joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d9fc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00457ab4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00449494
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d9ee3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x398], 0
jne 0x4d9e8d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38c], 0
je 0x4d9e8d
mov byte [ebx], 0
jmp 0x4d9fb1
mov eax, dword [ebp - 4]
call fcn.004da32c
mov byte [ebx], 1
lea eax, [ebp - 0x1c]
call fcn.00405e34
push eax
push 0x4d9fd8
mov eax, dword [ebp - 4]
call fcn.0045e7c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00419528
test al, al
jne 0x4d9fb1
mov eax, dword [ebp - 4]
add eax, 0x38c
mov edx, dword [ebp - 0x1c]
call fcn.00405e4c
jmp 0x4d9fb1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
cmp eax, dword [ebp - 0x10]
jne 0x4d9ef9
mov byte [ebx], 0
jmp 0x4d9fb1
mov eax, dword [ebp - 4]
call fcn.004da32c
mov byte [ebx], 1
mov eax, dword [ebp - 0x10]
call fcn.00445a68
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov eax, dword [eax + 0xc]
call fcn.0041c774
mov eax, dword [eax + 0x30]
call fcn.004d51ac
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4d9f8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00405e34
push eax
push 0
push 0x4d9fd8
lea eax, [ebp - 0x20]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.0045e7c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
call fcn.00419528
test al, al
je 0x4d9f79
call fcn.00403bb8
jmp 0x4d9fb1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9f96
mov eax, dword [ebp - 0x20]
call fcn.004d515c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9fce
lea eax, [ebp - 0x1c]
call fcn.00405e34
ret

Function at 0x4da438
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
mov dword [ebp - 0x158], 0x20000000
push 0x20808
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
test byte [ebp - 0x155], 0x20
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4daad8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x4daaef
add esp, 0xfffffff0
call fcn.004036a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00441970
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4d3fdc]
call fcn.004d6638
mov dword [ebx + 0x358], eax
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4d8684]
call fcn.004d5808
mov esi, eax
mov dword [ebx + 0x36c], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0x4dc4b0
mov dl, 1
mov eax, dword [0x4d40f4]
call fcn.004d7e20
mov esi, eax
mov dword [ebx + 0x344], esi
mov dword [esi + 0xc], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x104]
mov dword [esi + 8], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4d87d4]
call fcn.004d7818
mov esi, eax
mov dword [ebx + 0x364], esi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], 0x4dc540
mov dl, 1
mov eax, dword [0x419ce8]
call fcn.0041cd50
mov dword [ebx + 0x354], eax
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x4dac08
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x34c], eax
lea eax, [ebx + 0x340]
call fcn.00405e34
xor edx, edx
mov eax, ebx
call fcn.004dc2ac
lea eax, [ebx + 0x348]
call fcn.00405e34
mov byte [ebx + 0x1f8], 1
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov byte [ebx + 0x361], 0
mov byte [ebx + 0x244], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4dabfe
call fcn.004036fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4daf18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db0d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004426d0
call fcn.004405a4
test eax, eax
je 0x4db0b6
mov eax, ebx
call fcn.004426d0
call fcn.004405a4
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d5e84
xor eax, eax
push ebp
push 0x4db0af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004426d0
call fcn.0044082c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 8]
dec edx
cmp eax, edx
jle 0x4daf97
call fcn.00403bb8
jmp 0x4db0b6
mov eax, ebx
call fcn.004426d0
call fcn.0044082c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c774
mov eax, dword [eax + 0x30]
call fcn.004d51ac
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4db092
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00405e34
push eax
push 0
push 0x4db0e0
lea eax, [ebp - 8]
push eax
push 1
mov eax, ebx
call fcn.0045e7c4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
call fcn.00419528
test al, al
je 0x4db00b
call fcn.00403bb8
call fcn.00403bb8
jmp 0x4db0b6
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4d3b44]
call fcn.004d7dc0
mov edx, eax
test edx, edx
je 0x4db022
sub edx, 0xfffffff0
lea eax, [ebp - 0x10]
call fcn.00405e4c
mov eax, dword [ebx + 0x344]
call fcn.004d7ea4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ole32.dll_DoDragDrop
mov eax, ebx
call fcn.004426d0
call fcn.004405a4
mov eax, dword [eax + 0xc]
call fcn.004dce5c
test al, al
jne 0x4db07c
mov eax, ebx
call fcn.004426d0
call fcn.004405a4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.004dc314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db099
mov eax, dword [ebp - 8]
call fcn.004d515c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db0db
lea eax, [ebp - 0x10]
call fcn.00405e34
lea eax, [ebp - 0xc]
call fcn.00405e34
ret
Function at 0x4db9bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov esi, ecx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dbbc9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00457ab4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004424d4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4dba19
mov eax, dword [ebp - 4]
call fcn.004dc2dc
jmp 0x4dbbab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
cmp eax, dword [ebp - 0x10]
jne 0x4dba3b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x340], 0
je 0x4dba3b
mov byte [ebx], 0
jmp 0x4dbbab
mov eax, dword [ebp - 4]
call fcn.004dc2dc
mov byte [ebx], 1
mov eax, dword [ebp - 0x10]
call fcn.004405a4
test eax, eax
jne 0x4dba98
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0xc]
cmp dword [ebx + 0x18], 0
je 0x4dbbab
lea eax, [ebp - 0x1c]
call fcn.00405e34
push eax
push 0x4dbbd8
mov eax, dword [ebp - 4]
call fcn.0045e7c4
push eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
mov ebx, eax
mov eax, ebx
call fcn.00419528
test al, al
jne 0x4dbbab
jmp 0x4dbb90
mov eax, dword [ebp - 0x10]
call fcn.004405a4
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0044082c
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0041c774
mov esi, eax
mov eax, dword [esi + 0x30]
call fcn.004d51ac
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4dbb89
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x23], 0
je 0x4dbb37
lea eax, [ebp - 0x24]
call fcn.00405e34
push eax
mov eax, dword [0x4fd08c]
push eax
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call fcn.00419528
test al, al
je 0x4dbb07
call fcn.00403bb8
jmp 0x4dbbab
lea eax, [ebp - 0x1c]
call fcn.00405e34
push eax
push 0x4dbbd8
mov eax, dword [ebp - 4]
call fcn.0045e7c4
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.00419528
test al, al
je 0x4dbb73
call fcn.00403bb8
jmp 0x4dbbab
lea eax, [ebp - 0x1c]
call fcn.00405e34
push eax
push 0
push 0x4dbbd8
lea eax, [ebp - 0x20]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.0045e7c4
push eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov ebx, eax
mov eax, ebx
call fcn.00419528
test al, al
je 0x4dbb73
call fcn.00403bb8
jmp 0x4dbbab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbb90
mov eax, dword [ebp - 0x20]
call fcn.004d515c
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004dc2ac
mov eax, dword [ebp - 4]
add eax, 0x340
mov edx, dword [ebp - 0x1c]
call fcn.00405e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbbd0
lea eax, [ebp - 0x24]
call fcn.00405e34
lea eax, [ebp - 0x1c]
call fcn.00405e34
ret
Function at 0x4dd31c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
call fcn.00405ea8
xor eax, eax
push ebp
push 0x4dd40d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edx
push 0x4208
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
push ebp
call fcn.004dd278
pop ecx
test al, al
jne 0x4dd39f
lea edx, [ebp - 0x170]
lea eax, [ebp - 0x160]
call fcn.00409698
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.0043fe4c
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp + 0xc]
call fcn.00440080
push 0x400a
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x168]
call fcn.004400d8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd414
lea eax, [ebp - 0x170]
call fcn.00404190
lea eax, [ebp - 0xc]
call fcn.00405e34
ret
Function at 0x4de350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4de48a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004d46f0
xor edi, edi
mov esi, 0x4ff354
mov ebx, esi
lea eax, [ebx + 4]
push eax
push edi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
je 0x4de3b4
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
call fcn.00404190
lea eax, [ebx + 0xc]
call fcn.00404190
lea eax, [ebx + 0x10]
call fcn.00404190
jmp 0x4de452
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, dword [ebx + 4]
call fcn.004ddee8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.004041e4
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.00408870
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x10]
call fcn.004041e4
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 4]
call fcn.004d5040
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404418
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408870
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xc]
call fcn.004041e4
cmp dword [ebx + 4], 0
je 0x4de452
mov dword [ebx], 0x20080000
mov eax, dword [ebx + 4]
call fcn.004d5140
mov dword [ebp - 8], eax
push ebx
lea eax, [ebp - 8]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
test eax, eax
je 0x4de44c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c917c]
call fcn.0040c8a4
call fcn.00403b0c
and dword [ebx], 0x20080000
inc edi
add esi, 0x14
cmp edi, 0x23
jne 0x4de37c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de491
lea eax, [ebp - 0x1c]
call fcn.0040489c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004041b4
lea eax, [ebp - 4]
call fcn.00405e34
ret

Function at 0x4f8294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f8318
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ab44
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x4f8330
call fcn.0040b790
mov eax, 0xff
call fcn.004027c4
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00409698
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x4f8344
call fcn.0040449c
mov eax, ebx
call fcn.004027e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f831f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041b4
ret
Function at 0x414831
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44eca0]
jne 0x41483b
repz ret
jmp fcn.0041a6db
Function at 0x42e3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e461
push 0x208
call main
add esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x42e461
mov edx, dword [ebp - 0x14]
push edx
call fcn.00414d88
add esp, 4
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call main
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e473
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x14]
call main
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00414d88
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42e640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0xc]
call main
lea ecx, [ebp - 0xc]
call main
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42e6f1
cmp dword [ebp + 0x18], 1
je 0x42e697
cmp dword [ebp + 0x18], 2
jne 0x42e6c1
mov edx, dword [ebp - 4]
shl edx, 1
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x42e6e7
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
call main
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x430b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x430b4f
pop dword [ebp - 0x20]
mov eax, 0x2c84a6e7
add eax, 0xd3be6468
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4e97b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x7b4c8bcc
sub ecx, 0x7b4c405b
mov edx, eax
mov esi, 0x46b200
add esi, dword [ebp - 0x20]
mov ebx, 0x90f58ae3
add ebx, 0x25f2481d
mov dword [ebp - 8], 0xce53f1af
mov edi, dword [esi]
xor dword [ebp - 0x1c], eax
sub edi, ebx
xor dword [ebp - 4], 0x1684d304
mov dword [edx], edi
add edx, 0xf2b14245
sub edx, 0xf2b14241
add esi, 0xe25bb54b
sub esi, 0xe25bb547
loop 0x430ba3
add eax, 0x12097
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x432890
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a525
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.00414840
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x432912
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x432928
cmp dword [ebp - 0x138], 6
jb 0x432928
mov dword [ebp - 0x14], 1
movzx eax, byte [0x452cb1]
test eax, eax
jne 0x4329be
cmp dword [ebp - 0x14], 0
je 0x43297b
push str.Vista_or_later
lea ecx, [ebp - 0x140]
call main
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call main
jmp 0x4329b7
push str.not_Vista_or_later
lea ecx, [ebp - 0x144]
call main
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call main
mov byte [0x452cb1], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00414831
mov esp, ebp
pop ebp
ret
Function at 0x101e3a4e
Capabilities:
Parse pe header

Disassembly:
jmp 0x102148c4
lea esp, [esp + 4]
jmp fcn.1021497b

Function at 0x101e3a75
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x102148cd
lea esp, [esp + 4]
jmp fcn.10214a00

Function at 0x101e67a0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x101e67d8
jmp 0x101e67bc
lea esp, [esp + 4]
jmp 0x101e6783
jmp 0x101e67f4
jmp 0x101e6810
push ebx
jmp 0x101e682c
jmp 0x101e6848
push ebp
jmp 0x101e6864
jmp 0x101e6880
push esi
jmp 0x101e689c
jmp 0x102199ab
push edi
movzx edx, byte [eax]
jmp 0x10219d46
shl edx, 8
jmp 0x10219dda
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
jmp 0x10219e89
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
jmp 0x10219d7e
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x101f0120]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x101f0120]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x101f0120]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x101f0120]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.10206ecb
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x101f0120]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x101f0120]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x101f0120]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x101f0120]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x101f1948
jne 0x10219f37
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101e88e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1021c33c
lea esp, [esp + 4]
jmp fcn.1021c244
Function at 0x10203537
Capabilities:
Encode data using xor

Disassembly:
push 0x207cd9
call fcn.101fad0e
stosb byte es:[edi], al
sub bh, byte [eax + 0x52cb2adf]
and al, 0xaf
mov ch, 0xa2
mov eax, 0x3bc8a939
fistp word [ebp + 0x2bc4882c]
jns 0x102035d6
sbb ah, byte [eax]
xor bh, byte fs:[ebp + 0x7d]
div byte [ecx]
shr byte [eax + 0x41101f38], cl
imul edx, edi, 0x72
add esi, dword cs:[edx + edx*8]
imul esi, dword [ecx - 0x7703efe1], 0x41
mov ch, 0x31
cmpsb byte [esi], byte es:[edi]
pushal
wait
or al, 0xbb
shr byte [ebx - 0x4f], cl
pop ds
adc ah, bh
mov byte [ecx - 0x4b], al
xor dword [esi - 0x44f364a0], esp
test eax, 0xd5f28947
dec edx
fdivr dword [edi - 0x20ba02b6]
dec edi
sub bl, cl
dec esi
inc ebx
fimul word [ebx + ebp - 0x1a]
push ecx
jns 0x1020356d
dec ecx
sub bl, bl
pop esi
int1
push edx
shl byte [edi + 0x54d6d552], 0xca
lodsd eax, dword [esi]
pop esp
mov byte [ebp + esi*8 + 0x65], dh
or al, 0xff
sbb esi, dword [ecx + 0x31c2a737]
ficomp word [ecx]
cwde
push cs
imul ebx, dword [eax + 0x23b32b7a], 0x15ab546
xchg byte [ebx + esi*2], dl
mov gs, word [esi + 0x72]
mul byte [ebx + eax - 2]
adc ch, cl
dec eax
fidivr word [ecx + 0xf83a148]
lahf
cli
or ebp, esi
in eax, 0x6e
aaa
cmpsd dword [esi], dword es:[edi]
ret 0xde31
cld
wait
jbe 0x102035ab
add cl, byte [edx + 0x418a7f18]
insb byte es:[edi], dx
jmp 0x1020365e
or al, 0x63
mov ecx, 0x2b7c8917
lea edi, cs:[ecx + 0x20]
push eax
sbb dl, byte [ebp + 0xb202032]
add dh, byte [ecx + eax*2]
inc ecx
or edi, eax
adc dword [eax], esi
invalid

Function at 0x10208206
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.101e3a4e
jmp 0x101e3a70

Function at 0x102095a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.101e8860
jmp 0x101e88df