joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f066
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x425708
call fcn.00418074
xor esi, esi
cmp dword [0x42d494], esi
jne 0x41f0aa
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41f095
mov dword [0x42d494], edi
jmp 0x41f0aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x41f0aa
mov dword [0x42d494], 2
mov eax, dword [0x42d494]
cmp eax, 2
je 0x41f18b
cmp eax, esi
je 0x41f18b
cmp eax, 1
jne 0x41f0ef
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x41f0d8
mov eax, dword [0x42d318]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x41f0f6
xor eax, eax
jmp 0x41f19d
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004152b0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x41f12c
cmp edi, esi
jne 0x41f147
lea eax, [ebx + ebx]
push eax
call fcn.00415fb7
pop ecx
mov edi, eax
cmp edi, esi
je 0x41f0ef
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41f17a
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x41f164
push esi
push esi
jmp 0x41f16a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x41f186
push edi
call fcn.00415232
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x41f19d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004180af
ret

Function at 0x5d8e62
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x5d8b64
sub esp, 4
mov dword [esp], esi
pop edi
call fcn.005d8e9e
sub esi, edi
sub edi, 0x5012503c
or edi, esi
xor dword [ecx], edx
mov esi, esi
or edi, edi
push esi
pop esi
add ecx, 2
mov edi, edi
add edi, esi
cmp ecx, ebx
jl fcn.005d8e62
or edi, edi
ret
Function at 0x401400
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
xor esi, esi
cmp dword [0x40c428], esi
push edi
jne 0x40143c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x401432
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x40c424], eax
mov dword [0x40c428], 1
mov eax, dword [0x40c424]
test eax, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x401459
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x401495
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x40148a
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x40147b
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x401480
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x40149d
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x401d40
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x40c420], edi
je 0x401d56
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x40c418], edi
je 0x401d67
mov eax, 1
pop edi
ret 4
cmp dword [0x40c420], edi
push esi
jne 0x401d79
call fcn.00401b30
test eax, eax
je 0x401dbb
mov eax, dword [0x40c438]
test eax, eax
mov esi, dword [0x40c050]
jne 0x401da5
push str.ActivateActCtx
push 0x40c42c
push 0x4086b4
call fcn.00401400
test eax, eax
mov dword [0x40c438], eax
je 0x401dbb
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x401dbb
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x401dd0
cmp eax, 0x7e
je 0x401dd0
cmp eax, 0x78
jne 0x401ddf
mov eax, 1
pop esi
mov dword [0x40c418], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4
Function at 0x402d00
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20c
mov eax, dword [0x40c3f8]
xor eax, esp
mov dword [esp + 0x208], eax
cmp dword [0x40c44c], 0
je 0x402d37
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00406596
add esp, 0x20c
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CRLRCVYCORE.DLL
call esi
test eax, eax
mov dword [0x40c44c], eax
jne 0x402db9
push 0x208
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402da1
lea ecx, [esp + 4]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x402da1
mov ecx, str.CRLRCVYCORE.DLL
lea edx, [eax + 2]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x402d82
lea edx, [esp + 4]
push edx
call esi
test eax, eax
mov dword [0x40c44c], eax
jne 0x402db9
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00406596
add esp, 0x20c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._RCV_ProcessWndProcException
push eax
call esi
mov dword [0x40c460], eax
mov eax, dword [0x40c44c]
push str._RCV_InitHandler
push eax
call esi
mov ecx, dword [0x40c44c]
push str._RCV_UnInitHandler
push ecx
mov dword [0x40c454], eax
call esi
mov edx, dword [0x40c44c]
push str._RCV_InitThreadHandler
push edx
mov dword [0x40c458], eax
call esi
mov dword [0x40c45c], eax
mov eax, dword [0x40c44c]
push str._RCV_ProcessWndProcException
push eax
call esi
mov ecx, dword [0x40c44c]
push str._RCV_ExceptionHandler
push ecx
mov dword [0x40c460], eax
call esi
mov edx, dword [0x40c44c]
push str._RCV_SetNotificationProc
push edx
mov dword [0x40c464], eax
call esi
cmp dword [0x40c454], 0
mov dword [0x40c468], eax
je 0x402e6d
cmp dword [0x40c458], 0
je 0x402e6d
cmp dword [0x40c45c], 0
je 0x402e6d
cmp dword [0x40c464], 0
je 0x402e6d
cmp dword [0x40c460], 0
je 0x402e6d
test eax, eax
jne 0x402e83
mov eax, dword [0x40c44c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x40c44c], 0
mov ecx, dword [esp + 0x20c]
xor eax, eax
cmp dword [0x40c44c], eax
pop esi
setne al
xor ecx, esp
call fcn.00406596
add esp, 0x20c
ret
Function at 0x402fc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x407328
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x40c3f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
push 0x408d00
lea ecx, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x408d00
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], edi
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x408d00
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x408d00
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 2
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
lea ecx, [esi + 0x24]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea ecx, [esi + 0x28]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
push 0x408d00
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 5
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4039a0
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
sub esp, 0x14
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x403ab9
cmp esi, 0xffffffff
je 0x403ab9
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xe
lea edx, [esp + 0x18]
push edx
push esi
call ebp
test eax, eax
jne 0x403a04
push str.Error_reading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0xe]
test eax, eax
jne 0x403a18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xe], eax
cmp dword [esp + 8], 0xe
jne 0x403aa6
cmp word [esp + 0xc], 0x4d42
jne 0x403aa6
push ebx
push edi
lea ebx, [eax - 0xe]
push 1
push ebx
call dword [sym.imp.MSVCR80.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
jne 0x403a5f
push str.Out_of_memory_loading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push esi
call ebp
test eax, eax
jne 0x403a95
push str.Error_reading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x14
ret
push str.Invalid_welcome_bitmap_file_format__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push str.Welcome_bitmap_file_does_not_exist__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x406596
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c3f8]
jne 0x4065a0
repz ret
jmp fcn.00406a91
Function at 0x1000e86d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.1002221d
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.1002221d
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x1000e8e9
mov eax, dword [0x100ff83c]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0x26
call fcn.10022235
cmp dword [ebp - 0x18], esp
je 0x1000e915
push 6
call fcn.1002222f
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x2b
call fcn.10022235
cmp dword [ebp - 0x18], esp
je 0x1000e943
push 6
call fcn.1002222f
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x2c
call fcn.10022235
cmp dword [ebp - 0x18], esp
je 0x1000e96f
push 6
call fcn.1002222f
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x2d
call fcn.10022235
cmp dword [ebp - 0x18], esp
je 0x1000e9fe
push 6
call fcn.1002222f
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x2e
call fcn.10022235
cmp dword [ebp - 0x18], esp
je 0x1000ea23
push 6
call fcn.1002222f
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x1000ea2b
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.10022229
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.10022229
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100230d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b54b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.100a9f1a
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10025710
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10023124
jmp dword [ecx*4 + 0x1002328c]
mov al, byte [esi]
test al, al
je 0x10023152
cmp al, 0x20
je 0x1002313e
cmp al, 0xa1
jne 0x10023152
cmp byte [esi + 1], al
jne 0x10023152
test al, 0x80
je 0x1002314a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10023152
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10023131
test ecx, ecx
je case.default.0x10023124
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10023124
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10023198
cmp dl, 0xa1
jne 0x1002318c
cmp byte [eax + 1], 0xa1
jne 0x1002318c
test ecx, ecx
jne 0x10023184
mov edi, eax
mov ecx, 1
inc eax
jmp 0x100231ac
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x100231c6
jmp 0x100231ac
cmp dl, 0x20
jne 0x100231aa
test ecx, ecx
jne 0x100231a3
mov edi, eax
mov ecx, 1
jmp 0x100231ac
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1002316c
cmp ecx, 1
jne case.default.0x10023124
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10023124
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10023124
mov al, byte [esi]
test al, al
je 0x1002321e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10023204
mov cl, byte [esi + 1]
test cl, cl
je 0x1002321e
cmp al, 0xa1
jne 0x100231f4
cmp cl, al
je 0x10023201
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.100259e0
inc esi
jmp 0x10023216
cmp al, 0x20
je 0x10023216
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10025a20
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100231dd
push 0
lea ecx, [esp + 0x14]
call fcn.10025a20
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10036b70
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10023251
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100d55f0
call fcn.10025910
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100a9eac
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10023ba0
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x100b54e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x100fb764]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push esi
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x30], 0
call fcn.10023a40
add esp, 0x14
dec esi
neg esi
sbb esi, esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x24]
add esi, 3
lea edx, [esp + 0x30]
lea ecx, [esi + esi*2]
push edx
push 0x20006
push 0
lea esi, [edi + ecx*4]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10023c42
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10023cfb
mov edx, dword [esi + 8]
push edx
call fcn.100358f0
add esp, 4
test eax, eax
mov eax, dword [esi + 8]
je 0x10023c92
cmp eax, 0x80000301
jne 0x10023c60
mov eax, dword [esi]
jmp 0x10023c6d
push 0
push esi
push 0x7d1
call fcn.1003ae20
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10023cf0
jmp 0x10023cea
cmp eax, 0x80000004
jne 0x10023cc1
mov esi, dword [esi]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x30]
not ecx
push ecx
mov ecx, dword [esp + 0x30]
push esi
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10023cf0
jmp 0x10023cea
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x10023cf0
mov esi, dword [esi]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 4]
add esi, 8
push eax
push esi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10023cf0
mov dword [ebx], 1
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.100a9eac
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1002d8c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b5d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.100a9c21
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1002d942
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100a6e04
mov eax, dword [eax]
push 0x100eb240
push eax
call fcn.10099754
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.100a9eac
test bl, bl
je 0x1002d942
push 0x100eb240
lea ecx, [esp + 0xc]
call fcn.100aa23c
push 0x100eedc4
lea ecx, [esp + 0xc]
call fcn.100aa23c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1002d97e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.100a9eac
jmp 0x1002da49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1002da02
lea edx, [esp + 0x7c]
push 0x100eedc0
push edx
call fcn.10099754
add esp, 8
test eax, eax
je 0x1002da02
lea eax, [esp + 0x7c]
push 0x100eedbc
push eax
call fcn.10099754
add esp, 8
test eax, eax
je 0x1002da02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002d992
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.100a9eac
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1002e240
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1002e2a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1002e2b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b5e1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100fb764]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1002e3e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1002e316
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100a9eac
xor eax, eax
jmp 0x1002e45f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100a9fe9
push esi
lea ecx, [esp + 0xc]
call fcn.100aa278
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1002e43d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.1002e240
test eax, eax
jne 0x1002e43d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.1002e240
test eax, eax
jne 0x1002e43d
lea eax, [esp + 0x14]
push 0x100eedd8
push eax
call fcn.1009a860
mov esi, eax
add esp, 8
test esi, esi
jne 0x1002e41c
lea ecx, [esp + 0x14]
push 0x100eedd4
push ecx
call fcn.1009a7e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1002e41c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1002e41f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.100a9f99
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1002e32e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100a9eac
xor eax, eax
jmp 0x1002e45f
mov byte [esi], 0
push 0x100eedd0
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.100a9eac
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4