joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421008]
jne 0x40100a
repz ret
jmp fcn.00401910

Function at 0x4050fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004038b7
and dword [ebp - 4], 0
cmp dword [0x422d70], 0
mov ebx, eax
jne 0x4051ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40525c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40525c
push eax
call fcn.00403845
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x422d70], eax
call esi
push eax
call fcn.00403845
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422d74], eax
call esi
push eax
call fcn.00403845
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x422d78], eax
call esi
push eax
call fcn.00403845
pop ecx
mov dword [0x422d80], eax
test eax, eax
je 0x4051ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403845
pop ecx
mov dword [0x422d7c], eax
mov eax, dword [0x422d7c]
cmp eax, ebx
je 0x405203
cmp dword [0x422d80], ebx
je 0x405203
push eax
call fcn.004038c0
push dword [0x422d80]
mov esi, eax
call fcn.004038c0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405203
test edi, edi
je 0x405203
call esi
test eax, eax
je 0x4051fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4051fa
test byte [ebp - 0xc], 1
jne 0x405203
or dword [ebp + 0x10], 0x200000
jmp 0x40523c
mov eax, dword [0x422d74]
cmp eax, ebx
je 0x40523c
push eax
call fcn.004038c0
pop ecx
test eax, eax
je 0x40523c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40523c
mov eax, dword [0x422d78]
cmp eax, ebx
je 0x40523c
push eax
call fcn.004038c0
pop ecx
test eax, eax
je 0x40523c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x422d70]
call fcn.004038c0
pop ecx
test eax, eax
je 0x40525c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40525e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d3d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x2a5d99c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x2a5d7e0], eax
jne 0x41d411
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401000
add esp, 0x404
ret
Function at 0x41d440
Capabilities:
Get hostname

Disassembly:
sub esp, 0x818
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [esp + 0x81c]
push edi
xor edi, edi
cmp dword [esp + 0x824], edi
mov dword [esp + 0xc], eax
jle 0x41d530
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push esi
lea esp, [esp]
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 5
mov dword [esp + 0x1c], 0
call fcn.0041d430
mov eax, dword [esp + 0x1c]
add eax, 0x46
mov dword [esp + 0x14], eax
nop
sub dword [esp + 0x14], 0x46
mov ecx, dword [esp + 0x18]
movsx edx, byte [ecx + edi]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov esi, dword [esp + 0x830]
mov al, byte [esp + 0x10]
mov byte [ecx + edi], al
cmp esi, 0xf
jne 0x41d524
push 0
push 0
call ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.razigo
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push 0
lea eax, [esp + 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push str.gecucufemesixihor
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
inc edi
cmp edi, esi
jl 0x41d480
pop esi
pop ebp
pop ebx
cmp dword [esp + 0x824], 0x2d
pop edi
jne 0x41d54f
mov dword [0x2a5dad0], 0xa62e7790
mov dword [0x2a5dad4], 0xffffffff
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00401000
add esp, 0x818
ret

Function at 0x41d570
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x421fe0]
push esi
mov esi, dword [0x2a5d99c]
push edi
mov edi, dword [0x2a5d7e4]
push eax
call fcn.0041d3d0
add esp, 4
cmp dword [0x2a5d99c], 0x2f
jne 0x41d5af
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
call fcn.0041d440
add esp, 8
cmp dword [0x2a5d99c], 0x568
pop edi
pop esi
jne 0x41d5e8
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7aeb7649
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1fa66605
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x402a0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402aa4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402a84
xor eax, eax
push ebp
push 0x402a7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ac0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402a84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40310c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x427034], 0
je 0x40316d
cmp word [0x427208], 0xd7b2
jne 0x403135
cmp dword [0x427210], 0
jbe 0x403135
mov eax, 0x427204
call dword [0x427220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403194
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x403189
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403420
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403486
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403310
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402900
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403470
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40348d
lea eax, [ebp - 0x10]
call fcn.00403290
ret
Function at 0xd38058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d381a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd3807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3806a
add dl, dl
jne 0xd38089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd380dc
xor eax, eax
add dl, dl
jne 0xd38096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3817d
add dl, dl
jne 0xd380a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd380b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd380bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd380c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd380d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd38075
mov eax, 1
add dl, dl
jne 0xd380ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd380f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd380e1
sub eax, ebx
mov ebx, 1
jne 0xd38128
mov ecx, 1
add dl, dl
jne 0xd3810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd38119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd38105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd38075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd3813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd38136
cmp eax, 0x7d00
jae 0xd3816d
cmp eax, 0x500
jb 0xd38168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd38075
cmp eax, 0x7f
ja 0xd38170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd38075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd3819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd38075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x40893c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
or esi, edx
add edx, edx
call fcn.00408959
xor dword [ebx], ecx
add ebx, 1
and esi, esi
cmp ebx, edi
jne fcn.0040893c
ret
Function at 0x1000ea17
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064e46
call fcn.10064598
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x1c], 0x48e9
cmp dword [ebp - 0x1c], 0x49bb
push edi
mov dword [ebp - 0x10], esp
jle 0x1000ea87
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], 0x2801
mov dword [ebp - 0x14], ecx
mov eax, edi
shl eax, cl
mov ecx, 0x106551f8
xor eax, esi
cdq
push edx
push eax
call fcn.1000ecdf
mov ecx, dword [ebp - 0x14]
add ecx, ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x1000ea4c
inc ebx
cmp ebx, 0x548d
jl 0x1000ea40
inc edi
cmp edi, 0x3ca4
jl 0x1000ea3e
inc esi
cmp esi, 0x1772
jl 0x1000ea3c
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4797
jge 0x1000eaa3
mov edx, 0x10007974
mov ecx, 0x106551f8
call fcn.1000cea1
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b879
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001b8b0
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001b8a6
push 0
push 0x1eff
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x1001b8ae
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001b8b8
push 0
call fcn.10014ea5
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001ba26
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x3c]
test eax, eax
je 0x1001bab1
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x6f5e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.1001bad7
add esp, 0x38
jmp 0x1001bad3
lea eax, [ebp + 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001bacb
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1001bad3
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret
Function at 0x1001cf56
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001cf90
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x813
call fcn.1001d005
add esp, 0x14
jmp 0x1001d001
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001cfb6
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1001d001
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001cfe4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001d001
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10009a26
mov dword [eax], 0xa4bedcc5
jmp 0x1001cfd9
mov esp, ebp
pop ebp
ret
Function at 0x1001f2dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f30d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 0x7ec
push dword [ebp - 8]
push 1
call fcn.1001f35b
add esp, 0x10
jmp 0x1001f357
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001f335
push 0x2334
push 0x27f
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x1001f357
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001f357
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov esp, ebp
pop ebp
ret
Function at 0x1001f8ab
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065336
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001f9d7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001f9cd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10009a26
mov dword [eax], 9
jmp 0x1001f934
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10009a26
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10009a26
cmp dword [eax], 0xffffffe4
je 0x1001f9cb
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x18], 0x11
jmp 0x1001f96c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jl 0x1001f9c6
push 2
lea ecx, [ebp - 0x60]
call fcn.100099bf
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 0x58a835a2
mov dword [ebp - 0x1c], 0
jmp 0x1001f997
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1001f9ad
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
call fcn.10009a26
or dword [eax], 0xffffffff
jmp 0x1001f990
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10009a21
jmp 0x1001f965
jmp 0x1001f91c
jmp 0x1001f9d5
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001fa56
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001fa42
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001fa0f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xffffffe9
je 0x1001fa40
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1001fa34
push 0
push 0
push 0x1c87
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x1001fa3e
jmp 0x1001fa40
jmp 0x1001fa04
jmp 0x1001fa56
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x1001fa56
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002a854
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002a94e
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002a892
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1002a94c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x1002a8f3
push 1
mov ecx, dword [ebp - 4]
call fcn.10009a26
cmp dword [eax], 1
jg 0x1002a8ca
mov dword [ebp - 0xc], 1
jmp 0x1002a8ce
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
push 1
mov ecx, dword [ebp - 4]
call fcn.10009a26
mov ecx, dword [ebp - 0xc]
imul ecx, dword [eax]
imul esi, ecx
test esi, esi
je 0x1002a8f3
mov dword [ebp - 0x10], 1
jmp 0x1002a8f7
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x10]
cmp eax, 4
jne 0x1002a90e
mov dword [ebp - 0x14], 1
jmp 0x1002a912
and dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.10009a26
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
jne 0x1002a92c
mov dword [ebp - 0x18], 1
jmp 0x1002a930
and dword [ebp - 0x18], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.10009a26
mov esi, dword [eax]
imul esi, dword [ebp - 0x18]
push 0
mov ecx, dword [ebp - 4]
call fcn.10009a26
mov dword [eax], esi
jmp 0x1002a96f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x1307
push 1
call fcn.10014cc9
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002aa07
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065604
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002ab0d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002aac0
push 2
lea ecx, [ebp - 0x4c]
call fcn.100099bf
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xdf1febae
mov dword [ebp - 0x18], 0
jmp 0x1002aa6f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002aa88
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4c]
call fcn.10009a26
mov dword [eax], 7
jmp 0x1002aa68
mov dword [ebp - 0x10], 0
jmp 0x1002aa98
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1002aab2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4c]
call fcn.10009a26
cmp dword [eax], 0
je 0x1002aab0
jmp 0x1002aab2
jmp 0x1002aa91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10009a21
jmp 0x1002ab0b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1002aaee
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x1002ab0b
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.10009a26
mov dword [eax], 2
jmp 0x1002aae3
jmp 0x1002ab53
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1002ab49
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1002ab53
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret