joyce8/EMBER2024-capa huggingface dataset:
Function at 0x85805d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x85808b
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
test eax, eax
je 0x858090
cmp eax, 1
je 0x858090
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x858094
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0xa23c64]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x85810c
push ebx
call fcn.0085805d
test eax, eax
pop ecx
jne 0x8580db
call fcn.00859ddf
mov dword [eax], 0xf
call fcn.00859dd6
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0085e419
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
jmp 0x85811e
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x8580ce
inc eax
cmp eax, 0x104
ja 0x8580ce
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x858156
cmp eax, dword [ebp + 0x10]
jg 0x858139
mov eax, dword [ebp + 0x10]
push eax
call fcn.00859c55
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x85816b
call fcn.00859dd6
mov dword [eax], 0xc
jmp 0x8580ce
cmp eax, dword [ebp + 0x10]
jle 0x85816b
call fcn.00859dd6
mov dword [eax], 0x22
jmp 0x8580ce
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.0085e2f0
pop ecx
pop ecx
jmp 0x8580d0
Function at 0x859f6f
Capabilities:
Terminate process

Disassembly:
push 8
push 0x997f88
call fcn.0085e5ac
push 8
call fcn.0085e57a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0xae7a50], esi
jne 0x859fa3
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0xae7a4c], esi
mov al, byte [ebp + 0x10]
mov byte [0xae7a48], al
cmp dword [ebp + 0xc], edi
jne 0x859fed
cmp dword [0xaf1bd0], edi
je 0x859fdd
mov eax, dword [0xaf1bcc]
sub eax, 4
mov dword [0xaf1bcc], eax
cmp eax, dword [0xaf1bd0]
jb 0x859fdd
mov eax, dword [eax]
cmp eax, edi
je 0x859fbe
call eax
jmp 0x859fbe
push 0x9a2c6c
mov eax, 0x9a2c64
call fcn.00859eed
pop ecx
push 0x9a2c78
mov eax, 0x9a2c70
call fcn.00859eed
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.0085a01e
cmp dword [ebp + 0x10], edi
jne 0x85a02c
mov dword [0xae7a50], esi
push dword [ebp + 8]
call fcn.00859eab
xor edi, edi
xor esi, esi
inc esi
call fcn.0085e5e7
ret

Function at 0x85af50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x85af6d
call fcn.00859dd6
mov dword [eax], 0x16
xor eax, eax
jmp 0x85afd7
push esi
push 0x8c
push 1
call fcn.008587c7
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x85afc2
push esi
call fcn.0085c570
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x85afa0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x85aebb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
jne 0x85afd6
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00858882
test ebx, ebx
pop ecx
je 0x85afd4
push ebx
call fcn.00859de8
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x85afdb
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x998030
call fcn.0085e5ac
mov eax, dword [0xa23c64]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x85b0e8
mov eax, edi
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x85b099
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00858020
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x85b086
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x85b0e8
push edi
inc esi
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x85b0e8
mov al, byte [edi]
cmp al, 0x5c
je 0x85b0a7
cmp al, 0x2f
jne 0x85b0ac
cmp al, byte [edi + 1]
je 0x85b0e2
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.008652e0
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x85b0e8
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00859de8
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x85b104
push edi
call fcn.00858882
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.0085e419
call fcn.0085e5e7
ret

Function at 0x8614fd
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x9989c0
call fcn.0085e5ac
mov eax, dword [0xa23c64]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x8615a1
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00858020
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x86158e
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x8615a1
push edi
inc esi
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x8615bc
cmp byte [edi + 1], 0x3a
jne 0x8615bc
movzx eax, byte [edi]
push eax
call fcn.00858aed
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x8615cc
push edi
call fcn.00858882
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
call fcn.0085e419
call fcn.0085e5e7
ret
Function at 0x863737
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0xae7c20], ebx
push esi
push edi
jne 0x8637b7
push 0x998aa8
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x8637f2
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x998a9c
push edi
call esi
test eax, eax
mov dword [0xae7c20], eax
je 0x8637f2
push 0x998a8c
push edi
call esi
push 0x998a78
push edi
mov dword [0xae7c24], eax
call esi
cmp dword [0xae7a10], 2
mov dword [0xae7c28], eax
jne 0x8637b7
push 0x998a5c
push edi
call esi
test eax, eax
mov dword [0xae7c30], eax
je 0x8637b7
push 0x998a44
push edi
call esi
mov dword [0xae7c2c], eax
mov eax, dword [0xae7c2c]
test eax, eax
je 0x8637fc
call eax
test eax, eax
je 0x8637e3
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0xae7c30]
test eax, eax
je 0x8637e3
test byte [ebp - 8], 1
jne 0x8637fc
cmp dword [0xae7a1c], 4
jb 0x8637f6
or byte [ebp + 0x12], 0x20
jmp 0x86381b
xor eax, eax
jmp 0x86382b
or byte [ebp + 0x12], 4
jmp 0x86381b
mov eax, dword [0xae7c24]
test eax, eax
je 0x86381b
call eax
mov ebx, eax
test ebx, ebx
je 0x86381b
mov eax, dword [0xae7c28]
test eax, eax
je 0x86381b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0xae7c20]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x864b78
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0xa23c64]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0xa24148]
je 0x864bad
inc eax
cmp eax, 0x13
jb 0x864b9e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0xa24148]
jne 0x864cd3
mov eax, dword [0xae7a5c]
cmp eax, 1
je 0x864cab
cmp eax, edx
jne 0x864bdd
cmp dword [0xa239dc], 1
je 0x864cab
cmp ecx, 0xfc
je 0x864cd3
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x864c13
lea eax, [ebp - 0x80]
push 0x997f38
push eax
call fcn.0085e2f0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0085d760
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x864c47
mov eax, edi
push eax
call fcn.0085d760
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x997f0c
push edi
call fcn.00858900
add esp, 0x10
push edi
call fcn.0085d760
push dword [esi + 0xa2414c]
mov ebx, eax
call fcn.0085d760
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00858020
mov ebx, esp
push 0x999258
push ebx
call fcn.0085e2f0
push edi
push ebx
call fcn.0085e300
push 0x997f04
push ebx
call fcn.0085e300
push dword [esi + 0xa2414c]
push ebx
call fcn.0085e300
push 0x12010
push 0x997f10
push ebx
call fcn.00863737
add esp, 0x2c
jmp 0x864cd3
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0xa2414c]
push dword [esi]
call fcn.0085d760
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0085e419
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x86fb98
Capabilities:
Get file size

