joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100713e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a9478
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100bf364]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x34], 1
mov ebx, 0xf
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x30], eax
cmp esi, eax
je 0x100714d9
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x1007145e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10071449
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.10022820
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x10071477
cmp ebx, 0x10
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x2c]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x10071484
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10030b00
cmp dword [ebp - 0x18], 0x10
lea ebx, [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x1c]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x100714b4
nop
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x100714a0
mov eax, dword [ebp - 0x2c]
cmp edi, dword [ebp + 8]
jne 0x100714c4
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x100714d4
dec ecx
mov dword [ebp - 0x34], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x30]
je 0x100714dc
mov ebx, dword [ebp - 0x18]
jmp 0x10071435
mov esi, dword [esi + 0x18]
jmp 0x100714de
mov eax, dword [ebp - 0x2c]
xor esi, esi
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x10071511
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x10071507
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x30], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x10071531
mov eax, dword [ebp - 0x30]
push ecx
push eax
call fcn.100a0a14
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100a04d8
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x10072d20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0x100bf364]
xor eax, esp
mov dword [esp + 0x254], eax
push 0x105
lea eax, [esp + 0x14c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x40]
push 0x105
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x100b3fc0]
add esp, 0xc
cmp dword [ebp + 0xc], 1
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 4], 0
movaps xmm0, xmmword [0x100b3f10]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0xc], 0
movaps xmm0, xmmword [0x100b3fe0]
mov dword [esp + 8], 0
movups xmmword [esp + 0x30], xmm0
jmp 0x10072e11
push 0
push 0
push 0
push 0x1002df00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x254]
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.100a04d8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100855c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10085751
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x10085751
mov eax, dword [0x1013e4a8]
cmp dword [eax + 0x174], 0xffffffff
je 0x10085751
mov eax, dword [0x1013e744]
add eax, 0xffffff90
xor eax, 0xd2ca0fda
cmp dword [eax + ebx], 0
mov eax, dword [0x1013e70c]
setle cl
add eax, 0xffffff9e
xor eax, 0xd2ca0fcc
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x1013e700]
add eax, 0xffffffa1
xor eax, 0xd2ca0fc9
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x1013e704]
add eax, 0xffffffa0
xor eax, 0xd2ca0fca
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x1013e708]
lea eax, [ecx - 0x61]
xor eax, 0xd2ca0fcb
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100856ae
lea eax, [ecx - 0x61]
xor eax, 0xd2ca0fcb
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100856a6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x1008569a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x10085697
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x1013e708]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x10085663
lea eax, [ecx - 0x61]
xor eax, 0xd2ca0fcb
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x1013e4bc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10085742
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x10085706
xor edx, edx
test ecx, ecx
je 0x1008572c
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10085713
cmp edi, 0x79705c5e
je 0x10085737
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10085742
mov ecx, dword [ebp - 4]
jmp 0x100856f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x10085744
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x1013e5b4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100978d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, dword [ebp + 8]
xor ecx, eax
mov dword [ebp - 4], esi
imul ecx, ecx, 0x1000193
mov eax, ebx
sar eax, 0x10
movzx eax, al
push edi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x10143554]
and edx, dword [0x10143560]
mov edi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x1014354c]
add ecx, 4
mov eax, edi
mov dword [ebp - 4], ecx
nop
cmp edi, edx
jne 0x10097948
mov ecx, edx
jmp 0x1009794c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10097968
cmp dword [eax + 8], ebx
je 0x1009795c
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x10097940
cmp eax, edx
je 0x10097968
push 1
add eax, 0xc
push eax
jmp 0x1009796f
push 0
push 0x100ae970
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.10022820
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009c470
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
lea eax, [ecx*8]
mov ecx, dword [eax + edx]
add edx, 4
add eax, edx
mov edx, ecx
mov dword [ebp - 8], eax
cmp edx, esi
jne 0x1009c4da
mov eax, esi
jmp 0x1009c4de
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x1009c4fd
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x1009c4f0
mov ecx, dword [ecx]
mov eax, dword [ebp - 8]
jmp 0x1009c4d2
pop edi
pop esi
mov dword [ebx], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009dfd0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100bf364]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1009e14c
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1009e139
cmp dword [ebp - 0x28], 0x10
jb 0x1009e11d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.100a106b
cmp dword [ebp - 0x1c], eax
jne 0x1009e11d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100a106b
cmp dword [ebp - 0x20], eax
je 0x1009e11d
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1009e0a4
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x100d4104]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100a106b
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1009e0a2
jmp 0x1009e139
jmp 0x1009e0fd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1009e0fd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x100d4104]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.100a106b
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1009e0e7
jmp 0x1009e139
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1009e023
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100a106b
push edx
mov ecx, ebp
push eax
lea edx, [0x1009e178]
call fcn.100a1017
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a04d8
add esp, 0x30
cmp ebp, esp
call fcn.100a106b
mov esp, ebp
pop ebp
ret
Function at 0x1009e190
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1009dfd0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1009e25b
mov dword [ebp - 4], 0
jmp 0x1009e1ec
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1009e25b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100a106b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009e259
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100a106b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1009ddf0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100a106b
jmp 0x1009e1e3
pop esi
add esp, 8
cmp ebp, esp
call fcn.100a106b
mov esp, ebp
pop ebp
ret

Function at 0x1009e270
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1009e31b
mov dword [ebp - 4], 0
jmp 0x1009e2a3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1009e2fe
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100a106b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009e2fc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100a106b
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100a106b
jmp 0x1009e29a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100d4104]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100a106b
pop esi
add esp, 8
cmp ebp, esp
call fcn.100a106b
mov esp, ebp
pop ebp
ret
Function at 0x1009e330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x101439b0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1009e393
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100a106b
test eax, eax
jne 0x1009e3be
mov eax, 0xa
jmp 0x1009e4c0
cmp dword [ebp + 0xc], 0
je 0x1009e40a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1009e408
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x1009e446
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1009e431
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1009e446
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100a106b
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100a106b
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100a106b
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1009e4e4]
call fcn.100a1017
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100a106b
mov esp, ebp
pop ebp
ret
Function at 0x1009ebb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x101439ac]
mov dword [ebp - 4], eax
jmp 0x1009ebd7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1009ebf0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1009ebee
mov eax, dword [ebp - 4]
jmp 0x1009ec74
jmp 0x1009ebcf
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100a106b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1009ec71
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1009ec33
mov edx, dword [ebp - 4]
mov eax, dword [0x101439ac]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101439ac], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100a106b
mov esp, ebp
pop ebp
ret

Function at 0x1009f160
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1009f1b0
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x1009f1b0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x1009f1b0
xor eax, eax
jmp 0x1009f1f1
mov dword [ebp - 4], 1
jmp 0x1009f1c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1009f1ec
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1009f1ea
xor eax, eax
jmp 0x1009f1f1
jmp 0x1009f1b9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10693058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106931a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1069307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1069306a
add dl, dl
jne 0x10693089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106930dc
xor eax, eax
add dl, dl
jne 0x10693096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1069317d
add dl, dl
jne 0x106930a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106930b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106930bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106930c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106930d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10693075
mov eax, 1
add dl, dl
jne 0x106930ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106930f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106930e1
sub eax, ebx
mov ebx, 1
jne 0x10693128
mov ecx, 1
add dl, dl
jne 0x1069310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10693119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10693105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10693075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1069313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1069314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10693136
cmp eax, 0x7d00
jae 0x1069316d
cmp eax, 0x500
jb 0x10693168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10693075
cmp eax, 0x7f
ja 0x10693170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10693075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1069319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10693075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40345b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
mov edi, edx
push esi
push 0x80
push 3
pop eax
push eax
push esi
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], esi
cmp ebx, 0xffffffff
je 0x4034b2
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, 0x400
push ebx
lea ecx, [eax - 1]
cmp ecx, 0x3fe
cmovbe eax, edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
shr esi, 0xa
test edi, edi
je 0x4034c2
push 3
pop eax
mov word [edi], ax
mov dword [edi + 8], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403ea3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x81c
mov eax, 0x4fb558
call fcn.004e6cea
mov esi, ecx
mov edi, dword [0x548750]
xor eax, eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x814], edi
mov dword [ebp - 4], eax
test edx, edx
je 0x403ff3
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x824]
jne 0x403ed8
sub ecx, ebx
sar ecx, 1
je 0x403ff3
mov dword [ebp - 0x818], edi
push edx
lea eax, [ebp - 0x818]
mov byte [ebp - 4], 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040306c
add esp, 0xc
lea eax, [ebp - 0x81c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp - 0x818]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403fd8
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0x820], 1
call fcn.004deff0
add esp, 0xc
mov dword [ebp - 0x828], 0x800
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x820]
push eax
push ebx
push str.DisplayIcon
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403fcc
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.004028f2
push 0x22
lea ecx, [ebp - 0x814]
call fcn.00404cbe
mov ecx, dword [ebp - 0x814]
call fcn.00404c46
test eax, eax
jne 0x403fcc
lea ecx, [ebp - 0x814]
call fcn.0040503b
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x818]
call fcn.00403080
jmp 0x404001
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x814]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret