joyce8/EMBER2024-capa huggingface dataset:
Function at 0x179009f
Capabilities:
Encode data using base64

Disassembly:
dec esi
lea ebx, [ebp - 0x26db0b7c]
neg ebx
movzx ecx, dx
not ebx
inc ecx
movsx eax, sp
not dword [esp + ecx - 0xffbb]
dec eax
and ecx, esi
bswap ebx
jge 0x176e010
sub byte [esp + ecx*2 - 0x1ff75], 0x87
dec esp
mov dword [esp + ecx - 0xffbe], edx
dec esp
lea eax, [edx*2 + 0x462043a6]
xor dword [esp + ecx*2 - 0x1ff7c], ebx
inc ecx
pop edx
inc ecx
mov edi, esp
dec eax
arpl bx, bx
sal di, 0xd
call fcn.0124455d
mov ecx, 0x42b62385
or ecx, 0x22118184
mov eax, dword [esi + ecx - 0x62b7a385]
mov dx, word [ecx + esi - 0x62b7a381]
lea esi, [esi + ecx - 0x62b7a37f]
shl cx, 3
mov word ss:[eax + ecx - 0x62b71c28], dx
movzx eax, cx
movsx edx, cl
neg eax
mov edx, dword [edi + ecx - 0x62b71c28]
call fcn.0171db6a
iretd
inc ecx
mov ebx, dword [ecx]
inc ecx
xor ebx, edx
inc ecx
movsx esi, ah
dec eax
mov dword [esp], 0x2aaa7d0d
neg ebx
inc eax
movsx ebp, dh
mov edx, ebp
xor dword [esp + 2], 0x3397fb2e
inc ebx
dec bp
not ebx
jno 0x176a58b

Function at 0x1790332
Capabilities:
Encode data using xor

Disassembly:
add edi, 0xe70e3b85
neg edi
push 0xe33eaaa5
add edi, 0xc228f2a1
dec esp
mov dword [esp + 0x18], edx
dec eax
mov dword [esp + 0x10], 0xaeb2f9bc
xor dword [esp + 0x18], edi
shl dword [esp + 0x13], 0x46
mov edx, 0x29a21694
dec esp
mov edx, dword [esp + edx*2 - 0x53442d10]
mov eax, 0x862455a6
dec eax
mov dword [esp + edx*2 - 0x53442d20], 0xd3a3df30
dec eax
arpl di, di
dec esp
add edi, edi
dec ecx
mov ebp, esi
inc esp
movsx ebx, byte [esp + edx*2 - 0x53442d1d]
dec eax
mov ecx, ebp
dec eax
mov dword [esp + edx*2 - 0x53442d10], eax
pop edx
inc sp
mov ebx, dword [ecx + edx + 0x1cc1555b]
dec eax
or dword [esp + edx*4 + 0x7305557c], 0x64250b29
xadd byte [esp + edx + 0x1cc15571], dh
pop edx
inc bp
mov dword [esi + edx*2 + 0x58b8419e], ebx
add word [esp + edx + 0x2c5c20db], 0xaf1e
adc dword [esp + edx + 0x2c5c20d4], eax
dec ebp
lea esi, [esi + edx + 0x2c5c20ce]
movsx esi, al
push edx
dec eax
lea ecx, [edx + 0x7a861606]
pop eax
pop eax
pop edi
jl fcn.012669aa
inc edx
invalid
Function at 0x1796d78
Capabilities:
Encode data using base64

Disassembly:
inc eax
dec ch
dec eax
and ecx, edi
dec ecx
mov dword [esi + ebx - 0x371dee17], ecx
jmp 0x12772af
mov esi, 0x371dee1f
dec ecx
mov ecx, dword [esi + esi*2 - 0x6e3bdc3e]
movsx ebx, si
mov ebp, 0x4fb488b8
dec eax
xchg esi, ebx
dec ecx
mov edi, dword [esi + ebx - 0x371dee17]
movsx edx, bl
push ebx
dec eax
not ecx
neg dword [esp + ebx - 0x371dee1e]
inc esp
movsx ebx, dl
ror bp, 0xe4
dec eax
not edi
jb 0x126081a
call fcn.016eefd0
jmp 0x12638fc

Function at 0x179ab7f
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi + ecx*4 + 4]
lea esi, [esi + ecx + 4]
lea ecx, [ecx*4 + 0x329984b4]
dec cx
or edx, eax
xchg ch, cl
not edx
call fcn.012576e1
xor dl, 0xba
dec dl
not dl
xor al, cl
xchg byte [esp + eax*4 - 0x2f9], cl
adc dl, 0x29
call fcn.01316d4e
add ebp, eax
lea eax, [edx + edx*2 + 0x55bd5c07]
pop edx
mov edx, dword [esi + edx*2 - 0x4f097720]
xor ax, ax
movzx ecx, al
jae 0x1239f95
dec ebp
or bl, byte [edx + 0x23]
cli
inc eax
push ss
xlatb
mov ebx, 0xebb76b9a
ret
mov dword [edx + ecx - 0x45aeb93d], eax
mov dword [esp + ecx - 0x45aeb93d], 0xe501b291
or ecx, ecx
mov edx, dword [edi + ecx - 0x45aeb93d]
shr word [esp + ecx - 0x45aeb93d], 1
lea edi, [edi + ecx - 0x45aeb939]
xor edx, ebx
movsx eax, word [esp + ecx - 0x45aeb93d]
push ecx
ror ecx, 0xa2
xor edx, 0x2d152bb9
dec word [esp + ecx - 0x516bae4b]
ror edx, 1
dec edx
xadd ecx, eax
ror edx, 1
sal byte [esp + eax - 0x516bae4d], 0x65
sar cl, 0x85
add dword [esp + eax - 0x516bae4b], 0x8023650b
sub edx, 0x43b16702
rol ax, 0x24
inc dword [esp + eax - 0x516be4f9]
xchg ah, cl
xor ebx, edx
xadd dword [esp + eax - 0x516bfcf9], ecx
dec ax
jge 0x1735685
adc ebp, edx
rol al, 1
or cx, 0x5bc
mov dword [esp + ecx - 0x5245c5be], ebp
ret 4
Function at 0x179c6db
Capabilities:
Encode data using base64

Disassembly:
call eax
ret
movzx ebp, di
dec eax
lea ecx, [edi + ecx - 0x6e83ecc]
inc ebp
xor esp, edx
or dx, si
jne 0x170c16c
call fcn.0171f1c6
dec eax
lea ebp, [edx + ebx*4 - 0x2d670ae6]
inc ecx
push ebx
dec esp
mov dword [esp + ecx*2 + 0x3f475406], edi
ret
inc ecx
rol esp, 1
inc ecx
not esp
movsx ebx, al
inc ecx
neg ch
inc ebp
lea esp, [esp + edx - 0x4278dc1f]
xadd ebp, ecx
inc ecx
xor esp, 0xcd9445a2
shl esi, cl
inc ecx
add esi, ebp
inc ecx
push edx
xor edx, 0xb9388580
call fcn.0126aa5e
push eax
not eax
sets al
push 0
mov eax, 0xbdba703c
push edx
bswap ax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x12231b4
dec esp
mov dword [esp + ebp - 0x782eaec6], edx
inc esp
xor byte [esp + ebp - 0x782eaecb], al
xor dword [esp + ebp - 0x782eaec6], eax
inc ecx
mov edx, 0x228d9c10
dec esp
mov edx, dword [esp + ebp - 0x782eaec6]
inc esp
movzx ebp, word [esp + edx - 0x6b290284]
inc esp
mov esp, dword [esp + edx - 0x6b290282]
inc cx
not eax
inc edx
or dword [esp + ebp - 0xb555], 0x76a899bd
cmovns dx, word [esp + edx - 0x6b290280]
inc ecx
pop ebx
not si
inc ecx
movzx eax, sp
js 0x1762d54
inc edx
movsx edi, word [esp - 0x1f9]
inc sp
and eax, esi
mov ecx, 0xc61dc5b6
inc bp
mov dword [esi + edx - 0x6b29a899], eax
inc ecx
pop ebx
inc edi
mov esp, dword [ecx + ebp*2 - 0x16ac2]
dec eax
lea esi, [eax + eax - 0x2664d343]
dec edi
lea ecx, [ecx + ebp - 0xb55d]
jmp 0x1258206

Function at 0x17a0dd5
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebx
jnp 0x1748cb8
sal edx, 2
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 0x10]
je 0x17b946c

Function at 0x17a20d5
Capabilities:
Encode data using base64

Disassembly:
ror ax, cl
adc ebp, edx
pop ecx
pop eax
pop eax
pop eax
pop ecx
jmp fcn.0171e965

Function at 0x17a3d46
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x15ff0b00
lea esp, [esp + 8]
call fcn.01753e63

Function at 0x17a607d
Capabilities:
Encode data using base64

Disassembly:
neg ecx
xchg edx, eax
mov dword [esp + eax*2 - 0x124], eax
ror word [esp + eax - 0x91], 0x2a
inc ecx
ror ecx, 1
rol dword [esp + eax*8 - 0x490], 0xa2
dec ecx
sar ax, 0x2f
ror dword [esp + eax*2], 0xed
shl dword [esp + eax], 0x22
neg ecx
not eax
xor ebx, ecx
lea eax, [edx + eax*2 + 0x28286496]
lea edx, [eax + eax*2 + 0x6738f781]
add ebp, ecx
shl edx, 0xf4
pop edx
jb fcn.0171e965
mov edx, 0xa09aa2f
call fcn.017a4907
Function at 0x17a6f06
Capabilities:
Encode data using base64

Disassembly:
dec ecx
mov esi, dword [esi + edi + 2]
sub di, bp
inc cx
xadd ebp, edi
inc ecx
adc cl, byte [esi + edi - 0x7b1b]
sar dx, 0xee
xor ebp, ebx
dec eax
sal esi, cl
dec eax
ror ebp, 0xf4
call fcn.0125dcff
js 0x17928ca
ror edx, 0xec
add ebp, ecx
pop ecx
neg eax
jle 0x177ee2a
mov esi, dword [esi + eax - 0x5ae34300]
jbe fcn.0171e965
adc esi, 2
shr word [esp + 1], 0x81
mov word [esp + 1], 0x2d94
shr cx, 1
not byte [esp + 2]
mov eax, dword [esp]
rcr edx, cl
mov ecx, 0xf0801e1e
mov dword [esi], edx
call fcn.01276e84
inc ecx
xor eax, edx
inc esp
movsx eax, bl
ror cx, cl
dec ecx
xor eax, 0x2587921b
bswap eax
dec ecx
lea esi, [esp - 0x10f91973]
inc ebp
xadd ah, al
xchg ebx, ecx
neg eax
shl ebp, 0x78
bswap eax
not eax
bswap eax
not eax
dec eax
inc ecx
push edx
inc edx
xor dword [esp - 0x8500], eax
dec esp
lea ebp, [ebx + ebp*8 - 0xd7930c2]
inc ecx
pop edx
shr edi, 0x5c
dec eax
arpl ax, ax
inc eax
movsx edx, ch
and edx, 0x4aa6849e
dec esp
adc edi, eax
rol bp, 0x69
add dx, cx
jae 0x126fae3
call fcn.0172cbd8
xor edx, edx
add eax, edx
xor ebx, ecx
shl dword [esp + edx*4 + 3], 0xfb
add ebp, ecx
rol dl, 0x83
lea eax, [edx + esi - 2]
mov dword [esi + edx*4 - 6], eax
jae 0x1234a9e
mov edx, 0xa51cef96
movzx ecx, dx
mov ecx, dword [edi + ecx - 0xef96]
push edx
pop eax
add edi, 4
neg al
xor ecx, ebx
not ecx
rol edx, 0x37
ror ecx, 2
dec dl
rol dl, 0xc2
shl ax, 0x62
not ecx
dec edx
sar dx, 0xd
inc ecx
sal dl, 6
xchg dl, al
shl dl, 0x45
xor ebx, ecx
push edx
jmp 0x13397a8
inc ecx
dec ebx
call fcn.01329099
mov eax, dword [edi]
mov ecx, 0xa2011b92
movsx edx, cl
dec cl
add edi, 4
shr edx, 0x83
setbe dl
rol edx, cl
xor eax, ebx
inc eax
xor eax, 0xc6ada783
ror edx, 0x1b
rol dl, 0x23
xor edx, edx
rol eax, 2
dec cx
push ecx
shr edx, cl
bswap eax
inc eax
not edx
and cx, 0x521b
xor ebx, eax
and cl, 0x1a
adc word [esp + 2], dx
add ebp, eax
mov edx, dword [esi]
mov dword [esp], ecx
sar byte [esp + 3], 0x62
or ecx, ecx
mov cx, word [esi + 4]
jne 0x132e997

Function at 0x17ad028
Capabilities:
Execute syscall

Disassembly:
pop ecx
dec ecx
sal ebx, 0xd7
dec esp
mov dword [esp + edi*4], edx
inc ecx
push eax
call fcn.012318a5

Function at 0x17ad038
Capabilities:
Execute syscall

Disassembly:
lea eax, [eax + eax*2 + 0x2f1cee0c]
ror dl, 1
call fcn.016ea781
syscall
pushfd
inc ecx
push edi
dec eax
mov dword [esp + 8], 0x6be6095
dec eax
lea esp, [esp + 8]
call fcn.01225a45
mov dword [esp + edx - 1], ebp
ret
Function at 0x17b1183
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1222459
lea esi, [eax + esi - 0x7371a02]
sar edx, 0xee
neg al
mov word [esi + eax - 0x7371a00], cx
mov dword [esp + eax*2 - 0xe6e3400], eax
mov eax, dword [edi + eax*8 - 0x39b8d000]
adc edx, dword [esp + edx]
movsx ecx, dx
pop edx
lea edi, [edi + edx - 0x73719fc]
xor edx, ecx
xor eax, ebx
xor cl, ch
not dx
dec eax
neg dx
rol eax, 1
shl dx, 0xd
neg eax
shr edx, cl
rol eax, 3
jmp 0x16f859b
Function at 0x17ba747
Capabilities:
Encrypt data using chaskey

Disassembly:
dec ecx
mov eax, dword [esi + ebp - 0x521c6203]
inc ebp
movzx esp, byte [ecx + ebp - 0x521c61ff]
inc ecx
ror eax, 0xf8
inc ecx
push eax
pop edx
inc ebp
xor ah, dl
inc ecx
dec ah
inc ecx
rol ah, 1
inc eax
or ch, ch
inc eax
movsx edi, ch
inc ecx
neg ah
inc ecx
rol ah, 1
inc ecx
xor ah, 0x16
dec eax
mov dword [esp + edi + 0x15], 0x7416271b
mov ecx, dword [esp + ebp - 0x521c61f2]
inc ebp
xor dl, ah
call fcn.0172b6de

Function at 0x17ba791
Capabilities:
Encrypt data using chaskey

Disassembly:
inc ebp
xor esp, esp
dec eax
test esi, esi
dec eax
lea esp, [esp + 0x10]
je 0x1234457
mov edi, 0x11128b23
dec eax
lea ebx, [0xfff55622]

Function at 0x17c3747
Capabilities:
Encode data using base64

Disassembly:
lea edx, [edx + edx + 0x4c10722a]
adc ebp, eax
mov ecx, dword [edi + ecx*4]
mov dword [esp + edx - 0x4026045e], 0x169603a7
sar dx, 0xac
lea edi, [edi + edx - 0x4025fff8]
xor ecx, ebx
call fcn.01799e5d
call fcn.01276e61

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x86340c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x487c0928
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001c55
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001c8b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10001c87
cmp esi, edx
jae 0x10001c8b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10001c77
cmp esi, edx
jb 0x10001c91
pop esi
pop edi
xor eax, eax
pop ebx
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x1000a100
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100418db
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi + 4], 0
lea ecx, [edi + 8]
mov dword [edi], vtable.ATL::CComPolyObject_class_ATL::CAxHostWindow_.0
call fcn.100059d0
mov dword [edi + 8], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.0
mov dword [edi + 0x2c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.1.0
mov dword [edi + 0x30], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.2.0
mov dword [edi + 0x34], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.3.0
mov dword [edi + 0x38], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.4.0
mov dword [edi + 0x3c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.5.0
mov dword [edi + 0x40], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.6.0
mov dword [edi + 0x48], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.7.0
mov dword [edi + 0x4c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.8.0
mov dword [edi + 0x50], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.9.0
mov dword [edi + 0x54], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.10.0
mov dword [edi + 0x58], edi
mov dword [esp + 0x18], 0
mov ecx, dword [0x1005e8ec]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1000bea0
Capabilities:
Get file attributes

Disassembly:
push ebp
push esi
xor esi, esi
mov ebp, edx
push edi
mov edi, ecx
cmp dword [0x1005e90c], esi
jne 0x1000bef3
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1000bee2
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1005e910], eax
mov dword [0x1005e90c], 1
jmp 0x1000bef8
mov eax, dword [0x1005e910]
mov dword [0x1005e90c], 1
jmp 0x1000bef8
mov eax, dword [0x1005e910]
test eax, eax
je 0x1000bf15
push dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000bf15
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
mov eax, dword [ebp]
test eax, eax
jne 0x1000bf3c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1000bf2e
push dword [edi + 0xc]
mov eax, dword [edi + 8]
jmp 0x1000bf33
push dword [edi + 4]
mov eax, dword [edi]
call eax
test eax, eax
je 0x1000bf0d
mov dword [ebp], eax
push dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
pop esi
pop ebp
ret 4
Function at 0x1000d6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10041d20
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x30], 0
xor edi, edi
mov eax, dword [esp + 0x38]
cmp dword [ebx + 0xc], edi
jbe 0x1000d73d
xor ebp, ebp
cmp edi, dword [ebx + 0xc]
jae 0x1000d77e
mov edx, dword [ebx + 8]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x1000d80d
mov ecx, dword [edx + ebp]
mov edx, eax
mov edi, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x1000d726
test si, si
je 0x1000d722
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1000d726
add ecx, 4
add edx, 4
test si, si
jne 0x1000d700
xor ecx, ecx
jmp 0x1000d72b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
jne 0x1000d779
inc edi
add ebp, 0x18
cmp edi, dword [ebx + 0xc]
jb 0x1000d6e7
xor edi, edi
lea esi, [eax - 0x10]
mov dword [esp + 0x30], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000d761
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
cmp edi, dword [ebx + 0xc]
jb 0x1000d788
push 0x80070057
call fcn.10002280
mov eax, dword [ebx + 8]
lea ecx, [edi + edi*2]
xor edx, edx
mov word [esp + 0x14], dx
lea eax, [eax + ecx*8]
add eax, 8
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jns 0x1000d7bf
mov ecx, 0xa
mov dword [esp + 0x1c], eax
push eax
mov word [esp + 0x18], cx
call fcn.10002280
mov esi, dword [esp + 0x3c]
mov byte [esp + 0x30], 1
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
je 0x1000d7f8
push esi
call edi
test eax, eax
js 0x1000d7f8
push 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
push esi
call fcn.1002b1c3
push eax
call fcn.10001ca0
add esp, 0x14
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push eax
call edi
mov eax, dword [esp + 0x38]
mov edi, 1
jmp 0x1000d73f
push 0x80004005
call fcn.10002280
int3

Function at 0x1000de30
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push str.Version
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000dea6
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x1000de74
cmp eax, 2
jne 0x1000de91
mov ecx, dword [esp + 0x14]
test esi, esi
je 0x1000dea0
test ecx, ecx
je 0x1000de9b
test cl, 1
jne 0x1000de91
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1000dea0
pop edi
mov eax, 0xd
pop esi
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
ret 0xc
Function at 0x1000deb0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x1000dec2
lea eax, [edx + 0xd]
pop esi
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x1000ded0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ded0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x1000f7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10041608
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
push 0x100455b0
push 0
push 0x17
push dword [esp + 0x30]
call dword [sym.imp.ole32.dll_CoGetClassObject]
mov esi, eax
test esi, esi
js 0x1000f810
push dword [esp + 0xc]
mov ecx, edi
call fcn.1000f6f0
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000f826
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x10010080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100100f4
push ebx
push esi
mov esi, dword [esp + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.EnableLUA
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
cmp dword [esp + 0xc], ebx
setne bl
test esi, esi
je 0x100100ec
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x10010100
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.1002d180
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x10010164
cmp dword [esp + 8], 1
jne 0x100101c6
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1002af5f
add esp, 0x118
ret
cmp eax, 6
jne 0x100101c6
mov eax, dword [esp + 8]
sub eax, 0
je 0x100101ac
dec eax
je 0x10010192
dec eax
jne 0x100101c6
mov eax, 4
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1002af5f
add esp, 0x118
ret
mov eax, 3
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1002af5f
add esp, 0x118
ret
mov eax, 2
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1002af5f
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor eax, eax
xor ecx, esp
call fcn.1002af5f
add esp, 0x118
ret
Function at 0x10011400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10041ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x14], 0
push ecx
mov dword [esp + 0x2c], 1
mov esi, esp
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
mov dword [esp + 0x1c], esp
call fcn.1000abe0
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [esp + 0x30], 2
mov esi, esp
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.1000abe0
add eax, 0x10
mov edx, edi
mov dword [esi], eax
mov ecx, ebx
mov byte [esp + 0x30], 1
call fcn.10011f20
mov byte [esp + 0x30], 0
or esi, 0xffffffff
mov edx, dword [esp + 0x38]
add esp, 8
add edx, 0xfffffff0
mov eax, esi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100114a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x100114c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x10012510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100421a1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi], 5
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
mov dword [esp + 0x14], eax
mov byte [esi + 0x1c], al
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], eax
mov word [esi + 0x20], ax
mov byte [esp + 0x14], 1
xorps xmm0, xmm0
mov byte [esi + 0x38], al
mov eax, dword [0x1005ead0]
movq qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 1
mov byte [esi + 0x4c], 1
test al, 1
jne 0x100125b9
or eax, 1
mov dword [0x1005eb08], 7
mov dword [0x1005ead0], eax
xor eax, eax
push 0x10043f10
mov dword [0x1005eb04], 0
mov word [0x1005eaf4], ax
call fcn.1002b1ae
add esp, 4
xor eax, eax
mov dword [esi + 0x64], 7
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
mov dword [ecx + 0x10], 0
push eax
push 0x1005eaf4
mov word [ecx], ax
call fcn.100116b0
mov byte [esp + 0x14], 2
mov al, byte [esi]
cmp al, 5
je 0x10012607
cmp al, 4
je 0x10012607
mov dword [esi + 0x68], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
push 0xc
call fcn.1002b336
add esp, 4
test eax, eax
je 0x1001262b
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
jmp 0x1001262d
xor eax, eax
mov dword [esi + 0x68], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4