joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12b0180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push 0
push ecx
push dword [ebp + 0xc]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2010
push 0
push 0
push 0xa
push dword [ebp + 0x10]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.012a9be0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 2
push 0x12c8194
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret

Function at 0x12b0260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2080
push 8
push 8
push 0x10
push eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.012a9be0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret

Function at 0x12b02d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x1000]
cmp eax, 0x2000
jb 0x12b0314
xor eax, eax
cmp byte [esi], al
je 0x12b0307
lea ebx, [ebx]
inc eax
cmp byte [esi + eax], 0
jne 0x12b0300
push 0
lea ecx, [ebp - 0x88]
push ecx
push eax
push esi
jmp 0x12b0383
push 0
lea eax, [ebp - 0x88]
push eax
push 0xb
push str._pszString
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2080
push 8
push 8
push 0x10
push esi
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.012a9be0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 1
push 0x12ce90c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01271180
mov esp, ebp
pop ebp
ret
Function at 0x12b03b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
push 0
push 0
push 0xa
push dword [ebp + 8]
lea eax, [ebp - 0xac]
push 0xa8
push eax
call fcn.012a9be0
push 0x2008
push 0
push 0
mov word [ebp + eax - 0xac], 0x2820
lea esi, [eax + 2]
push 0x10
push dword [ebp + 8]
mov eax, 0xa8
sub eax, esi
push eax
lea eax, [ebp - 0xac]
add eax, esi
push eax
call fcn.012a9be0
add esp, 0x38
lea ecx, [ebp - 0xb0]
add eax, esi
push 0
mov byte [ebp + eax - 0xac], 0x29
inc eax
push ecx
push eax
lea eax, [ebp - 0xac]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01271180
mov esp, ebp
pop ebp
ret

Function at 0x12b0460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2008
push 0
push 0
push 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.012a9be0
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret

Function at 0x12b0830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
jne 0x12b0943
shr eax, 8
cmp al, 0x32
jae 0x12b0943
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x12b0863
mov eax, dword [ecx + 0x3c]
add eax, ecx
jmp 0x12b0865
mov eax, ecx
cmp dword [eax], 0x4550
jne 0x12b0947
push esi
movzx esi, word [eax + 0x14]
add esi, eax
movzx eax, word [eax + 6]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x12b0942
push ebx
add esi, 0x20
push edi
lea esp, [esp]
mov ebx, dword [esi]
mov eax, dword [esi + 8]
cmp ebx, eax
jbe 0x12b0933
mov edi, dword [esi + 4]
sub ebx, eax
add edi, eax
add edi, ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jns 0x12b08bb
push ebx
push 0
push edi
call sym.VBoxTray.exe_nocrt_memset
add esp, 0xc
jmp 0x12b0930
mov eax, edi
and ecx, 0x20000000
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov eax, edi
and eax, 0xfff
add eax, 0xfff
add eax, ebx
and eax, 0xfffff000
neg ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
sbb ecx, ecx
push eax
and ecx, 0x3c
lea eax, [ebp - 8]
add ecx, 4
push ecx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x12b092f
push ebx
push 0
push edi
call sym.VBoxTray.exe_nocrt_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
jmp 0x12b0930
int3
mov ecx, dword [ebp + 8]
add esi, 0x28
sub dword [ebp - 0x10], 1
jne 0x12b0890
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
int3
Function at 0x12b1320
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.012a7560
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x12b141f
push esi
push 0x8000
push 0
push 0
push dword [ebp + 0xc]
call fcn.012afd10
mov esi, eax
push esi
call fcn.012afce0
add esp, 0x14
test al, al
je 0x12b140a
shr esi, 0x10
and esi, 0x31af
mov dword [ebp - 0x34], 0xc0000365
mov dword [ebp - 0x30], 0xffffffd5
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], esi
jne 0x12b13c8
mov dword [ebp - 0xc], 0x80
push 4
push 0x28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
js 0x12b13f1
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
push eax
call fcn.012a7bb0
add esp, 4
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xffffffeb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffc
xor ecx, ebp
pop edi
call fcn.01271180
mov esp, ebp
pop ebp
ret
Function at 0x12b1d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebx + 0x1000]
cmp eax, 0x2000
jb 0x12b1e2b
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 4], eax
add eax, 2
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxGuestlibVBoxGuestR3LibAdditions.cpp
push eax
call fcn.01295560
mov edi, eax
add esp, 8
test edi, edi
je 0x12b1e17
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x12b1dd4
push edi
call fcn.01295580
mov eax, dword [ebp - 4]
add eax, 0x10
mov dword [ebp - 4], eax
add eax, 2
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxGuestlibVBoxGuestR3LibAdditions.cpp
push eax
call fcn.01295560
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x12b1dbf
mov dword [ebx], eax
lea eax, [edi - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x12b1df6
cmp dword [ebp - 8], 1
jne 0x12b1def
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxGuestlibVBoxGuestR3LibAdditions.cpp
push ebx
push edi
call fcn.01298db0
add esp, 0xc
jmp 0x12b1dff
mov esi, 0xffffa877
jmp 0x12b1e01
push eax
call fcn.0128c1e0
add esp, 4
mov esi, eax
push edi
call fcn.01295580
add esp, 4
test esi, esi
js 0x12b1e1c
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xffffffec
pop edi
mov eax, esi
mov dword [ebx], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffa
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a22
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4340d0]
jne 0x401a2c
repz ret
jmp fcn.004028c6

Function at 0x40f8a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040344a
and dword [ebp - 4], 0
cmp dword [0x43d100], 0
mov ebx, eax
jne 0x40f959
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fa0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fa0a
push eax
call fcn.004033d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43d100], eax
call esi
push eax
call fcn.004033d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43d104], eax
call esi
push eax
call fcn.004033d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43d108], eax
call esi
push eax
call fcn.004033d8
pop ecx
mov dword [0x43d110], eax
test eax, eax
je 0x40f959
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004033d8
pop ecx
mov dword [0x43d10c], eax
mov eax, dword [0x43d10c]
cmp eax, ebx
je 0x40f9b1
cmp dword [0x43d110], ebx
je 0x40f9b1
push eax
call fcn.00403453
push dword [0x43d110]
mov esi, eax
call fcn.00403453
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f9b1
test edi, edi
je 0x40f9b1
call esi
test eax, eax
je 0x40f9a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f9a8
test byte [ebp - 0xc], 1
jne 0x40f9b1
or dword [ebp + 0x10], 0x200000
jmp 0x40f9ea
mov eax, dword [0x43d104]
cmp eax, ebx
je 0x40f9ea
push eax
call fcn.00403453
pop ecx
test eax, eax
je 0x40f9ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9ea
mov eax, dword [0x43d108]
cmp eax, ebx
je 0x40f9ea
push eax
call fcn.00403453
pop ecx
test eax, eax
je 0x40f9ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d100]
call fcn.00403453
pop ecx
test eax, eax
je 0x40fa0a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fa0c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f0bd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [0x43d5ac]
push esi
push dword [eax]
mov esi, dword [0x43d4f4]
call fcn.0042eff4
cmp dword [0x43d5ac], 0x2f
pop ecx
jne 0x42f11c
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 8], edi
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
pop edi
push esi
call fcn.0042f036
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x42f44e
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x43d5ac], 0xbf9
jne 0x42f469
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp dword [0x43d5ac], 0x3dc
mov dword [0x43d5a0], 0x8e55ceaa
jne 0x42f498
push esi
push 0x432878
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.xafecelocixupapedahesofunezodicexegenogexepumawojuyagon
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x42f457
cmp esi, 0x8465cb
jne 0x42f4b2
mov eax, dword [0x43c564]
add eax, 0xa231
mov dword [0x43d5ac], eax
cmp dword [0x43d5ac], 0x141
jne 0x42f4cf
or dword [0x43d274], 0xffffffff
mov dword [0x43d270], 0xec58acac
inc esi
cmp esi, 0x123c19c
jl 0x42f49b
call fcn.0042f127
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617
Function at 0x431000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x2479145c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x6ba85c05
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0xc82704
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xc828ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00c82690
test eax, eax
jbe 0xc82893
cmp dword [ebp - 8], 0
jbe 0xc82893
mov eax, dword [ebp - 0xc]
call fcn.00c82690
cmp eax, 0x80
jbe 0xc8276d
lea eax, [ebp - 0x510]
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp - 0xc]
call fcn.00c826fc
jmp 0xc82787
mov eax, dword [ebp - 0xc]
call fcn.00c82690
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x510]
mov edx, dword [ebp - 0xc]
call fcn.00c826fc
xor edi, edi
lea eax, [ebp - 0x410]
mov dword [eax], edi
inc edi
add eax, 4
cmp edi, 0x100
jne 0xc8278f
xor esi, esi
xor edi, edi
lea ebx, [ebp - 0x410]
lea eax, [ebp - 0x514]
mov edx, dword [ebp - 0xc]
call fcn.00c81a24
mov eax, dword [ebp - 0x514]
call fcn.00c81a98
push eax
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
xor eax, eax
mov al, byte [ebp + edx - 0x510]
add esi, dword [ebx]
add eax, esi
and eax, 0x800000ff
jns 0xc827e4
dec eax
or eax, 0xffffff00
inc eax
mov esi, eax
mov al, byte [ebx]
mov edx, dword [ebp + esi*4 - 0x410]
mov dword [ebx], edx
and eax, 0xff
mov dword [ebp + esi*4 - 0x410], eax
inc edi
add ebx, 4
cmp edi, 0x100
jne 0xc827a7
xor esi, esi
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
dec ecx
test ecx, ecx
jl 0xc82893
inc ecx
inc esi
and esi, 0x800000ff
jns 0xc8282d
dec esi
or esi, 0xffffff00
inc esi
add edx, dword [ebp + esi*4 - 0x410]
and edx, 0x800000ff
jns 0xc82844
dec edx
or edx, 0xffffff00
inc edx
mov al, byte [ebp + esi*4 - 0x410]
mov ebx, dword [ebp + edx*4 - 0x410]
mov dword [ebp + esi*4 - 0x410], ebx
and eax, 0xff
mov dword [ebp + edx*4 - 0x410], eax
mov eax, dword [ebp + esi*4 - 0x410]
add eax, dword [ebp + edx*4 - 0x410]
and eax, 0x800000ff
jns 0xc82881
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x410]
mov ebx, dword [ebp - 0x10]
xor byte [ebx], al
inc dword [ebp - 0x10]
dec ecx
jne 0xc8281c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc828b3
lea eax, [ebp - 0x514]
call fcn.00c8190c
ret
Function at 0xc82960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00c81d44
lea eax, [ebp - 8]
call fcn.00c81d44
lea eax, [ebp + 0xc]
call fcn.00c81d44
xor eax, eax
push ebp
push 0xc82a67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00c81948
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00c81a88
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0xc82a18
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00c81a88
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xc82a0f
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0xc829ec
adc edx, 0
mov eax, ebx
call fcn.00c81d00
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.00c81a88
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov edx, dword [ebx]
mov eax, 0xc82a7c
call fcn.00c81cb0
test eax, eax
jle 0xc82a44
push ebx
mov edx, dword [ebx]
mov eax, 0xc82a7c
call fcn.00c81cb0
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00c81bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc82a6e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00c81924
lea eax, [ebp + 0xc]
call fcn.00c8190c
ret

Function at 0xc82a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call sub.advapi32.dll_RegCreateKeyW
mov eax, esi
call fcn.00c82938
add eax, eax
push eax
push esi
mov eax, dword [ebp + 8]
push eax
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0xc82aba
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0xc82ad0
Capabilities:
Get common file path

Disassembly:
push ebx
push 4
push 0x1000
push 0x208
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
pop ebx
ret

Function at 0xc82af8
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffffdf4
push 0x104
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
mov edx, 0xc82b20
mov eax, esp
call fcn.00c82e98
add esp, 0x20c
ret

Function at 0xc82b24
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffffdf4
push 0x104
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov edx, 0xc82b4c
mov eax, esp
call fcn.00c82e98
add esp, 0x20c
ret
Function at 0xc82b84
Capabilities:
Delete file

Disassembly:
push ebx
push esi
call fcn.00c82ad0
mov edx, 0xc82be0
call fcn.00c82e98
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
push eax
call sub.KERNEL32.DLL_CloseHandle
push 4
push 0x1000
push 0x208
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
push esi
push 0
push ebx
call sub.shell32.dll_FindExecutableW
push ebx
call sub.KERNEL32.DLL_DeleteFileW
mov eax, esi
pop esi
pop ebx
ret

Function at 0xc82c2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0xc82cf5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00c82120
lea eax, [ebp - 0xc]
call fcn.00c82120
push eax
call sub.shell32.dll_SHGetMalloc
xor ebx, ebx
cmp dword [ebp - 0xc], 0
jne 0xc82c6c
mov dword [ebp - 4], ebx
jmp 0xc82cdf
xor eax, eax
push ebp
push 0xc82cd8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00c82c08
test al, al
je 0xc82cba
push 4
push 0x1000
push 0x208
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0xc82cba
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc82cdf
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc82cfc
lea eax, [ebp - 0xc]
call fcn.00c82120
ret

Function at 0xc82d08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0xc82d5e
cmp dword [ebp + 0xc], 0
jne 0xc82d47
cmp dword [ebp + 8], 0xffffffff
jne 0xc82d47
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8