joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jae 0x4118fe
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x411925
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x411925
inc esi
jmp 0x411916
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x411a15
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x41195a
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x411987
cmp cl, 0xff
je 0x411987
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x411909
dec ecx
shl edx, cl
and edx, 7
je 0x411940
movzx ecx, byte [edx + 0x414950]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x414948], 0
mov cl, byte [edi + 4]
je 0x411982
test cl, cl
je 0x411982
cmp cl, 0xff
jne 0x411940
mov dword [ebp - 4], eax
jmp 0x41194f
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x4119b0
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x4119b7
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x4119eb
movzx edi, byte [edx + 0x414950]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x4119d6
cmp al, 0xff
jne 0x4119e8
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x4119a2
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x411909
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x3e9600ea
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x520d3586
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x398f1c97
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1a78626d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x106c4f1
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov ebx, 0x10064f8
cmp eax, esi
je 0x106c536
test byte [eax + 0x1c], 2
je 0x106c536
cmp byte [eax + 0x19], 5
jb 0x106c536
push ebx
push 0x65
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp + 8]
push 0x1006acc
push 0x104
push eax
call fcn.01009a76
mov edi, eax
add esp, 0x14
test edi, edi
jge 0x106c59c
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c57f
test byte [eax + 0x1c], 2
je 0x106c57f
cmp byte [eax + 0x19], 2
jb 0x106c57f
push edi
push ebx
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x106c632
and edi, 0xffff
jmp 0x106c632
push 0x10000
push 0
push 0x1004dc8
push 0x80000002
call fcn.0105fce9
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x106c5ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c632
test byte [eax + 0x1c], 2
je 0x106c632
cmp byte [eax + 0x19], 2
jb 0x106c632
push edi
push ebx
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x106c632
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
test edi, edi
je 0x106c626
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c626
test byte [eax + 0x1c], 2
je 0x106c626
cmp byte [eax + 0x19], 2
jb 0x106c626
push edi
push ebx
push 0x68
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4023e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
dec eax
js 0x402415
push ebx
push esi
lea esi, [eax + 1]
mov eax, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x404588]
xor eax, edx
inc ecx
dec esi
jne 0x4023f4
pop esi
pop ebx
ret
mov eax, dword [esp + 4]
ret

Function at 0x402520
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4031c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x14], eax
mov ebx, 1
mov dword [esp + 0x18], eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], bl
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0xc
call fcn.00402b7e
push 0x2f
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x2f
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReverseFind
mov edx, dword [esp + 0xc]
inc eax
mov ecx, dword [edx - 8]
cmp eax, ecx
je 0x4025d1
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00402b7e
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.00402b18
push 4
push 0x2f
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
mov esi, eax
test esi, esi
jle 0x402642
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, esi
lea ecx, [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x14]
inc esi
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.00402b7e
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.00402b18
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call edi
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 8]
dec eax
cmp esi, eax
je 0x402642
push esi
push 0x2f
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
mov esi, eax
test esi, esi
jg 0x4025ea
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00402b18
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00402b18
mov ecx, dword [esp + 0x20]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x402700
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4031f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
call fcn.00402a10
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFile::CFile
mov eax, dword [esi + 0x14]
push 0
push 0x20
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
lea ecx, [esp + 0x14]
je 0x4027e9
call sub.MFC42.DLL_CFile::GetLength
cmp eax, 0x120
mov dword [esi + 0xc], eax
jbe 0x4027ac
xor eax, eax
mov edx, dword [esp + 0x18]
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
push eax
push eax
push eax
push 2
push ecx
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x4027a5
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
jne 0x4027b7
mov ecx, esi
call fcn.00402a10
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFile::Close
jmp 0x4027e5
mov ecx, dword [esi + 0x10]
push 1
add ecx, 0xd0
push 1
push ecx
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x18]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.00402810
mov ecx, esi
call fcn.00402a10
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00402b3c
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x402810
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x403230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x44]
mov byte [esp + 0x38], 1
test eax, eax
jbe 0x4029af
mov edi, dword [esi + 4]
mov ebx, dword [esi + 0x10]
mov eax, dword [esp + 0x40]
add edi, ebx
lea ecx, [esp + 0x10]
lea ebx, [edi + 4]
push ebx
push eax
push str._s_s
push ecx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi + 0x10]
add esp, 0x10
add ecx, 0x50
mov dword [esi + 0x10], ecx
mov al, byte [edi + 0x46]
cmp al, 1
jne 0x40293c
push 0x406174
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
lea edx, [esp + 0x10]
push edx
call fcn.00402520
add esp, 4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x48]
mov byte [esp + 0x38], 2
test al, al
je 0x4028e5
lea ebp, [esi + 0x1c]
push ebx
push 0x406020
push ebp
call sub.MFC42.DLL_CString::Format
mov eax, dword [ebp]
lea ecx, [esp + 0x20]
push eax
push str.___Pack____Dir_Root____s
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x18
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push str.___Pack____Dir___s
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [edi]
push 0
push edx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.00402810
test al, al
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
je 0x4029e5
call fcn.00402b18
jmp 0x40299a
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [esp + 0x10]
push 0
push 0x1001
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_CFile::Open
cmp eax, 1
lea ecx, [esp + 0x20]
jne 0x402990
mov edx, dword [edi]
mov eax, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
add eax, edx
push eax
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::Close
mov ecx, dword [edi]
mov eax, dword [esi + 0x10]
add eax, ecx
lea ecx, [esp + 0x20]
mov dword [esi + 0x10], eax
mov byte [esp + 0x38], 1
call fcn.00402b3c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x402858
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.00402b18
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00402b18
mov al, 1
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 0xc
call fcn.00402b18
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.00402b18
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00402b18
xor al, al
jmp 0x4029d0
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401000
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401059
push ebx
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xffffffe6
cmp eax, 0xf85
ja 0x40104a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret

Function at 0x401110
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
cmp eax, 0x19
jl 0x401177
push esi
push dword [ebp + 8]
call ebx
imul eax, eax, 3
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp + 8]
mov esi, eax
call ebx
inc eax
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop ebp
ret

Function at 0x40117a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push 2
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4019fc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40119f

Function at 0x4011d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x401a77
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x1002672
Capabilities:
Get user security identifier

Disassembly:
push 0x14
mov eax, 0x10113c9
call fcn.01001410
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x10056b2
cmp dword [ebp + 8], esi
je 0x10056bc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10056f1
mov eax, dword [ebp - 0x18]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or eax, ecx
push eax
call dword [0x1014498]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
je 0x100273b
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [edi], eax
cmp eax, esi
je 0x1002734
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10056da
xor ebx, ebx
push dword [ebp - 0x14]
call dword [0x1014494]
mov eax, ebx
call fcn.01001350
ret 8
mov ebx, 0x8007000e
jmp 0x1002721
mov ebx, 0x8007000e
jmp 0x100272a
mov eax, 0x80004003
jmp 0x100272c
mov eax, 0x80070057
jmp 0x100272c
call fcn.01002d9a
push dword [edi]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [edi], esi
jmp 0x1002721
push eax
call fcn.01009439
mov ebx, eax
jmp 0x100272a

Function at 0x10034fe
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01002793
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10035a0
cmp dword [ebp - 0x94], 5
jb 0x1003573
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10035bc
call fcn.01002230
test eax, eax
jl 0x1005de4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret
cmp dword [ebp - 0x88], 1
je 0x1005dcc
jmp 0x1003573
cmp dword [ebp - 0x90], 0
jbe 0x1003573
jmp 0x100356f
cmp dword [ebp - 0x94], 4
ja 0x100356f
je 0x10035af
jmp 0x1003573
mov byte [0x1014548], 1
jmp 0x1003591
Function at 0x1003759
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1001ea0
call fcn.010021e6
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1014078
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1005df0
xor esi, esi
inc esi
mov eax, dword [0x101403c]
cmp eax, esi
je 0x1005e0f
mov eax, dword [0x101403c]
test eax, eax
jne 0x1001e5d
mov dword [0x101403c], esi
push 0x1001e98
push 0x1001e8c
call fcn.01002a44
pop ecx
pop ecx
test eax, eax
jne 0x1005e1c
mov eax, dword [0x101403c]
cmp eax, esi
jne 0x1001e12
push 0x1001e88
push 0x1001e68
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101403c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1001e1f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10144b4], ebx
jne 0x1005e2a
push dword [0x101408c]
push dword [0x1014090]
push dword [0x1014088]
call fcn.010016a0
add esp, 0xc
mov dword [0x1014038], eax
cmp dword [0x101402c], ebx
jne 0x1005e7c
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov dword [0x1014570], esi
jmp 0x1001dee
call fcn.01003768
jmp 0x1001d7f
cmp eax, esi
jne 0x1005dff
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1001db5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001da1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001dee
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1005e96
push 0x10144b4
call fcn.0100c1dc
pop ecx
test eax, eax
je 0x1001e2b
push ebx
push 2
push ebx
call dword [0x10144b4]
jmp 0x1001e2b
cmp dword [0x1014570], ebx
jne 0x1005e8a
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1014038]
call fcn.0100227c
ret

Function at 0x1009be4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x1009bff
push 0x80004005
call fcn.01009819
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1009c01
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100a2ef
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01009b42
mov edi, eax
cmp edi, esi
je 0x100a361
lea ecx, [ebp - 0x214]
call fcn.01009acf
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010012fd
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100a37f
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.0100a2ef
cmp eax, esi
jne 0x100a3ca
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x100a369
lea ecx, [ebp - 0x214]
call fcn.01009acf
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.010099ba
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01009acf
mov eax, esi
jmp 0x100a351