Disassembly:
push ebx
sub esp, 0x40
mov ebx, ecx
mov ecx, ebx
call fcn.0086fb64
xor eax, eax
push eax
push 0x8000080
push 3
push eax
push 1
push 0x80000000
push dword [esp + 0x60]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 0x2d4], eax
test eax, eax
je 0x86fc4f
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebx + 0x2d8], eax
lea edx, [ebx + 0x2d4]
mov eax, dword [0xa24e40]
mov dword [esp + 0x30], eax
mov eax, dword [0xa24e44]
mov dword [esp + 0x34], eax
mov eax, dword [0xa24e48]
mov dword [esp + 0x38], eax
mov eax, dword [0xa24e4c]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0xc], edx
call fcn.008701e0
test eax, eax
jne 0x86fc48
mov byte [ebx + 0x2d0], 0
add esp, 0x40
pop ebx
ret 4
mov eax, 0xffffff80
add esp, 0x40
pop ebx
ret 4

Function at 0x8700c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 8
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x8701b6
lea eax, [ebx + 0x250]
push eax
call fcn.00873ec4
lea eax, [ebx + 0x1e0]
push eax
call fcn.00873fc4
lea eax, [ebx + 0x78]
push eax
call fcn.00876024
add esp, 0xc
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x870156
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x870156
mov edx, 0
jle 0x8701c8
lea ecx, [edx + edx]
add ecx, ecx
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea esi, [edx + edx]
add esi, esi
add esi, esi
add esi, esi
mov dword [esp + 4], edi
mov edi, edx
mov dword [esp], ebp
mov ebp, ecx
jmp 0x870132
mov eax, dword [ebx + 0x48]
add eax, ebp
push eax
call fcn.00876cd8
mov eax, esi
add eax, dword [ebx + 0x4c]
push eax
call fcn.00876c4c
add esp, 8
add ebp, 0x20
add esi, 0x10
inc edi
cmp edi, dword [ebx + 0x34]
jl 0x87012f
jmp 0x8701be
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x870164
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x870172
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x870180
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x87018e
push eax
call fcn.00858882
pop ecx
lea eax, [ebx + 0x18]
push eax
call fcn.008760d4
pop ecx
mov eax, dword [ebx]
test eax, eax
je 0x8701a6
push eax
call dword [ebx + 0x2c8]
pop ecx
push 0x2d0
push 0
push ebx
call fcn.0086b688
add esp, 0xc
xor eax, eax
add esp, 8
pop ebx
pop esi
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp]
mov eax, dword [ebx + 0x48]
push eax
call fcn.00858882
push dword [ebx + 0x4c]
call fcn.00858882
add esp, 8
jmp 0x870156
Function at 0x89f22c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x89f24d
mov eax, 0x8876086c
jmp 0x89f32f
cmp dword [ebp + 0x7c], esi
je 0x89f2c7
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x89f2a7
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.00858020
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x89f2c7
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileW]
jmp 0x89f2e0
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x89f320
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x89f320
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x89f320
push esi
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x89f32d
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x89f32f
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x89f388
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x99bd88
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x89f3e0
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x89f3e0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x89f3e0
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x89f409
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x99bd88
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x89f477
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x99bda4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x89f46e
cmp dword [ebp - 0xc], 4
jne 0x89f46e
cmp dword [ebp - 0x10], edi
je 0x89f46e
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [0xa347c8], edi
xor eax, eax
jmp 0x89f49f
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [0xa347c8], edi
jge 0x89f49a
mov dword [0xa347c8], edi
call fcn.0089f3e4
test eax, eax
je 0x89f49a
emms
mov dword [0xa347c8], 1
mov eax, dword [0xa347c8]
pop edi
leave
ret

Function at 0x89f57f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x89f5b6
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x89f5d8
cmp dword [ebp - 0x20], 4
ja 0x89f5e2
jne 0x89f5d2
cmp dword [ebp - 0x1c], 0xa
jb 0x89f5d2
cmp word [ebp - 0x18], 0x55d
jae 0x89f5e2
mov byte [ebp + 0x73], 1
jmp 0x89f5e2
cmp dword [ebp - 0x14], 2
jne 0x89f5f8
test bl, bl
je 0x89f613
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x89f603
dec eax
je 0x89f5fc
sub eax, 3
jne 0x89f5f8
cmp byte [ebp + 0x73], 0
je 0x89f624
xor eax, eax
jmp 0x89f62c
call fcn.0089f4a2
jmp 0x89f62c
cmp byte [ebp + 0x73], 0
jne 0x89f5f8
call fcn.0089f4da
and eax, 4
jmp 0x89f62c
cmp dword [ebp + 0x7c], 0xa
je 0x89f624
push dword [ebp + 0x7c]
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
jmp 0x89f62c
call fcn.0089f4da
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x8a254a
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x8a2577
push esi
call fcn.008aa340
cmp byte [esi + 0x40], 0
pop ecx
je 0x8a2570
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x8a25e6
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x8a25db
mov eax, dword [esi + 8]
test eax, eax
je 0x8a2598
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x8a25d7
cmp eax, 2
je 0x8a25db
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x8a258d
cmp eax, 3
je 0x8a25bc
cmp eax, 1
jne 0x8a258d
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x8a258d
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x8a258d
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x8a2604
cmp eax, 0xcc
je 0x8a2604
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.008a241d
pop esi
ret

Function at 0x8abc4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x8abc58
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x8abd2c
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x99e530]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x99e530]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x99e530]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x99e530]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x99e530]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x99e530]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x99e530]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x99e530]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x8abc75
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x8abd4c
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x99e530]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x8abd32
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x8c1040
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xa37c64
call fcn.008c94e0
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
jne 0x8c110a
push esi
push 0xa37c58
call fcn.008c94e0
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.advapi32.dll_RegDeleteValueA]
add esp, 4
push eax
push ecx
call esi
push 0xa37c4c
call fcn.008c94e0
mov edx, dword [esp + 8]
add esp, 4
push eax
push edx
call esi
push 0xa37c40
call fcn.008c94e0
add esp, 4
push eax
mov eax, dword [esp + 8]
push eax
call esi
push 0xa37c34
call fcn.008c94e0
mov ecx, dword [esp + 8]
add esp, 4
push eax
push ecx
call esi
push 0xa37c28
call fcn.008c94e0
mov edx, dword [esp + 8]
add esp, 4
push eax
push edx
call esi
push 0xa37c18
call fcn.008c94e0
add esp, 4
push eax
mov eax, dword [esp + 8]
push eax
call esi
push 0xa37c08
call fcn.008c94e0
mov ecx, dword [esp + 8]
add esp, 4
push eax
push ecx
call esi
pop esi
mov edx, dword [esp]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ecx
ret
Function at 0x8c1120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
xor ebx, ebx
mov esi, 4
push eax
mov ebp, ecx
push 0xa37c64
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call fcn.008c94e0
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
jne 0x8c123c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push 0xa37d14
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call fcn.008c94e0
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
add esp, 4
push eax
push ecx
call edi
test eax, eax
jne 0x8c123c
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
push 0xa37d08
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call fcn.008c94e0
mov edx, dword [esp + 0x2c]
add esp, 4
push eax
push edx
call edi
test eax, eax
jne 0x8c123c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push 0xa37cfc
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call fcn.008c94e0
add esp, 4
push eax
mov eax, dword [esp + 0x2c]
push eax
call edi
test eax, eax
jne 0x8c123c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push 0xa37cf0
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call fcn.008c94e0
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
lea esi, [ebp + 0x24]
push eax
push 0xa37cdc
call fcn.008c94e0
add esp, 4
push eax
push esi
call fcn.008c3720
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push 0xa37cc8
call fcn.008c94e0
add esp, 4
push eax
push esi
call fcn.008c3720
mov edx, dword [esp + 0x30]
add esp, 0xc
push edx
push 0xa37cb4
call fcn.008c94e0
add esp, 4
push eax
push esi
call fcn.008c3720
mov eax, dword [esp + 0x34]
add esp, 0xc
push eax
push 0xa37ca0
call fcn.008c94e0
add esp, 4
push eax
push esi
call fcn.008c3720
mov eax, dword [esp + 0x28]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret