joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b409
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b4f6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002b4d8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1002b4d6
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002b49e
mov ecx, dword [ebp - 8]
call fcn.10039c1f
movzx eax, al
test eax, eax
jne 0x1002b4d6
push dword [ebp - 4]
push 1
push 0x2150
push 0x1fc6
push dword [ebp - 8]
push 1
push dword [ebp - 0x34]
call fcn.1002945b
add esp, 0x1c
push 0x4aa0
push 1
push dword [ebp - 0xc]
push 0x5444
push 0
call fcn.100296c9
add esp, 0x14
jmp 0x1002b4f4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002b4f4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1002b508
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x44]
call fcn.10028a32
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1002d444
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002d4b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002d4ac
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.10039be1
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002d4b6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1002d4cc
push 0x2f3e
push 0x3f70
push 0
call fcn.10028dad
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x710c6f
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
mov ecx, ebx
call fcn.00710ca6
dec ebx
and ecx, ebx
xor dword [edx], edi
sub ebx, ecx
add ebx, 1
and ecx, ebx
add edx, 1
sub ebx, ecx
cmp edx, eax
jne fcn.00710c6f
add ecx, ebx
add ebx, ecx
sub ecx, 0xa78477e3
ret
Function at 0x4062f1
Capabilities:
Access the windows event log

Disassembly:
push 0x30
mov eax, 0x42aec1
call fcn.00407223
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], 0xf
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
mov dword [ebp - 4], ebx
cmovae ecx, dword [ebp + 8]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea edi, [ecx + eax*2]
mov dword [ebp - 0x14], ebx
mov eax, edi
mov dword [ebp - 0x34], ebx
sub eax, esi
mov dword [ebp - 0x24], ebx
sar eax, 1
lea ecx, [ebp - 0x34]
push eax
call fcn.00405872
mov byte [ebp - 0x38], bl
lea ecx, [ebp - 0x34]
push dword [ebp - 0x38]
push edi
push esi
call fcn.00401f2e
push str.MsiInstaller
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x40639c
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
push 3
push ebx
push 0x2dbc
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], str.Trellix_Agent_installation_failed_because_it_detected_the_following_products_as_incompatible_with_this_version_:__2___3
cmovae ecx, dword [ebp - 0x34]
push 1
push esi
mov dword [ebp - 0x18], str.MAR_____1000
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x4063d3
mov ecx, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
cmp eax, 0x1000
jb 0x4063ca
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004037ee
mov eax, dword [ebp - 0x3c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.004071a2
pop ecx
pop ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
call fcn.004046d1
call fcn.004071d2
ret

Function at 0x41e7a0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e616

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3b15c5b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x9fa2a1e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov esi, dword [edi]
lea eax, [esi*4]
test eax, eax
je 0x1000239c
mov ebx, dword [ebp + 8]
sub ebx, ecx
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
inc edx
mov esi, dword [edi]
lea eax, [esi*4]
cmp edx, eax
jb 0x10002382
mov ecx, dword [ebp - 0x10]
lea edi, [esi*4]
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 4]
inc eax
shl eax, 4
cmp edi, eax
jae 0x100024e5
lea eax, [edi - 3]
add eax, ecx
mov bh, byte [eax]
nop dword [eax]
mov cl, byte [eax + 1]
xor edx, edx
mov ch, byte [eax + 2]
mov bl, byte [eax - 1]
mov dword [ebp - 0x1c], eax
mov eax, edi
shr eax, 2
div dword [esi]
mov byte [ebp - 8], bl
mov eax, edx
mov byte [ebp - 7], bh
mov byte [ebp - 0xa], cl
mov byte [ebp - 6], cl
mov byte [ebp - 9], ch
mov byte [ebp - 5], ch
test eax, eax
jne 0x10002447
lea eax, [ebp - 8]
mov byte [ebp - 8], bh
push eax
mov byte [ebp - 7], cl
mov byte [ebp - 6], ch
mov byte [ebp - 5], bl
call fcn.100022c0
mov eax, dword [esi]
xor edx, edx
mov cl, 1
lea esi, [eax*4]
mov eax, edi
div esi
mov esi, eax
sub esi, 1
je 0x10002434
nop word [eax + eax]
mov dl, cl
add cl, cl
shr dl, 7
movzx eax, dl
imul eax, eax, 0x1b
xor cl, al
sub esi, 1
jne 0x10002420
mov bl, byte [ebp - 8]
mov dh, byte [ebp - 5]
xor bl, cl
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov esi, dword [ebp - 0x18]
jmp 0x10002470
mov edx, dword [esi]
cmp edx, 6
jbe 0x1000246a
cmp eax, 4
jne 0x1000246a
lea eax, [ebp - 8]
push eax
call fcn.100022c0
mov dh, byte [ebp - 5]
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov bl, byte [ebp - 8]
jmp 0x10002470
mov dh, byte [ebp - 9]
mov dl, byte [ebp - 0xa]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x10]
shl eax, 2
sub ecx, eax
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 0x1c]
xor al, bl
mov byte [ecx + 3], al
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
shl ecx, 2
sub eax, ecx
mov al, byte [eax + edi + 1]
xor al, bh
mov ebx, dword [ebp - 0x1c]
mov byte [ebx + 4], al
lea ecx, [ebx + 4]
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi]
shl ecx, 2
sub eax, ecx
movzx eax, byte [eax + edi + 2]
xor al, dl
mov byte [ebx + 5], al
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
shl ecx, 2
sub eax, ecx
movzx eax, byte [eax + edi + 3]
add edi, 4
xor al, dh
mov byte [ebx + 6], al
mov eax, dword [esi + 4]
mov bh, byte [ebp - 9]
inc eax
shl eax, 4
cmp edi, eax
mov eax, dword [ebp - 0x14]
jb 0x100023c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101786e5
mov esp, ebp
pop ebp
ret 8
Function at 0x10004250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10004279
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000428f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10004286
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x100042c2
nop
cmp esi, ecx
jae 0x10004286
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x100042b0
cmp esi, ecx
jae 0x10004286
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.10036aa3
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x10004468
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10004468
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100043bd
xor esi, esi
jmp 0x10004402
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10004402
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x100043f2
nop
cmp esi, ecx
jae 0x100043f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x100043e0
cmp esi, ecx
jb 0x100043fa
xor esi, esi
jmp 0x10004402
xor eax, eax
cmp word [esi], ax
cmove esi, eax
test esi, esi
je 0x10004468
mov eax, dword [ebx]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10004424
push edi
mov ecx, ebx
call fcn.10004ab0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.10184e02
add esp, 0x10
cmp eax, 0x50
ja case.0x10004443.1
movzx eax, byte [eax + 0x10004498]
jmp dword [eax*4 + 0x10004488]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10004478
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100314e8
push 0x80070057
call fcn.10004d60
call fcn.100314ce
nop
dec edx
inc esp
add byte [eax], dl
jae 0x100044d2
add byte [eax], dl
add byte [eax + eax + 0x10], 0x82
inc esp
add byte [eax], dl
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3

Function at 0x10004f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10035d3d
Function at 0x100137f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a617d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
cmp dword [edx + 0x14], 0xf
jbe 0x1001382b
mov edx, dword [edx]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x10013866
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
jne 0x1001387f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x10013962
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor edi, edi
movq qword [ebp - 0x20], xmm0
xor ebx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x100138b5
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.100157f0
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x24]
test eax, eax
jne 0x10013913
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test edi, edi
je 0x10013962
sub ebx, edi
mov eax, edi
cmp ebx, 0x1000
jb 0x10013907
mov edi, dword [eax - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10013980
push ebx
push edi
call fcn.10178716
add esp, 8
jmp 0x10013962
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
je 0x10013957
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test edi, edi
je 0x10013962
sub ebx, edi
mov eax, edi
cmp ebx, 0x1000
jb 0x10013907
mov edi, dword [eax - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10013980
jmp 0x10013907
mov eax, dword [ebp - 0x1c]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101786e5
mov esp, ebp
pop ebp
ret
call fcn.1018001f
int3
Function at 0x10022160
Capabilities:
Terminate process

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x1002a030
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.10179380
mov eax, dword [0x10216040]
xor eax, esp
mov dword [esp + 0x1390], eax
push esi
call fcn.1017bb13
mov dword [esp + 0x138c], 0xffffffff
mov ecx, 1
mov dword [esp + 0xc], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [esp + ecx*4 + 0xc], eax
inc ecx
cmp ecx, 0x270
jb 0x1002a068
lea ecx, [esp + 8]
mov dword [esp + 8], 0x270
call fcn.1002a7d0
mov esi, 0x1389
mul esi
cmp eax, esi
jae 0x1002a0b9
cmp eax, 0xd93
jae 0x1002a0b9
lea ecx, [esp + 8]
call fcn.1002a7d0
mul esi
cmp eax, 0xd93
jb 0x1002a0a7
mov ecx, dword [esp + 0x1394]
lea eax, [edx - 0x7fffc568]
pop esi
xor ecx, esp
xor eax, 0x80000000
call fcn.101786e5
mov esp, ebp
pop ebp
ret 8

Function at 0x1002a7d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1002a82d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1002a7f0
mov eax, dword [esi]
jmp 0x1002a90b
cmp eax, 0x4e0
jb 0x1002a90b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x1002a846
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x1002a891
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002d83b
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x101a80ba
call fcn.101791fb
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1002ab33
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x1002d89d
call fcn.1002ca12
cmp eax, 1
jne 0x1002d89d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1002cb51
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1002afeb
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.10004d90
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x1002d8af
call fcn.1002dc30
jmp 0x1002d8b5
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.10004d90
mov eax, esi
call fcn.101791c9
ret 0xc

Function at 0x1002d966
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x101a80ba
call fcn.101791fb
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1002ab33
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x1002d9c4
call fcn.1002ca12
cmp eax, 1
jne 0x1002d9c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1002cb51
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1002afeb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10004d90
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.10004d90
mov eax, esi
call fcn.101791c9
ret 0x10

Function at 0x1002d9eb
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x101a80ba
call fcn.101791fb
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1002ab33
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x1002da49
call fcn.1002ca12
cmp eax, 1
jne 0x1002da49
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1002cb51
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1002afeb
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10004d90
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.10004d90
mov eax, esi
call fcn.101791c9
ret 0x14
Function at 0x1002fa4e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x101a8206
call fcn.101791fb
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1002faf6
push dword [ebp + 8]
call fcn.1002fd6d
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1002fb7c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x1002fadf
push ecx
call fcn.1002aa7a
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002fadf
xor edi, edi
inc edi
jmp 0x1002fae9
push dword [ebx]
call fcn.1002aa83
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1002da73
jmp 0x1002fb7a
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x101b8a64]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x1002fb72
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.1002aa7a
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x1002fb6c
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.1002f90b
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.1002f90b
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x1002fb3a
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.10004d90
mov eax, edi
call fcn.101791c9
ret 0x10

Function at 0x1002fb84
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1002fbd7
push esi
push dword [ebp + 8]
call fcn.1002fd6d
mov edi, eax
test edi, edi
je 0x1002fbd2
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1002fbd2
mov eax, dword [ebp - 8]
jmp 0x1002fbe9
mov eax, dword [ebp + 0x10]
jmp 0x1002fbe9
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc