joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xa2a3a4a5
mov byte [esp + 4], 0
xor eax, eax
mov ebx, 0x60889915
sub ebx, eax
mov ecx, ebx
and ecx, 0x1c
mov edx, eax
and edx, 3
or edx, ecx
lea ecx, [eax + 0xa]
and ecx, 0x1c
xor ecx, 0x2008981c
or edx, ecx
and ebx, 3
xor ebx, 0x16600203
xor edx, 2
or edx, ebx
movzx ecx, byte [esp + eax]
xor edx, ecx
lea ecx, [edx + edx]
and ecx, 0x5e
xor ecx, 0x58
xor edx, 0x53
add edx, ecx
inc dl
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d530
mov eax, dword [esp]
mov edx, dword [0x449dc8]
test edx, edx
je 0x43d5d8
xor ebx, ebx
mov ecx, dword [0x449dcc]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43d5b0
inc ebx
cmp edx, ebx
jne 0x43d5a0
jmp 0x43d5d8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43d5d8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x20
test edi, edi
je 0x43d5e2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43d5ee
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xa2a3a4a5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax]
mov edi, 0x60889915
sub edi, eax
lea esi, [eax + 0xa]
mov ecx, edi
and ecx, 0x1c
and esi, 0x1c
xor esi, 0x2008981c
mov ebx, eax
and ebx, 3
or ebx, ecx
or ebx, esi
and edi, 3
xor edi, 0x16600203
xor ebx, 2
or ebx, edi
xor ebx, ebp
lea ecx, [ebx + ebx]
and ecx, 0x5e
xor ecx, 0x58
xor ebx, 0x53
add ebx, ecx
inc bl
mov byte [esp + eax], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d620
mov eax, dword [esp]
mov edi, dword [0x449dc8]
test edi, edi
je 0x43d6da
xor ebx, ebx
mov ebp, dword [0x449dcc]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xe88ddea1
je 0x43d6ab
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
cmp ebx, edi
jb 0x43d690
jmp 0x43d6da
mov ebx, dword [ebp + ebx*8 + 4]
cmp ebx, eax
je 0x43d6da
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x30
cmp eax, 0x103
jne 0x43d7a8
mov dword [esp + 0xa], 0xa2a3a4a5
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xa]
mov edi, 0x60889915
sub edi, eax
lea esi, [eax + 0xa]
mov ebx, edi
and ebx, 0x1c
and esi, 0x1c
xor esi, 0x2008981c
mov ecx, eax
and ecx, 3
or ecx, ebx
or ecx, esi
and edi, 3
xor edi, 0x16600203
xor ecx, 2
or ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
and edx, 0x5e
xor edx, 0x58
xor ecx, 0x53
add ecx, edx
inc cl
mov byte [esp + eax + 0xa], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d700
mov eax, dword [esp + 0xa]
mov ecx, dword [0x449dc8]
test ecx, ecx
je 0x43d7a1
xor edx, edx
mov edi, dword [0x449dcc]
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43d780
inc edx
cmp ecx, edx
jne 0x43d770
jmp 0x43d7a1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d7a1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x18
test eax, eax
js 0x43d7a8
mov eax, dword [esp]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43d7bf
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43d7bd
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xa2a3a4a5
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax]
mov edi, 0x60889915
sub edi, eax
lea esi, [eax + 0xa]
mov ecx, edi
and ecx, 0x1c
and esi, 0x1c
xor esi, 0x2008981c
mov ebx, eax
and ebx, 3
or ebx, ecx
or ebx, esi
and edi, 3
xor edi, 0x16600203
xor ebx, 2
or ebx, edi
xor ebx, ebp
lea ecx, [ebx + ebx]
and ecx, 0x5e
xor ecx, 0x58
xor ebx, 0x53
add ebx, ecx
inc bl
mov byte [esp + eax], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d7f0
mov eax, dword [esp]
mov edi, dword [0x449dc8]
test edi, edi
je 0x43d8a0
xor ebx, ebx
mov ebp, dword [0x449dcc]
nop
nop
nop
cmp dword [ebp + ebx*8], 0x88822328
je 0x43d871
inc ebx
cmp edi, ebx
jne 0x43d860
jmp 0x43d8a0
mov ebx, dword [ebp + ebx*8 + 4]
cmp ebx, eax
je 0x43d8a0
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x30
cmp eax, 0x103
jne 0x43d968
mov dword [esp + 0xa], 0xa2a3a4a5
mov byte [esp + 0xe], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xa]
mov edi, 0x60889915
sub edi, eax
lea esi, [eax + 0xa]
mov ebx, edi
and ebx, 0x1c
and esi, 0x1c
xor esi, 0x2008981c
mov ecx, eax
and ecx, 3
or ecx, ebx
or ecx, esi
and edi, 3
xor edi, 0x16600203
xor ecx, 2
or ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
and edx, 0x5e
xor edx, 0x58
xor ecx, 0x53
add ecx, edx
inc cl
mov byte [esp + eax + 0xa], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43d8c0
mov eax, dword [esp + 0xa]
mov ecx, dword [0x449dc8]
test ecx, ecx
je 0x43d961
xor edx, edx
mov edi, dword [0x449dcc]
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43d940
inc edx
cmp ecx, edx
jne 0x43d930
jmp 0x43d961
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43d961
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x18
test eax, eax
js 0x43d968
mov eax, dword [esp]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43d976
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43d9a0
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
add ebx, ecx
mov word [esp + 8], bx
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ecx, [ebx + ecx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 2], 0xa2a3a4a5
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
movzx edi, byte [esp + eax + 2]
mov ebp, 0x60889915
sub ebp, eax
lea ecx, [eax + 0xa]
mov edx, ebp
and edx, 0x1c
and ecx, 0x1c
xor ecx, 0x2008981c
mov ebx, eax
and ebx, 3
or ebx, edx
or ebx, ecx
and ebp, 3
xor ebp, 0x16600203
xor ebx, 2
or ebx, ebp
xor ebx, edi
lea ecx, [ebx + ebx]
and ecx, 0x5e
xor ecx, 0x58
xor ebx, 0x53
add ebx, ecx
inc bl
mov byte [esp + eax + 2], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 5
jb 0x43da20
mov eax, dword [esp + 2]
mov edi, dword [0x449dc8]
test edi, edi
je 0x43dac8
xor ebx, ebx
mov ebp, dword [0x449dcc]
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x43daa1
inc ebx
cmp edi, ebx
jne 0x43da90
jmp 0x43dac8
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43dac8
lea eax, [esp + 0x10]
push esi
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x449dd0]
call fcn.0043ad80
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46e8e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
and edi, 0x161f6
pop edi
push edi
push ebx
add esp, 4
call fcn.0046e84c
add byte [ebx], dh
cmp cl, byte [eax + eax*2 + 0x47]
dec edx
dec ebp
add esp, 4
jmp 0x46e858
and edi, 0x87d2
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
xor eax, 0x1308e
pop eax
push esi
push ecx
add esp, 4
xor esi, 0x33d5
or esi, 0x7a41
pop esi
push esi
add esi, 0x3c5
call 0x46e8e4
add byte [esp + esi + 0x40], al
inc ecx
cmp eax, 0xc4833247
add al, 0x5e
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x46e905
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x46e95f
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x46e82d
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x46e82d
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x46e949
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x46e953
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x46e9a8
push edi
call 0x46e976
add byte [edx], dh
xor eax, 0x4b4c4b44
inc ecx
add esp, 4
and edi, 0x17b93
and edi, 0x12bd5
xor edi, 0x18672
pop edi
push edi
xor edi, 0x1797d
add edi, 0x3a66
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x46ea10
push ebx
push esi
add esp, 4
call 0x46e9bc
add byte [edi + 0x40], cl
xor eax, 0x4c334f45
xor edi, dword [edi]
add esp, 4
sub ebx, 0x13b7c
xor ebx, 0x64f8
pop ebx
push esi
or esi, 0xd0c1
add esi, 0x158f8
pop esi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x46ea06
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x46e7d1
mov dword [ebp - 0x710], 0
Function at 0x46e976
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
and edi, 0x161f6
pop edi
push edi
push ebx
add esp, 4
call fcn.0046e84c
add byte [ebx], dh
cmp cl, byte [eax + eax*2 + 0x47]
dec edx
dec ebp
add esp, 4
jmp 0x46e858
and edi, 0x87d2
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
xor eax, 0x1308e
pop eax
push esi
push ecx
add esp, 4
xor esi, 0x33d5
or esi, 0x7a41
pop esi
push esi
add esi, 0x3c5
call 0x46e8e4
add byte [esp + esi + 0x40], al
inc ecx
cmp eax, 0xc4833247
add al, 0x5e
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x46e905
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x46e95f
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x46e82d
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x46e82d
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x46e949
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x46e953
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x46e9a8
push edi
call 0x46e976
add byte [edx], dh
xor eax, 0x4b4c4b44
inc ecx
add esp, 4
and edi, 0x17b93
and edi, 0x12bd5
xor edi, 0x18672
pop edi
push edi
xor edi, 0x1797d
add edi, 0x3a66
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x46ea10
push ebx
push esi
add esp, 4
call 0x46e9bc
add byte [edi + 0x40], cl
xor eax, 0x4c334f45
xor edi, dword [edi]
add esp, 4
sub ebx, 0x13b7c
xor ebx, 0x64f8
pop ebx
push esi
or esi, 0xd0c1
add esi, 0x158f8
pop esi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x46ea06
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x46e7d1
mov dword [ebp - 0x710], 0
Function at 0x46e9bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
and edi, 0x161f6
pop edi
push edi
push ebx
add esp, 4
call fcn.0046e84c
add byte [ebx], dh
cmp cl, byte [eax + eax*2 + 0x47]
dec edx
dec ebp
add esp, 4
jmp 0x46e858
and edi, 0x87d2
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push eax
xor eax, 0x1308e
pop eax
push esi
push ecx
add esp, 4
xor esi, 0x33d5
or esi, 0x7a41
pop esi
push esi
add esi, 0x3c5
call 0x46e8e4
add byte [esp + esi + 0x40], al
inc ecx
cmp eax, 0xc4833247
add al, 0x5e
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x46e905
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x46e95f
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x46e82d
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x46e82d
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x46e949
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x46e953
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x46e9a8
push edi
call 0x46e976
add byte [edx], dh
xor eax, 0x4b4c4b44
inc ecx
add esp, 4
and edi, 0x17b93
and edi, 0x12bd5
xor edi, 0x18672
pop edi
push edi
xor edi, 0x1797d
add edi, 0x3a66
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x46ea10
push ebx
push esi
add esp, 4
call 0x46e9bc
add byte [edi + 0x40], cl
xor eax, 0x4c334f45
xor edi, dword [edi]
add esp, 4
sub ebx, 0x13b7c
xor ebx, 0x64f8
pop ebx
push esi
or esi, 0xd0c1
add esi, 0x158f8
pop esi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x46ea06
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x46e7d1
mov dword [ebp - 0x710], 0
Function at 0x100018c0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10048040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10001a11
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
xorps xmm0, xmm0
push eax
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10001a0a
mov ebx, 1
nop
cmp dword [ebp - 0x20], 0x10
jb 0x100019a4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100019a4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100019a4
mov edx, dword [esi]
test edx, edx
jne 0x10001969
push 0x200
push 8
push dword [0x1004e230]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100019c9
lea edi, [esi + 8]
jmp 0x10001997
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x10001997
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 8
push dword [0x1004e230]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10001a24
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10001920
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10001a0a
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10001a0a
push eax
push ebx
push dword [0x1004e230]
call dword [sym.imp.KERNEL32.dll_HeapSize]
cmp eax, 0xffffffff
je 0x100019f4
test eax, eax
je 0x100019f4
push eax
push ebx
push dword [esi]
call fcn.10034f00
add esp, 0xc
push dword [esi]
push 0
push dword [0x1004e230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a6fb
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x100019c9
Function at 0x10001a30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.100018c0
test eax, eax
jne 0x10001a63
mov eax, 9
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0
je 0x10001ad5
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10001acd
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10001abd
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10001ab0
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10001730
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x10001ac6
mov ecx, dword [esi]
mov dword [ecx + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jb 0x10001a71
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001ae0
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10001b57
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10001b20
push ebx
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x10001b19
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10001b19
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10001af1
pop ebx
push dword [edi]
push 0
push dword [0x1004e230]
call dword [sym.imp.KERNEL32.dll_HeapSize]
pop esi
cmp eax, 0xffffffff
je 0x10001b47
test eax, eax
je 0x10001b47
push eax
push 0
push dword [edi]
call fcn.10034f00
add esp, 0xc
push dword [edi]
push 0
push dword [0x1004e230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x10001b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10048040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
mov dword [ebp - 8], 0
push edi
add esi, dword [0x10050468]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001bc8
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a6fb
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10001be9
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10001c0a
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10001c0a
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10001c04
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10001c0a
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1001a6fb
mov esp, ebp
pop ebp
ret
Function at 0x10002eb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0x20206
push 0
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10002f14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002f55
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002f20
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a6fb
mov esp, ebp
pop ebp
ret

Function at 0x10002f70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
jne 0x10002f92
push str.Ini_is_not_available__r_n_r_n
push 1
call fcn.10002ac0
add esp, 8
xor eax, eax
pop esi
pop ebp
ret 0xc
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10027be2
mov dword [eax], 0
push dword [esi]
mov esi, dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10002fd6
call fcn.10027be2
cmp dword [eax], 0
jne 0x10002fd6
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
push str.GetPrivateProfileInt_Failed__r_n_r_n
push 1
call fcn.10002ac0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10012fd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10048040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x104
mov ebx, edx
mov edi, ecx
push ebx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
test eax, eax
je 0x1001302b
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push ebx
call fcn.1002207e
add esp, 0xc
neg eax
sbb esi, esi
and esi, 0x80070057
test esi, esi
js 0x100130b9
mov ecx, dword [edi + 0x10]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 4
jb 0x100130cc
cmp dword [edi + 0x14], 7
jbe 0x1001304e
mov edi, dword [edi]
push 4
push ecx
push ecx
push edi
push ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.100191d0
cmp dword [ebp - 0xc], 7
lea eax, [ebp - 0x20]
cmova eax, dword [ebp - 0x20]
push eax
push 0x104
push ebx
call fcn.1002207e
mov ecx, dword [ebp - 0xc]
add esp, 0xc
neg eax
sbb esi, esi
and esi, 0x80070057
cmp ecx, 7
jbe 0x100130b9
mov edx, dword [ebp - 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100130af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100130d1
push ecx
push edx
call fcn.1001a858
add esp, 8
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a6fb
mov esp, ebp
pop ebp
ret
call fcn.10002840
call fcn.10022409
int3