joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009fa39
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d1040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, ecx
mov dword [esp + 0x14], edi
xor ebp, ebp
mov dword [edi], vtable.CAPEDecompressOld.0
mov dword [esp + 0x24], ebp
mov dword [edi + 0xc], 1
mov dword [edi + 4], ebp
lea ecx, [edi + 0x2c]
mov byte [esp + 0x24], 1
call fcn.1006da20
lea esi, [edi + 0x60]
mov dword [esi + 8], 1
mov dword [esi], ebp
mov ecx, esi
mov byte [esp + 0x24], 3
mov dword [ebx], ebp
call fcn.1006a690
mov eax, dword [esp + 0x30]
push ebp
push ebp
mov ecx, eax
push 0x3e8
mov dword [esi + 8], 1
mov dword [esi + 4], ebp
mov dword [esi], eax
call fcn.1006c040
cmp eax, 0xf50
jle 0x1006aa89
mov dword [ebx], 0xffffffff
jmp 0x1006ab2a
mov ecx, dword [esi]
push ebp
push ebp
push 0x3ef
call fcn.1006c040
mov ebx, dword [esp + 0x34]
cmp ebx, ebp
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ebp
mov dword [edi + 0x6c], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x24], ebp
jge 0x1006aab2
xor eax, eax
jmp 0x1006aad6
mov ecx, dword [esi]
push ebp
push ebp
push 0x3f8
call fcn.1006c040
cmp ebx, eax
jge 0x1006aac8
mov eax, ebx
jmp 0x1006aad6
mov ecx, dword [esi]
push ebp
push ebp
push 0x3f8
call fcn.1006c040
mov ecx, dword [esi]
mov ebx, dword [esp + 0x38]
push ebp
push ebp
push 0x3f8
mov dword [edi + 0x1c], eax
call fcn.1006c040
cmp ebx, ebp
jl 0x1006ab05
cmp ebx, eax
jge 0x1006aaf7
mov eax, ebx
jmp 0x1006ab05
mov ecx, dword [esi]
push ebp
push ebp
push 0x3f8
call fcn.1006c040
mov dword [edi + 0x20], eax
cmp dword [edi + 0x1c], ebp
jne 0x1006ab22
mov esi, dword [esi]
push ebp
push ebp
push 0x3f8
mov ecx, esi
call fcn.1006c040
cmp dword [edi + 0x20], eax
je 0x1006ab27
mov ebp, 1
mov dword [edi + 0x28], ebp
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1005710f
add esp, 0x14
ret 0x10
Function at 0x1006db60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
push ebx
push ebp
xor eax, eax
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], eax
cmp ecx, 2
jne 0x1006dc51
xor edi, edi
cmp dword [esp + 0x28], ecx
mov dword [esp + 0x24], ebp
jl 0x1006dc09
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub eax, ecx
lea esi, [ecx + 4]
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov ebx, dword [esi - 4]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + edi*4]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
lea eax, [ebx + ecx]
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, ebp
lea ebp, [eax + ebx]
mov ebx, dword [esi]
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + esi]
sar eax, 1
sub ecx, eax
lea eax, [ebx + ecx]
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, dword [esp + 0x24]
add edi, 2
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
dec eax
add esi, 8
cmp edi, eax
jl 0x1006dba0
mov eax, dword [esp + 0x10]
cmp edi, dword [esp + 0x28]
jge 0x1006dc3f
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + edi*4]
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + edi*4]
sar eax, 1
sub edi, eax
lea eax, [ecx + edi]
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov dword [esp + 0x10], ecx
mov eax, ecx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
add ecx, ebp
pop ebp
add eax, ecx
pop ebx
add esp, 8
ret 0x10
cmp ecx, 1
jne 0x1006dca0
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
xor edi, edi
xor ecx, ecx
cmp ebx, 2
jl 0x1006dc8c
dec ebx
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esi + ecx*4 + 4]
cdq
xor eax, edx
sub eax, edx
add ecx, 2
add ebp, eax
cmp ecx, ebx
jl 0x1006dc68
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
cmp ecx, ebx
jge 0x1006dc9c
mov eax, dword [esi + ecx*4]
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x10], eax
add ebp, edi
add eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x10070530
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, 1
mov ebp, ecx
mov dword [esp + 0x10], 0
mov esi, ebx
mov dword [edi], eax
test ebx, ebx
jle 0x10070585
cmp dword [edi], 0
jbe 0x10070585
test eax, eax
je 0x10070585
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 4]
push 0
push edi
sub eax, esi
push esi
add eax, ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x10070581
mov ecx, dword [edi]
sub esi, ecx
add dword [esp + 0x10], ecx
test esi, esi
jg 0x10070554
mov edx, dword [esp + 0x10]
neg eax
mov dword [edi], edx
pop edi
sbb eax, eax
pop esi
and eax, 0xfffffc18
pop ebp
add eax, 0x3e8
pop ebx
pop ecx
ret 0xc

Function at 0x10071980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a01d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100d1040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
push eax
call fcn.1006f8b0
mov ebx, dword [esp + 0x28]
cmp ebx, 0xf28
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.CUnBitArrayOld.0
mov ecx, 0x40000
jg 0x10071a15
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
push 0
push 0
push 0x3f0
mov ecx, edi
call eax
imul eax, eax, 0x32
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, 0x10000
cmp eax, ecx
jle 0x10071a0e
mov edi, edi
add ecx, ecx
cmp ecx, eax
jl 0x10071a00
cmp ecx, 0x40000
jg 0x10071a22
mov ecx, 0x40000
jmp 0x10071a22
cmp ebx, 0xf32
jg 0x10071a22
mov ecx, 0x10000
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
push ebx
push ecx
push 0
push 0
push 0x403
mov ecx, edi
call eax
push eax
mov ecx, esi
call fcn.1006fa90
cmp dword [esi + 0x14], 0xf28
mov eax, esi
jg 0x10071a6a
mov ecx, dword [esi + 0xc]
sub ecx, 0x20000
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [esi + 0xc]
sub edx, 0x200
mov dword [esi + 0x30], edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc

Function at 0x100722f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, ecx
cmp dword [edx + 0x34], 0x800000
ja 0x10072351
push esi
push edi
mov edi, dword [edx + 0x24]
mov eax, dword [edx + 0x20]
mov esi, eax
and esi, 0x1f
mov ecx, 0x18
sub ecx, esi
mov esi, eax
shr esi, 5
mov esi, dword [edi + esi*4]
shl dword [edx + 0x34], 8
add eax, 8
mov dword [edx + 0x20], eax
mov eax, dword [edx + 0x38]
shr esi, cl
mov ecx, dword [edx + 0x30]
shl eax, 8
shl ecx, 8
and esi, 0xff
or eax, esi
mov dword [edx + 0x38], eax
shr eax, 1
and eax, 0xff
or eax, ecx
mov dword [edx + 0x30], eax
cmp dword [edx + 0x34], 0x800000
jbe 0x10072300
pop edi
pop esi
mov ecx, dword [esp + 4]
shr dword [edx + 0x34], cl
mov ecx, dword [edx + 0x34]
mov eax, dword [edx + 0x30]
xor edx, edx
div ecx
ret 4
Function at 0x10072370
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0x800000
push edi
ja 0x100723cf
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov edx, eax
and edx, 0x1f
mov ecx, 0x18
sub ecx, edx
mov edx, eax
shr edx, 5
mov edx, dword [edi + edx*4]
shl dword [esi + 0x34], 8
add eax, 8
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x38]
shr edx, cl
mov ecx, dword [esi + 0x30]
shl eax, 8
shl ecx, 8
and edx, 0xff
or eax, edx
mov dword [esi + 0x38], eax
shr eax, 1
and eax, 0xff
or eax, ecx
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], 0x800000
jbe 0x10072380
mov edi, dword [esi + 0x30]
mov ecx, dword [esp + 0xc]
shr dword [esi + 0x34], cl
mov ecx, dword [esi + 0x34]
mov eax, edi
xor edx, edx
div ecx
imul ecx, eax
sub edi, ecx
mov dword [esi + 0x30], edi
pop edi
pop esi
ret 4
Function at 0x10092080
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x10092120
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x100920d2
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x100ab238]
xor eax, edx
inc esi
cmp esi, edi
jl 0x100920b3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x100920fb
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x100ab238]
xor eax, edx
inc esi
cmp esi, edi
jl 0x100920de
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x10001f65
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x10004bd9
call fcn.1000212f
test byte [0x100063d4], 1
jne 0x10001fa3
or dword [0x100063d4], 1
and dword [ebp - 4], 0
push 0x1f4
mov ecx, 0x100063b4
call fcn.1000165e
push 0x10004c81
call fcn.10001467
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [ebp + 8]
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
and dword [ebp - 0x14], 0
mov ebx, 0x100020d8
push ebx
push 1
push 0
mov edi, 0x100020c8
push edi
call esi
mov dword [ebp - 0x10], eax
cmp eax, 0x800401f0
jne 0x1000209a
cmp dword [0x100063b0], 0
jne 0x1000208c
push 0x100063b4
lea ecx, [ebp - 0x1c]
call fcn.10001eba
xor eax, eax
mov dword [ebp - 4], 1
cmp dword [0x100063b0], eax
jne 0x10002072
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
mov dword [0x100063ac], eax
cmp eax, ecx
jne 0x10002043
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10002024
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call fcn.10001ef1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x1000209a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1000209a
push ecx
push ecx
push ecx
push 0x10001f0d
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10002010
push 0xffffffffffffffff
push dword [0x100063ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x100063b0], 1
lea ecx, [ebp - 0x1c]
call fcn.10001ef1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x1000208c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
push ebx
push 1
push 0
push edi
call esi
mov dword [ebp - 0x10], eax
mov eax, dword [0x100063ac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100020b3
push eax
call esi
and dword [0x100063ac], 0
cmp dword [ebp - 0x14], 0
je 0x100020be
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x10]
call fcn.100021a6
ret
Function at 0x10002f57
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000607c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x10003244
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 0x18]
mov word [ecx], ax
call fcn.10001dcb
mov ecx, dword [ebp + 0x20]
push dword [ebp + 8]
xor eax, eax
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10003097
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10003097
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003097
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10003097
movzx esi, word [edi]
mov eax, esi
shr eax, 1
add eax, esi
call fcn.100016d0
mov ebx, esp
push esi
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10003210
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10003031
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx]
xor eax, eax
cmp cx, word [eax*8 + 0x100030b0]
je 0x1000301f
inc eax
cmp eax, 0x27
jae 0x10003031
jmp 0x1000300d
push dword [eax*8 + 0x100030b4]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.10001dcb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x100030ac
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10003097
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0xffffffff
je 0x1000307b
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x100031f8
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.10002abb
mov eax, dword [ebp - 8]
add esp, 0x1c
test byte [eax + 0x1c], 1
mov eax, 0x100031f0
jne 0x1000308b
mov eax, 0x100031e8
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
call fcn.10001dcb
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002112
leave
ret 0x1c
Function at 0x10003369
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
shr eax, 0x1e
push esi
push edi
cmp eax, 1
jbe 0x10003389
push 2
pop ebx
cmp eax, ebx
je 0x1000338c
xor ebx, ebx
inc ebx
jmp 0x1000338c
push 4
pop ebx
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.10002670
mov esi, dword [ebp - 4]
cmp esi, edi
je 0x100033c6
movzx ecx, word [ebp + 0x18]
mov eax, dword [esi]
push edi
push dword [ebp + 0x1c]
push edi
push ecx
movzx ecx, word [ebp + 8]
push edi
push dword [ebp + 0xc]
push ecx
movzx ecx, bx
push ecx
push esi
call dword [eax + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x100033f6
push 0x10003400
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x100033f6
push edi
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x18]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1000343a
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x1000607c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x87c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
xor edi, edi
lea eax, [ebp - 0x622]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
push 0x24c
lea eax, [ebp - 0x870]
push edi
push eax
xor esi, esi
mov dword [ebp - 0x874], edi
call sub.msvcrt.dll_memset
push ebx
push dword [ebp - 0x87c]
lea eax, [ebp - 0x624]
push 0x10003630
push 0x104
push eax
call fcn.10002abb
add esp, 0x44
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x878], eax
cmp eax, 0xffffffff
je 0x1000355a
inc esi
cmp word [ebp - 0x41c], di
je 0x1000352b
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jle 0x10003543
lea eax, [ebp - 0x848]
push eax
push 0x105
lea eax, [ebp - 0x41c]
push eax
call fcn.10001dcb
lea eax, [ebp - 0x874]
push eax
push dword [ebp - 0x878]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003507
cmp esi, dword [ebp + 0x10]
jb 0x100035f0
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x87c]
lea eax, [ebp - 0x210]
push 0x10003624
push 0x105
push eax
call fcn.10002abb
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 0x14
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0x210]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x100035f0
xor ecx, ecx
push 0x10003618
mov word [eax], cx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.100028bd
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call edi
cmp dword [ebp - 0x878], 0xffffffff
pop edi
pop esi
pop ebx
je 0x10003608
push dword [ebp - 0x878]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002112
leave
ret 0xc
Function at 0x1000364b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x1000607c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push edi
mov word [ebp - 0x414], ax
mov word [ebp - 6], ax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.10001e3a
xor edi, edi
cmp eax, edi
jl 0x1000373c
push 0x40
lea eax, [ebp - 0x468]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 6
pop eax
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x46c]
push eax
push edi
push edi
push 8
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push eax
push edi
mov dword [ebp - 0x46c], 0x44
mov dword [ebp - 0x440], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10003728
push esi
push 0xffffffffffffffff
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x428]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x424]
call esi
mov eax, dword [ebp - 0x418]
pop esi
jmp 0x1000372e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1000373c
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10002112
leave
ret
Function at 0x10004095
Capabilities:
Print debug messages

Disassembly:
push 0x14
push 0x10004428
call fcn.100011db
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cmp dword [0x10006058], esi
je 0x100040c3
push 0x10006040
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], esi
xor eax, eax
mov word [0x100078a0], ax
mov edi, 0x100078a0
cmp dword [ebp + 0x14], esi
je 0x100040f2
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push 0x3fd
push edi
call fcn.10001e3a
xor eax, eax
mov word [0x1000809a], ax
mov ebx, 0x400
cmp word [0x100078a0], si
je 0x1000410c
push 0x10004254
push ebx
push edi
call fcn.100028bd
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x10004111
sub eax, ecx
sar eax, 1
mov ecx, ebx
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.10002b2f
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0
je 0x10004145
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.10002cf9
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push dword [esi]
call fcn.10002dd5
cmp dword [esi], 0
jne 0x1000415d
cmp dword [esi + 0x18], 0
je 0x1000416e
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10002e97
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.1000325f
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 8]
movzx eax, word [esi + 4]
push eax
call fcn.1000340f
mov ecx, dword [esi + 8]
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x100041a2
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000423e
cmp dword [esi + 0x18], ebx
je 0x10004213
cmp dword [esi + 0x1c], ebx
je 0x10004213
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x100041cb
call fcn.10004b8a
test eax, eax
je 0x10004213
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10004380
push 0x3ff
push 0x100070a0
call fcn.10002abb
add esp, 0x20
push 0x100042f0
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call ebx
push 0x100070a0
call ebx
push 0x10004260
call ebx
cmp dword [esi + 0x18], 0
je 0x1000422b
push dword [esi + 0x1c]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10003bd5
call fcn.10001220
ret
Function at 0x10004449
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x1000607c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push ebx
push edi
mov dword [ebp - 0xf8], 0xf0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100044bd
cmp dword [ebp - 0xf8], 2
jb 0x100044ee
mov eax, dword [ebp - 0xf4]
and eax, 0xffdf
cmp eax, 0x4e
je 0x100044b8
cmp eax, 0x59
jne 0x100044ee
mov dword [esi], 1
jmp 0x100044ee
and dword [esi], 0
jmp 0x100044ee
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0x4e
mov word [ebp - 0xf4], ax
xor eax, eax
push 4
mov word [ebp - 0xf2], ax
lea eax, [ebp - 0xf4]
push eax
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002112
leave
ret 0xc