joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402618
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x402618
lcall 0x5de5, 0x8b10c483
jmp fcn.014074e0

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x44
mov eax, 0x401023
mov ecx, 0
mov bl, byte [eax]
add bl, 0x38
mov byte [eax], bl
add eax, 1
add ecx, 1
cmp ecx, 0xd137
jne 0x40100e
or al, 0xc8
or eax, ecx
or eax, 0x52c8c8c8
loopne 0x401078
mov edx, dword [0x894be050]
leave
dec ebx
mov cl, cl
dec ecx
rol edi, 0xef
enter 0x3dc8, 0xffffffffffffffb3
or al, 0xd8
or al, cl
or dword [ebx + 0x518b8b8b], 0xffffffe0
sbb byte [ebp + 0x4bc808a2], 0x88
enter 0xffffffffffff8c4b, 0xc
invalid
not dword [ecx - 0x74de3738]
and dword [eax - 0x4e37f611], 0xc8c86da6
mov al, 0xcd
enter 0xffffffffffffc8c8, 0xffffffffffffffb1
ror al, cl
enter 0xffffffffffff81c8, 0xffffffffffffffd0
invalid
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401bd7
pop dword [ebp - 0x10]
mov eax, 0x3708c3dc
sub eax, 0x36c8a805
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7821daef
sub dword [ebp - 0x20], 0x29cf95a4
mov dword [ebp - 0x1c], 0x77ecfe93
add dword [ebp - 0x1c], 0xba464db2
mov dword [ebp - 0x18], 0x983f95cf
add dword [ebp - 0x18], 0xb40cae5f
mov dword [ebp - 0x14], 0xfd03ceaf
sub dword [ebp - 0x14], 0xfd03ceaf
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x3c79e625
sub dword [ebp - 0x20], 0xc8077ccf
mov dword [ebp - 0x1c], 0x59ba3fc4
sub dword [ebp - 0x1c], 0x184dde4f
mov dword [ebp - 0x18], 0x99044ec1
add dword [ebp - 0x18], 0xca6b1dab
mov dword [ebp - 0x14], 0xdfffe8f3
sub dword [ebp - 0x14], 0xdfffe8f3
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xe978b53c
sub eax, 0xe938443c
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3993f
push 0
call eax
mov ecx, 0xb9f20b66
sub ecx, 0xb9f1b763
xor esi, esi
add esi, eax
mov edx, 0xe7895a4e
add edx, 0x18b7a5b2
add edx, dword [ebp - 0x10]
mov ebx, 0x65181526
add ebx, 0xe6c24952
xor dword [ebp - 0xc], 0x87b05061
mov edi, dword [edx]
add dword [ebp - 0xc], edi
add edi, ebx
xor dword [ebp - 4], ebx
mov dword [esi], edi
xor dword [ebp - 4], edx
add esi, 0x321d2f00
add esi, 0xcde2d104
add edx, 4
loop 0x401cf6
add eax, 0xf3121fef
add eax, 0xcef22f0
mov ebx, eax
add eax, 0x11cc0723
add eax, 0xee33f8e2
mov ecx, 0xf076a6b6
sub ecx, 0xf036a6b6
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1001204a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10012059
pop dword [ebp - 8]
mov eax, 0x789173cc
sub eax, 0x68905373
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3921c
push 0
mov eax, 0x10f376b1
sub eax, 0xf0e5a5
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x1799de90
sub ecx, 0x17999c8f
mov edx, eax
mov ebx, 0x10046c00
add ebx, dword [ebp - 8]
mov esi, 0x6b697c52
add esi, 0x2251e6b9
add dword [ebp - 4], 0x69b42e2f
mov edi, dword [ebx]
xor dword [ebp - 4], 0x64ec9e71
add edi, esi
sub dword [ebp - 4], 0x567d8c28
mov dword [edx], edi
add edx, 0xd4e4294
sub edx, 0xd4e4290
add ebx, 0xfd967e95
sub ebx, 0xfd967e91
loop 0x100120b2
add eax, 0xfad7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2ae9e7ee
sub ecx, 0x1ae9e7ee
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x405a12
pop dword [ebp - 8]
mov eax, 0x8183e750
sub eax, 0x81438d3e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xcdd2122
sub dword [ebp - 0x18], 0xbe8adbd7
mov dword [ebp - 0x14], 0x5552ba78
sub dword [ebp - 0x14], 0x231f6e33
mov dword [ebp - 0x10], 0x42baeb07
add dword [ebp - 0x10], 0x9915927
mov dword [ebp - 0xc], 0x4445dc49
sub dword [ebp - 0xc], 0x4445dc49
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1f008901
add dword [ebp - 0x18], 0x5571e055
mov dword [ebp - 0x14], 0xa9742e54
add dword [ebp - 0x14], 0x97f83321
mov dword [ebp - 0x10], 0x702c6cd8
add dword [ebp - 0x10], 0xf342ff94
mov dword [ebp - 0xc], 0x7bcef313
sub dword [ebp - 0xc], 0x7bcef313
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xbfb344df
sub eax, 0xbf72c3df
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35360
push 0
call eax
mov ecx, 0x40ec
mov edi, eax
mov ebx, 0x24451813
add ebx, 0xdc01cbed
add ebx, dword [ebp - 8]
mov esi, 0x5015f321
add esi, 0xec801d1c
xor dword [ebp - 4], esi
mov edx, dword [ebx]
xor dword [ebp - 4], ebx
add edx, esi
xor dword [ebp - 4], ecx
mov dword [edi], edx
sub dword [ebp - 4], eax
add edi, 0xb4643aab
sub edi, 0xb4643aa7
add ebx, 4
loop 0x405b29
add eax, 0xf683
mov ebx, eax
add eax, 0xf896227e
sub eax, 0xf8962279
mov ecx, 0x2b776c3c
sub ecx, 0x2b376c3c
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x401999
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4019d8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4019d8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019d8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4019d8
cmp dword [ecx + 0x74], 0xe
jbe 0x4019d8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407b76
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415610
push 0x415608
push str.FlsAlloc
push 0x1f
call fcn.00407a35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407baa
push dword [ebp + 8]
mov ecx, esi
call dword [0x414114]
call esi
jmp 0x407bb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407bf4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415620
push 0x415618
push str.FlsGetValue
push 0x21
call fcn.00407a35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407c2b
push dword [ebp + 8]
mov ecx, esi
call dword [0x414114]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407c33
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415628
push 0x415620
push str.FlsSetValue
push 0x22
call fcn.00407a35
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407c6d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414114]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b1b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b255
push ebx
push esi
call fcn.0040b181
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b115
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b202
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b254
push edi
push eax
call fcn.00408325
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b222
call fcn.004078c8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b253
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b115
add esp, 0x20
test eax, eax
jne 0x40b241
push edi
call fcn.004078c8
jmp 0x40b249
push ebx
call fcn.004078c8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10013da0
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10013da0
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10013da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10013daf
pop dword [ebp - 0x50]
mov eax, 0x10013daf
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x24d4ad8e
add dword [ebp - 0x60], 0x297d97bd
mov dword [ebp - 0x5c], 0xc5078993
sub dword [ebp - 0x5c], 0x92d43d4e
mov dword [ebp - 0x58], 0xcdb8fa81
add dword [ebp - 0x58], 0x7e9349ad
mov dword [ebp - 0x54], 0x4070f597
add dword [ebp - 0x54], 0xbf8f0a69
lea eax, [ebp - 0x60]
push eax
mov eax, 0x7153b2ac
add eax, 0x9eaebee0
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x930fb874
sub dword [ebp - 0x60], 0x1e9d4f1e
mov dword [ebp - 0x5c], 0xe6876777
add dword [ebp - 0x5c], 0x5ae4f9fe
mov dword [ebp - 0x58], 0x7346ed41
add dword [ebp - 0x58], 0xf0287f2b
mov dword [ebp - 0x54], 0x52bbd2e4
add dword [ebp - 0x54], 0xad442d1c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x414b0
push 0
call eax
mov ecx, 0x4a98
xor edi, edi
add edi, eax
mov ebx, 0x3a3a9f18
add ebx, 0xd5c8f8e8
add ebx, dword [ebp - 0x50]
mov edx, 0xa0a3bed3
add dword [ebp - 0x28], ebx
mov esi, dword [ebx]
xor dword [ebp - 0x40], 0xb8f7344
xor esi, edx
xor dword [ebp - 0x28], edx
mov dword [edi], esi
mov dword [ebp - 0x34], 0x1c01f1
add edi, 0x17ddd79b
sub edi, 0x17ddd797
add ebx, 0xd31f9b32
sub ebx, 0xd31f9b2e
loop 0x10013ebd
add eax, 0xbf44b448
add eax, 0x40bc68eb
mov ebx, eax
add eax, 5
mov ecx, 0xe599e8d2
sub ecx, 0xd599e8d2
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1001cacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10025ac4
call fcn.100233e2
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
mov eax, edi
call fcn.10013da0
pop ecx
test eax, eax
jne 0x1001cba6
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
inc dword [eax + 0x38]
mov dword [ebp - 0x58], edi
inc dword [edi + 0x14]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x54], eax
xor eax, eax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x3c], ax
push 4
add edi, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], edi
pop edi
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x52535048
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], ebx
call fcn.10013da0
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 8
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x20], 0x55524544
call fcn.10013da0
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1001bc6e
mov eax, esi
call fcn.10023465
ret
Function at 0x1001e1a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10025ae9
call fcn.100233ac
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
call edi
test eax, eax
jne 0x1001e2e2
cmp dword [ebp - 0x1c], 1
jne 0x1001e2e2
mov eax, dword [ebp - 0x14]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10013da0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001e2d4
push dword [ebp - 0x14]
push esi
push eax
call fcn.10013da0
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10013da0
pop ecx
mov dword [ebx], eax
cmp eax, esi
je 0x1001e2d4
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push esi
push eax
call fcn.10013da0
lea eax, [ebp - 0x20]
push eax
push 0x1002ac24
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, esi
je 0x1001e2ba
push edi
call fcn.10013da0
pop ecx
test al, al
je 0x1001e2ba
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [ebx]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e2d4
push dword [ebx]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], esi
jmp 0x1001e2d4
cmp dword [ebp - 0x18], esi
je 0x1001e2e2
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023451
ret
Function at 0x1001e2e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x10025b04
call fcn.10023418
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push 0x80000002
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e531
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x1001e402
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x1001e3e2
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x1001e3e2
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e3e4
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x1001e39a
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x1001e531
mov ebx, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call ebx
mov edi, str.SoftwareMicrosoftSoftGrid_
push edi
mov dword [ebp - 0x430], eax
call ebx
mov ecx, dword [ebp - 0x430]
lea ebx, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.10013da0
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1001e531
push ebx
push esi
push eax
call fcn.10013da0
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call edi
push str.ClientUserInterface
push ebx
push dword [ebp - 0x428]
call edi
add esp, 0x30
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e525
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x43c]
push 0x1002ac28
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023474
ret