joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fcc0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1002fedd
cmp eax, 0x7c
je 0x1002fedd
cmp eax, 0x29
jne 0x1002fd01
cmp dword [esi + 0x10], 0
jne 0x1002fedd
cmp eax, eax
jne 0x1002fd01
test dword [esi + 0x50], 0x10000000
je 0x1002feea
jmp 0x1002fe96
cmp eax, 0x2e
jne 0x1002fd12
push 5
lea ecx, [esi + 0x24]
call fcn.1002ff40
jmp 0x1002fd8e
cmp eax, 0x5c
jne 0x1002fd71
mov ecx, esi
call fcn.1002fc70
test byte [esi + 0x50], 0x80
je 0x1002fd65
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1002fd43
push 4
lea ecx, [esi + 0x24]
call fcn.1002ff40
mov ecx, esi
call fcn.1002fc70
jmp 0x1002fecf
cmp eax, 0x42
jne 0x1002fd65
push 4
lea ecx, [esi + 0x24]
call fcn.1002ff40
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1002fc70
jmp 0x1002fecf
mov ecx, esi
call fcn.100315a0
jmp 0x1002fec8
cmp eax, 0x5b
jne 0x1002fdde
mov ecx, esi
call fcn.1002fc70
mov ecx, esi
call fcn.100314a0
cmp dword [esi + 0x4c], 0x5d
jne 0x1002fef8
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x1002fdd2
cmp word [eax], 0x5c
jne 0x1002fdcd
lea ecx, [eax + 2]
cmp ecx, edx
je 0x1002fdcd
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1002fdb9
movzx edi, word [ecx]
cmp edi, 0x28
je 0x1002fdcb
cmp edi, 0x29
je 0x1002fdcb
test dl, 0x10
jne 0x1002fdcd
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x1002fdcb
cmp edx, 0x7d
jne 0x1002fdcd
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.1002ea00
jmp 0x1002fec8
cmp eax, 0x28
jne 0x1002fe52
mov ecx, esi
call fcn.1002fc70
mov ecx, esi
call fcn.10031750
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1002feea
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1002fe41
cmp word [eax], 0x5c
jne 0x1002fe3c
lea ecx, [eax + 2]
cmp ecx, edx
je 0x1002fe3c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1002fe28
movzx edi, word [ecx]
cmp edi, 0x28
je 0x1002fe3a
cmp edi, 0x29
je 0x1002fe3a
test dl, 0x10
jne 0x1002fe3c
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x1002fe3a
cmp edx, 0x7d
jne 0x1002fe3c
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.1002ea00
test bl, bl
je 0x1002fecf
jmp 0x1002fec8
cmp eax, 0x5e
jne 0x1002fe6a
push 2
lea ecx, [esi + 0x24]
call fcn.1002ff40
mov ecx, esi
call fcn.1002fc70
jmp 0x1002fecf
cmp eax, 0x24
jne 0x1002fe82
push 3
lea ecx, [esi + 0x24]
call fcn.1002ff40
mov ecx, esi
call fcn.1002fc70
jmp 0x1002fecf
cmp eax, 0x2a
je 0x1002fee3
cmp eax, 0x2b
je 0x1002fee3
cmp eax, 0x3f
je 0x1002fee3
cmp eax, 0x7b
je 0x1002fee3
cmp eax, 0x7d
jne 0x1002fea6
test dword [esi + 0x50], 0x10000000
je 0x1002fef1
jmp 0x1002feb4
cmp eax, 0x5d
jne 0x1002feb4
test dword [esi + 0x50], 0x10000000
je 0x1002fef8
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10031a10
mov ecx, esi
call fcn.1002fc70
mov ecx, esi
call fcn.10031860
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x1002fcd3
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.1002e9f0
push 5
call fcn.1002e9f0
push 6
call fcn.1002e9f0
push 4
call fcn.1002e9f0
int3
Function at 0x100392c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009769e
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x118], ecx
push ecx
mov dword [ebp - 4], 0
mov edi, esp
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xff
mov dword [ebp - 0x124], edi
call fcn.10003080
mov ebx, eax
test ebx, ebx
je 0x100394f0
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.CRLogProductPreferences
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.100046b0
test al, al
jne 0x1003935f
push 0x18
push str.CRLogProductPreferences
mov ecx, edi
call fcn.100050e0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0
call fcn.1003b330
add esp, 4
test al, al
jne 0x10039392
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jmp 0x100394be
mov esi, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003940d
mov eax, dword [ebp - 0x11c]
mov ecx, 0xff
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
mov dword [ebp - 0x11c], eax
cmovl ecx, eax
cmp ecx, 0x100
jae 0x100394fa
lea eax, [ebp - 0x114]
mov byte [ebp + ecx - 0x114], 0
push eax
push 0x100af434
push dword [ebp - 0x118]
call fcn.10023680
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10039375
or ebx, 0xffffffff
cmp eax, 2
jne 0x100394a2
push str.0_1_100
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], 0
call fcn.100034f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x118]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x10039458
push edi
lea ecx, [ebp - 0x118]
call fcn.10005310
mov eax, dword [ebp - 0x118]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100394a2
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x120]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x100394d4
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
call fcn.10057ea9
int3
Function at 0x1003b4a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097a6e
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov dword [ebp - 4], 0
mov edi, esp
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xff
mov dword [ebp - 0x120], edi
call fcn.10003080
mov ebx, eax
test ebx, ebx
je 0x1003b664
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.CRLogProductPreferences
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.100046b0
test al, al
jne 0x1003b539
push 0x18
push str.CRLogProductPreferences
mov ecx, edi
call fcn.100050e0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0
call fcn.1003b330
add esp, 4
or esi, 0xffffffff
test al, al
jne 0x1003b559
xor bl, bl
jmp 0x1003b61b
mov ebx, dword [ebp - 0x118]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003b612
cmp eax, 2
jne 0x1003b612
push str.0_1_100
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], 0
call fcn.100034f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x118]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x1003b5cb
push edi
lea ecx, [ebp - 0x118]
call fcn.10005310
mov eax, dword [ebp - 0x118]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b612
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
or esi, 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1003b646
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3
Function at 0x1003b670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094eb0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100c006c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x1003b6e7
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x1003b6c0
push edi
lea ecx, [ebp + 0xc]
call fcn.10005310
mov eax, dword [ebp + 0xc]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov ecx, dword [ebp + 8]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b714
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1003b73f
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003b760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097aca
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x41c], edx
mov ebx, ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
mov dword [ebx], 0
call fcn.10003080
mov edi, eax
test edi, edi
je 0x1003b87d
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x418], 1
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x414], 0x400
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003b82d
lea eax, [ebp - 0x410]
push eax
push 0x100af434
push ebx
call fcn.10023680
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b85f
mov edi, dword [ecx]
push ecx
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3
Function at 0x1003b890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x418], ebx
call fcn.10003080
mov edi, eax
test edi, edi
je 0x1003ba16
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x414], esi
push ecx
mov dword [ebp - 4], 0
mov ecx, esp
push str.CRLog
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0x400
call fcn.10009810
lea ecx, [ebp - 0x41c]
call fcn.1003b330
add esp, 4
test al, al
jne 0x1003b971
lea ecx, [ebp - 0x414]
call fcn.100051d0
mov esi, dword [ebp - 0x414]
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000c040
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003b9f8
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
jmp 0x1003b9ec
mov edi, dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push str.User_level_client_setting
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003b9ba
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
push 0x100af434
push eax
call fcn.10023680
mov esi, dword [ebp - 0x414]
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000c040
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003b9f8
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3
Function at 0x10040e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100983eb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x224], eax
call fcn.10003080
mov edi, eax
test edi, edi
je 0x100410bc
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x224], 0x104
push eax
push 0
push 0
push 0x100b10d8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push 0x100af434
push eax
call fcn.10023680
mov esi, dword [ebp - 0x220]
add esp, 0xc
xor edi, edi
mov ebx, esi
movzx eax, word [esi]
test ax, ax
je 0x10040fcf
mov ecx, eax
nop dword [eax + eax]
push ecx
call fcn.100775c7
add esp, 4
test eax, eax
je 0x10040f78
test edi, edi
mov eax, ebx
cmovne eax, edi
mov edi, eax
jmp 0x10040f7a
xor edi, edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x10040f60
test edi, edi
je 0x10040fcf
sub edi, esi
sar edi, 1
js 0x100410c6
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
sub eax, edi
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x10040fbb
push edi
lea ecx, [ebp - 0x220]
call fcn.10005260
mov esi, dword [ebp - 0x220]
cmp edi, dword [esi - 8]
jg 0x100410c6
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x10040fd4
mov ebx, 1
movzx eax, word [esi]
mov edi, esi
push eax
call fcn.100775c7
add esp, 4
test eax, eax
je 0x10041061
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.100775c7
add esp, 4
test eax, eax
jne 0x10040fe6
cmp edi, esi
je 0x10041061
mov ecx, dword [esi - 0xc]
sub edi, esi
sar edi, 1
test ecx, ecx
js 0x100410d0
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, ecx
or eax, ebx
jge 0x1004102b
push ecx
lea ecx, [ebp - 0x220]
call fcn.10005260
mov esi, dword [ebp - 0x220]
mov ecx, dword [esi - 0xc]
lea edx, [esi + edi*2]
mov ebx, ecx
sub ebx, edi
lea eax, [ebx*2 + 2]
push eax
push edx
lea eax, [ecx*2 + 2]
push eax
push esi
call fcn.10005d90
add esp, 0x10
test ebx, ebx
js 0x100410c6
cmp ebx, dword [esi - 8]
jg 0x100410c6
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000c040
mov ebx, dword [ebp - 0x228]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004109e
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
push 0x80070057
call fcn.10002e30
push 0x80070057
call fcn.10002e30
int3
Function at 0x100415b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100983eb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x224], eax
call fcn.10003080
mov edi, eax
test edi, edi
je 0x100417dc
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x224], 0x104
push eax
push 0
push 0
push str.CurrentBuild
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push 0x100af434
push eax
call fcn.10023680
mov esi, dword [ebp - 0x220]
add esp, 0xc
xor edi, edi
mov ebx, esi
movzx eax, word [esi]
test ax, ax
je 0x100416ef
mov ecx, eax
nop dword [eax + eax]
push ecx
call fcn.100775c7
add esp, 4
test eax, eax
je 0x10041698
test edi, edi
mov eax, ebx
cmovne eax, edi
mov edi, eax
jmp 0x1004169a
xor edi, edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x10041680
test edi, edi
je 0x100416ef
sub edi, esi
sar edi, 1
js 0x100417e6
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
sub eax, edi
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x100416db
push edi
lea ecx, [ebp - 0x220]
call fcn.10005260
mov esi, dword [ebp - 0x220]
cmp edi, dword [esi - 8]
jg 0x100417e6
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x100416f4
mov ebx, 1
movzx eax, word [esi]
mov edi, esi
push eax
call fcn.100775c7
add esp, 4
test eax, eax
je 0x10041781
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.100775c7
add esp, 4
test eax, eax
jne 0x10041706
cmp edi, esi
je 0x10041781
mov ecx, dword [esi - 0xc]
sub edi, esi
sar edi, 1
test ecx, ecx
js 0x100417f0
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, ecx
or eax, ebx
jge 0x1004174b
push ecx
lea ecx, [ebp - 0x220]
call fcn.10005260
mov esi, dword [ebp - 0x220]
mov ecx, dword [esi - 0xc]
lea edx, [esi + edi*2]
mov ebx, ecx
sub ebx, edi
lea eax, [ebx*2 + 2]
push eax
push edx
lea eax, [ecx*2 + 2]
push eax
push esi
call fcn.10005d90
add esp, 0x10
test ebx, ebx
js 0x100417e6
cmp ebx, dword [esi - 8]
jg 0x100417e6
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000c040
mov ebx, dword [ebp - 0x228]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100417be
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
push 0x80070057
call fcn.10002e30
push 0x80070057
call fcn.10002e30
int3
Function at 0x1005a62f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10081a7a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10081721

Function at 0x10081a85
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100818ab
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x6a385dbc
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6ae05968
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d60
mov ecx, dword [0x10048240]
call fcn.1001a5a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001fcd
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10047828]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1004782c]
call fcn.100140c0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003332
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x10003371
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000336c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003329
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4