
mov dword [ebp - 0x114], 1
cmp dword [ebp - 0x114], 0
jne 0x2100c2b9
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call fcn.2104a8ae
cmp dword [ebp + 8], 0
je 0x2100c2d5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x2100c2d5
mov dword [ebp - 0x118], 0
jmp 0x2100c2df
mov dword [ebp - 0x118], 1
cmp dword [ebp - 0x118], 0
jne 0x2100c2f7
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
movsx eax, byte [ebp - 0x108]
test eax, eax
je 0x2100c34e
cmp dword [ebp + 0x18], 0
jne 0x2100c32b
push 0xfa
lea ecx, [ebp - 0x108]
push ecx
call fcn.2104ead9
mov dword [ebp - 0x110], eax
jmp 0x2100c34e
push 0xfa
lea edx, [ebp - 0x108]
push edx
call fcn.2104eb76
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov dword [ebp - 0x110], eax
cmp dword [ebp + 0x14], 0
je 0x2100c35f
cmp dword [ebp - 4], 0
je 0x2100c35f
jmp 0x2100c3e4
cmp dword [ebp + 0x18], 0
je 0x2100c36d
cmp dword [ebp - 8], 0
je 0x2100c36d
jmp 0x2100c3e4
cmp dword [ebp - 4], 0
je 0x2100c37b
cmp dword [ebp + 0x18], 0
jne 0x2100c37b
jmp 0x2100c3e4
cmp dword [ebp - 0x110], 0
je 0x2100c38c
cmp dword [ebp + 0x14], 0
jne 0x2100c38c
jmp 0x2100c3e4
cmp dword [ebp + 0x10], 0
je 0x2100c3a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x10c]
jbe 0x2100c3a4
xor eax, eax
jmp 0x2100c405
movsx ecx, byte [ebp - 0x108]
test ecx, ecx
je 0x2100c3c1
push 0xfa
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
call fcn.210518a6
test eax, eax
jne 0x2100c3df
xor eax, eax
jmp 0x2100c405
jmp 0x2100c2b9
cmp dword [ebp + 0x14], 0
je 0x2100c3f2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp + 0x18], 0
je 0x2100c400
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 0x14