joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e2ebd65
Capabilities:
Authenticate hmac

Disassembly:
aaa
add dword [eax], eax
push eax
aaa
add dword [eax], eax
add byte [eax], al
add byte [eax], al
bound esi, qword [edi]
add dword [eax], eax
push 0x37
add dword [eax], eax
je 0x6e2ebdb1
add dword [eax], eax
xor byte [edi], 1
add byte [edi + esi + 0x37960001], cl
add dword [eax], eax
sahf
aaa
add dword [eax], eax
test al, 0x37
add dword [eax], eax
mov dl, 0x37
add dword [eax], eax
mov esp, 0xc6000137
aaa
add dword [eax], eax
aam 0x37
add dword [eax], eax
fidiv word [edi]
add dword [eax], eax
out 0x37, al
add dword [eax], eax
hlt
cmp byte [ecx], al
add byte [edx], dl
cmp byte [ecx], al
add byte [edx], ch
cmp byte [ecx], al
add byte [esi], bh
cmp byte [ecx], al
add byte [eax + 0x38], bl
add dword [eax], eax
push 0x38
add dword [eax], eax
js 0x6e2ebe02
add dword [eax], eax
mov byte [eax], bh
add dword [eax], eax
pushfd
cmp byte [ecx], al
add byte [edx - 0x49fffec8], ch
cmp byte [ecx], al
add byte [esi - 0x33fffec8], bh
cmp byte [ecx], al
add ah, dl
cmp byte [ecx], al
add dh, bl
cmp byte [ecx], al
add al, dh
cmp byte [ecx], al
add dl, bh
cmp byte [ecx], al
add byte [edx], al
cmp dword [ecx], eax
add byte [ecx + edi], cl
add dword [eax], eax
sbb byte [ecx], bh
add dword [eax], eax
cmp dword cs:[ecx], eax
add byte [edx], bh
cmp dword [ecx], eax
add byte [eax + 0x39], dl
add dword [eax], eax
pop esi
cmp dword [ecx], eax
add byte [eax + 0x39], ch
add dword [eax], eax
je 0x6e2ebe4f
add dword [eax], eax
cmp bh, byte [ecx]
add dword [eax], eax
push eax
cmp dword [ecx], eax
add byte [esi + 0x39], bl
add dword [eax], eax
push 0x74000139
cmp dword [ecx], eax
add byte [edx + 0x139], al
add dword [eax], eax
cmp byte [ecx], 1
add byte [eax], al
add byte [eax], al
add byte [esi - 0x5dfffec7], cl
cmp dword [ecx], eax
add byte [eax + 0x139], dh
add byte [eax], al
add byte [ecx + edi + 0x39ce0001], bh
add dword [eax], eax
fidivr word [ecx]
add dword [eax], eax
invalid
add byte [edx + edi + 1], bl
add byte [edx + 0x3a], dh
add dword [eax], eax
mov bh, byte [edx]
add dword [eax], eax
pushfd
cmp al, byte [ecx]
add byte [eax], al
add byte [eax], al
add byte [0x800001], dl
Function at 0x6e2f2af9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [ebp - 4], esi
test byte [esi + 8], 0x10
jne 0x6e2f7fc2
call fcn.6e2f3232
test eax, eax
je 0x6e2fdfdf
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
lea esi, [ecx + eax]
movzx eax, word [esi + 0x16]
shr eax, 0xc
not eax
test al, 1
je 0x6e2fdfdf
push edi
push dword [esi + 0x3c]
lea eax, [ebp - 0x18]
push eax
call fcn.6e2f2d4d
xor edi, edi
cmp dword [eax], edi
jne 0x6e2fdfed
push ebx
mov ebx, dword [esi + 0x38]
push ebx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], ebx
call fcn.6e2f2d4d
cmp dword [eax], edi
jne 0x6e2fe04c
push 0x200
push dword [esi + 0x3c]
lea eax, [ebp - 0x18]
push eax
call fcn.6e2f29cb
cmp dword [eax], edi
jne 0x6e2fe04c
push dword [esi + 0x3c]
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.6e2f29cb
cmp dword [eax], edi
jne 0x6e2fe04c
push 0x1000
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.6e2f29cb
cmp dword [eax], edi
jne 0x6e2fe04c
push ebx
push dword [esi + 0x50]
lea eax, [ebp - 0x18]
push eax
call fcn.6e2f29cb
cmp dword [eax], edi
jne 0x6e2fe04c
push dword [esi + 0x3c]
mov eax, dword [esi + 0x54]
push eax
mov dword [ebp - 8], eax
invalid

Function at 0x6e2f2e33
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov eax, dword [ecx]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [eax + ecx + 0x18]
movzx eax, word [ecx + 6]
imul eax, eax, 0x28
add eax, edx
cmp edx, eax
jae 0x6e2f2e88
mov ecx, dword [ecx + 0x38]
mov edi, dword [esp + 0x10]
lea esi, [ecx - 1]
not esi
mov ebx, dword [edx + 8]
lea ebx, [ebx + ecx - 1]
and ebx, esi
add ebx, dword [edx + 0xc]
cmp edi, ebx
jb 0x6e2f2e79
add edx, 0x28
cmp edx, eax
jb 0x6e2f2e60
jmp 0x6e2f2e88
cmp edi, dword [edx + 0xc]
sbb eax, eax
not eax
and eax, edx
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
jmp 0x6e2f2e82
Function at 0x6e2f2e8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 5
call fcn.6e2f2fa8
test eax, eax
je 0x6e2fe084
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 4], eax
add eax, ecx
mov dword [ebp - 0xc], eax
movzx eax, word [eax + 0x16]
xor ebx, ebx
not eax
inc ebx
test bl, al
je 0x6e2fe0ae
push 0
push 0x80000000
push 5
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.6e2f316b
cmp dword [eax], 0
jne 0x6e2fe0ae
push 5
mov ecx, esi
call fcn.6e2f3147
mov edi, dword [eax]
push edi
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.6e2f2e33
test eax, eax
je 0x6e2fe0ae
test dword [eax + 0x24], 0x40000000
je 0x6e2fe0ae
test edi, edi
je 0x6e2fe0ae
test byte [esi + 8], bl
je 0x6e2f8009
mov eax, edi
mov ecx, dword [ebp - 4]
add ecx, eax
je 0x6e2fe0ae
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 8]
cmp edx, dword [eax + 4]
jne 0x6e2fe0ae
lea eax, [ecx + 8]
lea esi, [edx + ecx]
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx + 4]
mov edi, 0x200
cmp cx, di
je 0x6e2fe0b8
cmp edx, 0xa
jb 0x6e2fe0ae
mov edx, 0x8664
cmp cx, dx
mov cx, word [eax]
mov edx, 0xf000
je 0x6e2fe0e9
and cx, dx
mov edx, 0x3000
cmp cx, dx
jne 0x6e2fe0ae
inc eax
inc eax
cmp eax, esi
jae 0x6e2f2f9b
mov ecx, 0xf000
test word [eax], cx
je 0x6e2f2f86
jmp 0x6e2fe0ae
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
pop ebx
leave
ret 4
push edi
mov ecx, esi
call fcn.6e2f84da
jmp 0x6e2f2f21
rcl byte [0x1703c603], 3
inc edi
add al, 3
ja 0x6e2fe098
add al, 0x89
ja 0x6e2fe0a4
add byte [ebx + 0xc601], cl
ret
dec edx
or byte [ecx], bh
dec edx
or al, 0x75
pop es
mov ecx, edx
jmp 0x6e2d24bf
add eax, dword [ebp + edi*8 - 1]
mov eax, dword [edx]
imul eax, ecx
add eax, dword [edx + 4]
inc ecx
mov dword [edx + 8], ecx
ret
push ecx
or byte [ecx + 0x51896051], cl
pop esp
mov dword [ecx + 0x68], edx
mov dword [ecx + 0x6c], eax
mov dword [ecx + 0x44], edx
mov word [ecx + 0x1e], ax
mov byte [ecx + 0x20], dl
mov dword [ecx + 0x14], edx
Function at 0x6e2f2fd4
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
test byte [esi + 8], 0x40
jne 0x6e2fe154
push edi
lea eax, [ebp - 4]
push eax
call fcn.6e2f26d7
xor edi, edi
cmp dword [eax], edi
jne 0x6e2fe15f
push ebx
mov ecx, esi
call fcn.6e2f2487
xor ebx, ebx
inc ebx
mov dword [ebp - 4], eax
test eax, eax
jbe 0x6e2f3024
push edi
mov ecx, esi
call fcn.6e2f2fa8
test eax, eax
jne 0x6e2f31a1
inc edi
cmp edi, dword [ebp - 4]
jb 0x6e2f300e
push ebx
mov ecx, esi
call fcn.6e2f2fa8
test eax, eax
je 0x6e2fe16d
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.6e2f3480
xor edi, edi
cmp dword [eax], edi
jne 0x6e2f30c1
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.6e2f2e8c
cmp dword [eax], edi
jne 0x6e2f30c1
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.6e2f24a3
cmp dword [eax], edi
jne 0x6e2f30c1
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edi, [eax + ecx + 0x18]
movzx eax, word [ecx + 6]
imul eax, eax, 0x28
add eax, edi
cmp edi, eax
jae fcn.6e2f3099
mov edx, dword [edi + 0x24]
shr edx, 0x1c
not edx
test bl, dl
je 0x6e2f30c1
test dword [edi + 0x24], 0xe0000000
je 0x6e2f30c1
add edi, 0x28
jmp 0x6e2f307b
mov eax, ebx
mov ecx, edi
shl eax, cl
test dword [0x79041088], eax
je 0x6e2f30c1
cmp edi, 4
je 0x6e2f301e
push 0
push 0x10000000
push edi
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.6e2f316b
cmp dword [eax], 0
je 0x6e2f301e
jmp 0x6e2f30c1
inc edx
shl byte [eax - 0x63ee2daf], cl
scasd eax, dword es:[edi]
add byte [eax - 0x50], ah
in al, dx
cmp eax, 0x198bf39
add al, 0x10

Function at 0x6e2f3232
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
cmp dword [ecx + 4], 0x40
jb 0x6e2fdf85
push ebx
push esi
push edi
mov edi, dword [ecx]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x6e2f32c0
mov esi, dword [edi + 0x3c]
xor ebx, ebx
cmp esi, ebx
je 0x6e2f32c0
mov byte [ebp - 0x10], bl
push dword [ebp - 0x10]
mov eax, 0xf8
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], bl
call fcn.6e2f31ff
cmp byte [ebp - 0x10], bl
jne 0x6e2f32c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x14]
jb 0x6e2f32c0
add edi, esi
cmp dword [edi], 0x4550
jne 0x6e2f32c0
movzx eax, word [edi + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x6e2fdf89
lea eax, [ecx - 0x2b]
cmp word [edi + 0x14], ax
jne 0x6e2f32c0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x6e2f32bb

Function at 0x6e31ec7b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc eax, 0x3f
nop
or al, 0
pushal
add byte [eax], al
add byte [edi - 0x1bcc5dcd], cl
xor esp, dword [ebp + 0x3d353334]
xor eax, 0x354a3542
pop ebx
xor eax, 0x35a33588
sti
xor eax, 0x36bf3619
cmp byte es:[ecx - 0x2ec752c8], al
cmp byte [esi], bl
cmp dword [ebx + 0x39], edx
cli
cmp al, byte [edx - 0x5fc46ec5]
cmp ebp, dword [edi + 0x333c063b]
cmp al, 0xa0
cmp al, 0xdb
cmp al, 0xc9
cmp eax, 0x3ddc3dcf
out 0x3d, eax
out dx, eax
cmp eax, 0x3e213e10
das
cmp dword ds:[esi], edi
invalid
Function at 0x6e31f521
Capabilities:
Get number of processors
Parse credit card information

Disassembly:
cmp edi, dword [eax + 0x3b]
jl 0x6e31f561
cmp byte [ebx], 0xd4
cmp ebx, eax
cmp ebx, esp
cmp esp, eax
cmp esp, esp
cmp ebp, eax
cmp ebp, esp
cmp esi, eax
cmp esi, esp
cmp edi, eax
cmp edi, esp
cmp eax, dword [eax]
cmp al, 4
cmp al, 8
cmp al, 0xc
cmp al, 0x10
cmp al, 0x14
cmp al, 0x18
cmp al, 0x1c
cmp al, 0x20
cmp al, 0x24
cmp al, 0x50
cmp al, 0x54
cmp al, 0x58
cmp al, 0x5c
cmp al, 0x60
cmp al, 0x64
cmp al, 0x68
cmp al, 0x6c
cmp al, 0x70
cmp al, 0x74
cmp al, 0x78
cmp al, 0x7c
cmp al, 0x80
cmp al, 0x84
cmp al, 0x88
cmp al, 0x8c
cmp al, 0x90
cmp al, 0x94
cmp al, 0x98
cmp al, 0xa0
cmp al, 0xa4
cmp al, 0xa8
cmp al, 0xac
cmp al, 0xb0
cmp al, 0xb4
cmp al, 0xb8
cmp al, 0xbc
cmp al, 0xc0
Function at 0x6e320e82
Capabilities:
Parse credit card information

Disassembly:
dec esp
xor edx, dword [eax + 0x33]
push esp
xor ebx, dword [eax + 0x33]
pop esp
xor esp, dword [eax + 0x33]
xor ebp, dword fs:[eax + 0x33]
insb byte es:[edi], dx
xor esi, dword [eax + 0x33]
je 0x6e320ecb
js 0x6e320ecd
jl 0x6e320ecf
xor byte [ebx], 0x84
xor ecx, dword [eax - 0x6fcc73cd]
xor edx, dword [ebx + esi + 0x339c3398]
mov al, byte [0xa833a433]
xor ebp, dword [ebx + esi + 0x33b433b0]
mov eax, 0xc033bc33
xor eax, esp
xor ecx, eax
xor ecx, esp
xor edx, eax
xor edx, esp
xor ebx, eax
xor ebx, esp
xor esp, eax
xor esp, esp
xor ebp, eax
xor ebp, esp
xor esi, eax
xor esi, esp
xor edi, eax
xor edi, esp
xor eax, dword [eax]
xor al, 4
xor al, 8
xor al, 0xc
xor al, 0x30
xor al, 0x58
xor al, 0xce
xor al, 0xd8
xor al, 0xdc
xor al, 0xe0
xor al, 0xe4
xor al, 0xe8
xor al, 0xec
xor al, 0xf0
xor al, 0xf4
xor al, 0xf8
xor al, 0xfc
xor al, 0
xor eax, 0x35083504
or al, 0x35
adc byte [0x35183514], dh
sbb al, 0x35
and byte [0x35283524], dh
aaa
xor eax, 0x35443540
xor eax, 0x354c3548
push eax
xor eax, 0x35583554
pop esp
xor eax, 0x35643560
push 0x70356c35
xor eax, 0x35783574
Function at 0x6e320f19
Capabilities:
Parse credit card information

Disassembly:
xor eax, 0x354c3548
push eax
xor eax, 0x35583554
pop esp
xor eax, 0x35643560
push 0x70356c35
xor eax, 0x35783574
jl 0x6e320f6b
xor byte [0x35883584], 0x8c
xor eax, 0x385f3590
mov bh, 0x38
pop es
cmp dword [eax], ebx
cmp dword [eax], esp
cmp dword [ecx + edi + 0x50], esi
cmp dl, byte [edx + edi + 0x58]
cmp bl, byte [edx + edi + 0x60]
cmp ah, byte [edx + edi + 0x68]
cmp ch, byte [edx + edi - 0x77]
cmp dh, byte [ebx + edi]
adc byte [esp + edx], bh
cmp al, 0x18
cmp al, 0x1c
cmp al, 0x20
cmp al, 0x24
cmp al, 0x28
cmp al, 0x2c
cmp al, 0x30
cmp al, 0x34
cmp al, 0x38
cmp al, 0x3c
cmp al, 0x40
cmp al, 0x44
cmp al, 0x48
cmp al, 0x4c
cmp al, 0x50
cmp al, 0x54
cmp al, 0x58
cmp al, 0x5c
cmp al, 0x60
cmp al, 0x64
cmp al, 0x68
cmp al, 0x7f
cmp al, 0x93
cmp al, 0xa8
cmp al, 0xac
cmp al, 0xb0
cmp al, 0xb4
cmp al, 0xb8
cmp al, 0xbc
cmp al, 0xc0
cmp al, 0xc4
cmp al, 0xc8
cmp al, 0xcc
cmp al, 0xd0
cmp al, 0xd4
cmp al, 0xd8
cmp al, 0xdc
cmp al, 0xe0
cmp al, 0xe4
cmp al, 0xe8
cmp al, 0xec
cmp al, 0xc
cmp eax, 0x3d143d10
sbb byte [0x3d203d1c], bh
and al, 0x3d
sub byte [0x3d303d2c], bh
xor al, 0x3d
cmp byte [0x3d403d3c], bh
inc esp
cmp eax, 0x3d4c3d48
push eax
cmp eax, 0x3d583d54
pop esp
cmp eax, 0x3d643d60
push 0x703d6c3d
cmp eax, 0x3d783d74
jl 0x6e32102d
cmp byte [0x3d883d84], 0x8c
cmp eax, 0x3d943d90
cwde
cmp eax, 0x3da03d9c
movsb byte es:[edi], byte [esi]
cmp eax, 0x3dac3da8
mov al, 0x3d
mov ah, 0x3d
mov eax, 0xc03dbc3d
cmp eax, 0x3dc83dc4
int3
cmp eax, 0x3e003dfc
add al, 0x3e
or byte [esi], bh
or al, 0x3e
adc byte [esi], bh
adc al, 0x3e
sbb byte [esi], bh
sbb al, 0x3e
and byte [esi], bh
and al, 0x3e
sub byte [esi], bh
sub al, 0x3e
xor byte [esi], bh
xor al, 0x3e
cmp byte [esi], bh
cmp al, 0x3e
inc eax
inc esp
dec eax
dec esp
push eax
push esp
pop eax
pop esp
pushal
push 0x703e6c3e
je 0x6e3210aa
js 0x6e3210ac
jl 0x6e3210ae
cmp byte [esi], 0x84
mov byte ds:[esi], bh
invalid
hlt
clc
cld
cld
add byte ds:[edi], bh
add al, 0x3f
or byte [edi], bh
or al, 0x3f
adc byte [edi], bh
adc al, 0x3f
sbb byte [edi], bh
sbb al, 0x3f
and byte [edi], bh
and al, 0x3f
sub byte [edi], bh
sub al, 0x3f
xor byte [edi], bh
xor al, 0x3f
cmp byte [edi], bh
cmp al, 0x3f
inc eax
aas
inc esp
aas
dec eax
aas
dec esp
aas
push eax
aas
push esp
aas

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1002ab5
Capabilities:
Accept command line arguments

Disassembly:
push 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call fcn.01005595
add esp, 0x10
ret

Function at 0x1002ad0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100a11c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x94
push esi
lea eax, [ebp - 0x98]
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x98], esi
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x98]
inc esi
push eax
mov dword [0x100a4a8], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002b7f
push 2
pop eax
cmp dword [ebp - 0x88], eax
jne 0x1002b7f
cmp dword [ebp - 0x94], 5
jne 0x1002b62
cmp dword [ebp - 0x90], 0
je 0x1002b7a
cmp dword [ebp - 0x90], esi
jne 0x1002b4e
mov dword [0x100a4a8], 3
jmp 0x1002b7f
cmp dword [ebp - 0x90], eax
jne 0x1002b7f
mov dword [0x100a4a8], 4
jmp 0x1002b7f
cmp dword [ebp - 0x94], 6
jb 0x1002b7f
cmp dword [ebp - 0x8c], 0x1b58
sbb eax, eax
add eax, 6
mov dword [0x100a4a8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010081b4
leave
ret

Function at 0x1002daf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push edi
call fcn.01005736
test eax, eax
je 0x1002eef
push 0x1001758
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x100a478], eax
cmp eax, edi
jne 0x1002df0
push 0x1001734
push 0x10015b8
push 0x100171c
call fcn.01007eb7
add esp, 0xc
xor eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100170c
push eax
call esi
push 0x10016fc
push dword [0x100a478]
mov dword [0x100a484], eax
call esi
push 0x10016e4
push dword [0x100a478]
mov dword [0x100a488], eax
call esi
push 0x10016d0
push dword [0x100a478]
mov dword [0x100a48c], eax
call esi
push 0x10016c0
push dword [0x100a478]
mov dword [0x100a490], eax
call esi
push 0x10016b0
push dword [0x100a478]
mov dword [0x100a494], eax
call esi
push 0x10016a0
push dword [0x100a478]
mov dword [0x100a498], eax
call esi
push 0x100168c
push dword [0x100a478]
mov dword [0x100a49c], eax
call esi
push 0x100167c
push dword [0x100a478]
mov dword [0x100a4a0], eax
call esi
mov dword [0x100a4a4], eax
pop esi
cmp dword [0x100a484], edi
je 0x1002ed9
cmp dword [0x100a488], edi
je 0x1002ed9
cmp dword [0x100a48c], edi
je 0x1002ed9
cmp dword [0x100a490], edi
je 0x1002ed9
cmp dword [0x100a494], edi
je 0x1002ed9
cmp dword [0x100a498], edi
je 0x1002ed9
cmp dword [0x100a49c], edi
je 0x1002ed9
cmp dword [0x100a4a0], edi
je 0x1002ed9
cmp eax, edi
jne 0x1002eef
push dword [0x100a478]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1001648
jmp 0x1002dda
xor eax, eax
inc eax
pop edi
ret
Function at 0x1003938
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100a11c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
cmp dword [0x100a4a8], ebx
jne 0x100396d
call fcn.01002ad0
cmp dword [0x100a4a8], 3
jg 0x100397b
xor eax, eax
inc eax
jmp 0x10039c0
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x10039bd
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10039b4
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.010081b4
leave
ret
Function at 0x10057d6
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
sub eax, 0x11
push esi
je 0x10057fd
dec eax
je 0x10057ef
xor eax, eax
jmp 0x100592a
call fcn.01005736
mov dword [ebp - 4], 0x1002374
jmp 0x1005809
call fcn.01005736
mov dword [ebp - 4], 0x1002364
mov esi, eax
neg esi
sbb esi, esi
push ebx
and esi, 6
push edi
inc esi
call fcn.01005736
test eax, eax
je 0x1005870
cmp dword [ebp + 0x18], 2
jle 0x100584b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyA]
test eax, eax
jne 0x1005925
push dword [ebp - 4]
push 0x1002344
jmp 0x10058bb
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceRegistryPropertyA]
test eax, eax
jne 0x1005925
push dword [ebp - 4]
push 0x1002324
jmp 0x10058bb
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x1005890
cmp byte [ecx], 0x2c
jne 0x100587e
mov byte [ecx], bl
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1005883
sub eax, edi
lea ecx, [ecx + eax + 1]
cmp byte [ecx], bl
jne 0x1005877
push 0xf003f
push 1
push ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10058ca
push 0x1002304
push 0x10015b8
push 0x10022e8
call fcn.01007eb7
add esp, 0xc
jmp 0x100591a
cmp dword [ebp + 0x18], 3
jle 0x10058f0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100591e
push dword [ebp - 4]
push 0x1002344
jmp 0x1005906
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x100591e
push dword [ebp - 4]
push 0x1002324
push 0x10022e8
call fcn.01007eb7
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1005928
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10059ff
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xf003f
push 1
push 0
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
test esi, esi
je 0x1005a58
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1005a51
push dword [ebp + 0x10]
push 0x10023f0
push 0x10023cc
call fcn.01007ef3
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1005a5a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1005da6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push eax
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp + 0x14], eax
xor edi, edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e19
lea eax, [ebp + 0x14]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005e19
inc edi
cmp dword [ebp - 8], edi
jne 0x1005e19
mov eax, esi
cmp byte [esi], bl
je 0x1005e19
cmp byte [eax], 0x2c
jne 0x1005e14
mov byte [eax], bl
inc eax
cmp byte [eax], bl
jne 0x1005e0d
cmp dword [ebp - 4], ebx
je 0x1005e27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1005e33
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
call fcn.01005736
mov esi, dword [ebp + 0x10]
test eax, eax
jne 0x1005e69
mov eax, esi
cmp byte [esi], bl
je 0x1005e69
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x1005e69
cmp byte [eax], bl
jne 0x1005e63
mov byte [eax], 0x2c
mov eax, ecx
cmp byte [eax], bl
jne 0x1005e55
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005ec0
cmp dword [ebp + 0x14], 2
jle 0x1005ead
call fcn.01005736
push dword [ebp + 0x14]
push esi
test eax, eax
je 0x1005ea9
push 7
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1005eb9
push 1
jmp 0x1005e9a
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1005ec0
xor edi, edi
inc edi
cmp dword [ebp - 4], ebx
je 0x1005ece
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10066a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, eax
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x310]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002364
push dword [ebp + 8]
mov dword [ebp - 4], 0x103
call esi
test eax, eax
je 0x10066f5
push 0x104
lea eax, [edi + 0x310]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
add edi, 0x414
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0x1002374
push dword [ebp + 8]
mov dword [ebp - 4], 0x103
call esi
test eax, eax
je 0x100672b
push 0x104
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
pop edi
inc eax
pop esi
leave
ret