joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e0198dc
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e0198dc
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret

Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e0198dc
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e0198dc
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e0198dc
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e0198dc
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e0198dc
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0198dc
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8

Function at 0x2e0198dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2e0198eb
pop dword [ebp - 0x1c]
mov eax, 0x97d98c53
sub eax, 0x69d7f368
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x3be9a4c2
sub dword [ebp - 0x2c], 0xed975f77
mov dword [ebp - 0x28], 0xcad38b47
add dword [ebp - 0x28], 0x675fc0fe
mov dword [ebp - 0x24], 0x31d73d66
add dword [ebp - 0x24], 0x1a7506c8
mov dword [ebp - 0x20], 0xef71ec0d
sub dword [ebp - 0x20], 0xef71ec0d
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x1f13947e
add eax, 0xeef9c4a
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x92b7ae3c
add dword [ebp - 0x2c], 0xe1babb1a
mov dword [ebp - 0x28], 0x4de98a08
sub dword [ebp - 0x28], 0xc7d2893
mov dword [ebp - 0x24], 0x1ca2f5c9
sub dword [ebp - 0x24], 0xb933895d
mov dword [ebp - 0x20], 0xf415214f
sub dword [ebp - 0x20], 0xf415214f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x41199
push 0
call eax
mov ecx, 0x77319344
add ecx, 0x88ceb4c2
xor esi, esi
add esi, eax
mov edx, 0xcba9dec9
sub edx, 0x9da460c9
add edx, dword [ebp - 0x1c]
mov ebx, 0x1755c676
add ebx, 0xf3c20c2b
xor dword [ebp - 4], edi
mov edi, dword [edx]
sub edi, ebx
sub dword [ebp - 0x10], ebx
mov dword [esi], edi
add dword [ebp - 0xc], 0x5f6f3ee0
add esi, 4
add edx, 0xed7d4437
sub edx, 0xed7d4433
loop 0x2e019a0a
add eax, 0x112eb
xor ebx, ebx
add ebx, eax
add eax, 0xe52728b8
add eax, 0x1ad8d74d
mov ecx, 0x3cd2c6a7
add ecx, 0xf12d3959
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e0198dc
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e0198dc
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e0198dc
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e0198dc
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e0198dc
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e0198dc
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x576e07a5
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa67741b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x156e110
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf01000]
push edi
or ebp, 0xffffffff
jmp 0x156e132
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x156e139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156e128
mov eax, 1
add ebx, ebx
jne 0x156e14b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x156e15c
jne 0x156e17b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156e17b
dec eax
add ebx, ebx
jne 0x156e168
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x156e140
add ebx, ebx
jne 0x156e177
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x156e1cd
xor ecx, ecx
sub eax, 3
jb 0x156e193
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x156e202
sar eax, 1
mov ebp, eax
jmp 0x156e19e
add ebx, ebx
jne 0x156e19e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156e16c
inc ecx
add ebx, ebx
jne 0x156e1ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156e16c
add ebx, ebx
jne 0x156e1b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x156e1ae
jne 0x156e1ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x156e1ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x156e1ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x156e1de
jmp 0x156e12e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x156e1ec
add edi, ecx
jmp 0x156e12e
pop esi
mov edi, esi
mov ecx, 0xf2ab
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x156e20a
cmp byte [edi], 0x3e
jne 0x156e20a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x156e20f
lea edi, [esi + 0x116a000]
mov eax, dword [edi]
or eax, eax
je 0x156e27e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1171278]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11713d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x156e23c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11713dc]
or eax, eax
je 0x156e278
mov dword [ebx], eax
add ebx, 4
jmp 0x156e259
call dword [esi + 0x11713d8]
mov ebp, dword [esi + 0x11713e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x156e2b2
sub esp, 0xffffff80
jmp 0x5d9aa0
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x450012
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
xor ebx, ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x44ff28]
sub edi, edi
sub ecx, ecx
mov cl, 0xe5
inc edi
loop 0x45003a
call 0x450042
pop esi
sub esi, 0xffffffc2
push esi
sub ebx, ebx
or ebx, 0x2394
mov al, byte [esi]
xor ax, di
xchg byte [esi], al
inc esi
sub ebx, 1
cmp ebx, 0
ja 0x450052
pop esi
mov esp, dword fs:[0]
pop dword fs:[0]
pop edi
pop ebp
jmp esi
Function at 0x1001a8f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001a905
pop dword [ebp - 8]
mov eax, 0xf0d821e3
sub eax, 0xe0d678de
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x44501
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x339624a6
add ecx, 0xcc6a3257
xor ebx, ebx
add ebx, eax
mov edx, 0x7626fef
sub edx, 0xf75eb1ef
add edx, dword [ebp - 8]
mov edi, 0xc841abc0
add edi, 0x98f58b70
mov dword [ebp - 4], 0xf44ce25c
mov esi, dword [edx]
add dword [ebp - 4], ebx
xor esi, edi
xor dword [ebp - 4], 0xaebd46d3
mov dword [ebx], esi
sub dword [ebp - 4], 0x7149e777
add ebx, 0xe58b1ae4
sub ebx, 0xe58b1ae0
add edx, 0xab0c0a4d
add edx, 0x54f3f5b7
loop 0x1001a961
add eax, 0x14ec7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x118201c1
add ecx, 0xfe7dfe3f
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a8f6
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a8f6
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x998dfa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x9a7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
push ebx
push 0x9911e0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x9a7888
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x998e79
mov ecx, dword [ebp - 8]
mov byte [ebp - 0x14], bl
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x998e3e
push dword [ebp - 0x14]
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.0099aab3
add esp, 0xc
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
push eax
call fcn.00998be4
pop ecx
xor ecx, ecx
inc ecx
cmp dword [eax], 3
jne 0x998e7c
jmp 0x998e7e
mov ecx, dword [ebp - 0x14]
mov bl, 1
test cl, 1
je 0x998e8b
lea ecx, [ebp - 0x30]
call fcn.00999ef4
mov ecx, esi
test bl, bl
je 0x998e98
push 0x996dcc
jmp 0x998e9b
push dword [ebp - 8]
call fcn.00999db3
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0099b2a3
leave
ret

Function at 0x9990bd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x9a7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x44], 0x9a7888
push edi
xor edi, edi
mov dword [ebp - 0x48], edi
cmp dword [ebx + 0x10], edi
je 0x999172
lea edx, [ebp - 0x48]
call fcn.00998bb3
test al, al
je 0x999172
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push edi
push eax
call fcn.0099cf80
xor eax, eax
mov dword [ebp - 0x90], esi
lea edi, [ebp - 0xa0]
add esp, 0xc
cmp dword [ebx + 0x14], 8
mov esi, 0x996dd0
stosd dword es:[edi], eax
push 0xf
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
jb 0x999131
mov ebx, dword [ebx]
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x999172
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x999174
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0099b2a3
leave
ret
Function at 0x9998b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x9a7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x6c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ecx
push 0x20019
push ebx
movzx eax, al
push 0x996e10
sub eax, 0x7fffffff
mov dword [ebp - 0x6c], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x999918
push 0x996dcc
mov ecx, esi
call fcn.00999db3
cmp dword [ebp - 0x6c], ebx
je 0x9999c0
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x9999c0
push edi
push 0x64
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
push ebx
push eax
call fcn.0099cf80
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x996db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x9999a5
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x9999a5
cmp dword [ebp - 0x70], 1
jne 0x9999a5
shr edi, 1
cmp edi, 0x32
jae 0x9999a5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x996db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [edi + edi]
mov edx, eax
cmp word [ebp + ecx - 0x6a], bx
je 0x999996
lea eax, [edi + 1]
cmp eax, 0x32
jae 0x999996
cmp ecx, 0x64
jae 0x9999d2
xor eax, eax
mov word [ebp + ecx - 0x68], ax
lea eax, [ebp - 0x68]
test edx, edx
je 0x9999a2
mov eax, 0x996dcc
push eax
jmp 0x9999aa
push 0x996dcc
mov ecx, esi
call fcn.00999db3
cmp dword [ebp - 0x6c], ebx
je 0x9999bf
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0099b2a3
leave
ret 8
call fcn.0099b3d3
int3

Function at 0x99bd66
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x99bda5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x99bda5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x99bda5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x99bda5
cmp dword [ecx + 0x74], 0xe
jbe 0x99bda5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x9a6590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9a65bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9a65bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret