joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030488
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030512
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100304c5
push 0x1e59
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10030510
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100304f3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10030510
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10013b14
mov dword [eax], 0xfffffffd
jmp 0x100304e8
jmp 0x1003052e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.100400b7
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100347a2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100347f6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.10034961
add esp, 0x10
jmp 0x10034950
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x470e
mov dword [ebp - 0x5c], 0x10008718
cmp dword [ebp - 0x24], 0x4859
jle 0x100348bd
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
and dword [ebp - 0x1c], 0
jmp 0x1003483e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c7
jge 0x100348bd
and dword [ebp - 0x20], 0
jmp 0x10034854
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7e57
jge 0x100348b8
and dword [ebp - 0x14], 0
jmp 0x1003486a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1bed
jge 0x100348b6
and dword [ebp - 0x18], 0
jmp 0x10034880
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x40c7
jge 0x100348b4
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
add edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x10034879
jmp 0x10034863
jmp 0x1003484d
jmp 0x10034837
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10034904
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
push dword [eax]
push 0
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push dword [eax]
call fcn.100309e7
add esp, 0x10
jmp 0x10034910
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x441d
jge 0x1003492a
mov edx, dword [ebp - 0x5c]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x10034946
or dword [ebp - 4], 0xffffffff
jmp 0x10034950
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036429
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100364b5
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100364a9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10013b14
cmp dword [eax], 0xffff
jne 0x1003649b
mov dword [ebp - 4], 1
jmp 0x1003649f
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x100364b3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x100364d6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push 0x2bea
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
call fcn.1003523c
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10038b59
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10038b7d
push 0x1254
push 0
push 0x55ca
call fcn.10040986
add esp, 0xc
jmp 0x10038bbf
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10038ba1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x10038bbf
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10038bbf
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret
Function at 0x1003922b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10039261
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x27e1
push dword [ebp - 4]
push 0x2541
push 1
push dword [ebp - 8]
call fcn.1003929d
add esp, 0x14
jmp 0x10039299
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10039291
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x10039299
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x1003a401
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060f3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003a529
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003a461
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003a45c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1003a527
mov dword [ebp - 0x10], 0xa4f833fc
mov dword [ebp - 0x5c], 0x948708ef
mov dword [ebp - 0x58], 0x948708ef
mov dword [ebp - 0x54], 0x948708ef
mov dword [ebp - 0x50], 0x948708ef
push 2
lea ecx, [ebp - 0x4c]
call fcn.10013a9c
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
jmp 0x1003a4a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003a4b5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18], 0xa8e
jmp 0x1003a49b
push 0x7289
push 1
push 0x1ea8
push 0x3378
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 0x19c8
call fcn.1002d84f
add esp, 0x20
mov dword [ebp - 0x10], 0
jmp 0x1003a4ed
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1003a503
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x18]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x1003a4e6
push 1
lea ecx, [ebp - 0x4c]
call fcn.10013b14
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10013af8
jmp 0x1003a57e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
push 0x2948
push 0x70f5
push dword [ebp - 0x30]
push 0x724d
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x6bb7
push 0x1917
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0x76c3
push 0
call fcn.10032399
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003b463
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1003b4ca
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x3593
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
call fcn.1003b526
add esp, 0x28
jmp 0x1003b522
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003b502
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003b500
push 0
push 0x1ba1
push 6
push 0xb22
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x1003b522
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003b522
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esp, ebp
pop ebp
ret
Function at 0x10040330
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004037f
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10040372
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10040370
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1004037d
push 0xb96
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x10040394
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push 0x27
push dword [ebp - 0x14]
push 0
call fcn.1003fbd1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1004417b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100441c6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100441b9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x100441c1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1004433f
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1004432c
mov dword [ebp - 0x40], 0xac7a
mov dword [ebp - 0x20], 0xf4e26c12
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x68], 0xfffffffa
mov dword [ebp - 0x64], 0xfffffffa
mov dword [ebp - 0x60], 0xfffffffa
mov dword [ebp - 0x5c], 0xfffffffa
mov dword [ebp - 8], 0
jmp 0x10044228
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1004423b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 4], 0xfffffffa
jmp 0x10044221
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0xdf5e
je 0x10044254
mov dword [ebp - 0x10], 1
jmp 0x10044258
and dword [ebp - 0x10], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
dec ecx
cmp dword [ebp + eax - 4], ecx
jge 0x10044271
mov dword [ebp - 0x14], 1
jmp 0x10044275
and dword [ebp - 0x14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp - 0x14], eax
jg 0x1004428d
mov dword [ebp - 0x18], 1
jmp 0x10044291
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x18], eax
jl 0x100442a2
mov dword [ebp - 0x1c], 1
jmp 0x100442a6
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp - 0x24], eax
jl 0x100442ca
mov dword [ebp - 0x44], 1
jmp 0x100442ce
and dword [ebp - 0x44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov dword [ebp - 0x58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
add eax, dword [ebp - 0x48]
cmp eax, 7
je 0x100442f6
mov dword [ebp - 0x28], 1
jmp 0x100442fa
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
add eax, dword [ebp - 0x28]
cmp eax, 0x490c
jge 0x10044317
mov dword [ebp - 0x2c], 1
jmp 0x1004431b
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
neg eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x68], eax
jmp 0x1004433f
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
and dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x1005cc05
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10065750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1004f218
mov dword [ebp - 0x14], eax
cmp dword [0x10608c8c], esi
jne 0x1005ccf8
push 0x800
push esi
push 0x10007528
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005cc85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005cdd8
push esi
push esi
push 0x10007528
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005cdd8
push 0x10007540
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005cdd8
push eax
call ebx
push 0x1000754c
push edi
mov dword [0x10608c8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000755c
push edi
mov dword [0x10608c90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007570
push edi
mov dword [0x10608c94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10608c9c], eax
test eax, eax
je 0x1005ccf5
push 0x1000758c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10608c98], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005cd1d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005cd10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005cd32
push 4
pop eax
jmp 0x1005cdda
cmp dword [ebp - 0x14], esi
je 0x1005cd32
push dword [0x10608c8c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005cd17
mov eax, dword [0x10608c98]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005cd90
cmp dword [0x10608c9c], edi
je 0x1005cd90
push eax
call ebx
push dword [0x10608c9c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005cd90
test eax, eax
je 0x1005cd90
call ecx
test eax, eax
je 0x1005cd85
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005cd85
test byte [ebp - 8], 1
jne 0x1005cd90
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005cdc0
mov eax, dword [0x10608c90]
cmp eax, edi
je 0x1005cdbd
push eax
call ebx
test eax, eax
je 0x1005cdbd
call eax
mov esi, eax
test esi, esi
je 0x1005cdbd
mov eax, dword [0x10608c94]
cmp eax, edi
je 0x1005cdbd
push eax
call ebx
test eax, eax
je 0x1005cdbd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10608c8c]
call ebx
test eax, eax
je 0x1005cdd8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005cdda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c5d7
mov esp, ebp
pop ebp
ret
Function at 0x410f88
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, ecx
push ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x2001f
push 0
mov ebx, edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x410fb7
xor esi, esi
inc esi
jmp 0x410ffc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x410ffc
mov ecx, dword [ebp - 4]
call fcn.00410dd0
mov esi, eax
test esi, esi
js 0x410ffc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x41100b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413f83
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x425454
push str.FlsAlloc
push 0
call fcn.00413f03
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413fb5
push dword [ebp + 8]
mov ecx, esi
call fcn.00411bda
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x413ff7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x425478
push str.FlsGetValue
push 2
call fcn.00413f03
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x414028
mov ecx, esi
call fcn.00411bda
call esi
jmp 0x41402e
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x414031
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x42548c
push str.FlsSetValue
push 3
call fcn.00413f03
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x414065
mov ecx, esi
call fcn.00411bda
call esi
jmp 0x41406b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xf0
mov ebx, 0x7ac56829
push edx
xor dword [esi + 0x5feadd4c], 0x347aa539
rcl al, 1
sbb eax, 0x81e0d3a8
pop ss
xchg esi, eax
pop edi
mov bh, 0x96
dec eax
sal esp, cl
xor dword [ebx + 0xf962e5a], 0xb669d138
sar bl, 1
dec eax
invalid
inc ebx
xchg esi, eax
jle 0x414ab8
invalid
loop 0x414a73
xor al, 0xaf
mov dl, 0xe8
sub byte [eax], 0xb7
cmp dword [ecx - 0x2e858a47], edi
add eax, dword [ecx - 0x30]
stosd dword es:[edi], eax
lodsb al, byte [esi]
dec ecx
mov dword [ecx + 0x2ffe1381], 0x31380e96
sub esi, dword [edi - 0xa762a7e]
cmp byte [ecx + 0x59], ch
xlatb
jns 0x414abc
and edi, 0x5f962ec7
arpl word [esi], bp
xchg esi, eax
dec eax
add cl, 9
idiv byte [eax]
cmp dword [eax - 0x5fd138cf], edi
je 0x414b3a
shr dword [ecx - 0x49], 1
cmp cl, dl
imul esi, dword [edi - 0x48962ec8], 0x4869d138
invalid
nop
imul edi, ecx, 0x35b1697f
add dl, byte [edi - 0x2e]
js 0x414baf
mov cl, 0x2c
sahf
invalid
xor dh, byte [esi]
xlatb
xor al, ah
pop edi
inc esi
call 0x511f0e73
xchg byte [esi + 0x3669d138], dh
sti
shr byte [ecx - 0x49], 1
cmp byte [edx], dl
call 0xe98b723c
inc eax
xchg byte [edi - 0x2ecd3b2b], ah
imul esi, dword [edi - 0x48962ec8], 0xb769d138
cmp cl, dl
imul esi, dword [edi - 0x48962ec8], 0xb769d138
cmp cl, dl
imul esi, dword [edi - 0x48962ec8], 0xb769d138
cmp cl, dl
imul esi, dword [edi - 0x48962ec8], 0xc369d138
dec esi
jg 0x414bc2
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x58b0413b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x4b1151b9
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219