joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b9e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x41a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x409be9
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00409dbb
test al, al
jne 0x409be3
sub edx, 2
cmp edx, edi
jne 0x409bc9
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x409c0b
lea eax, [edi + 2]
cmp edx, eax
je 0x409c0b
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00409aea
add esp, 0x10
jmp 0x409d05
push esi
lea ecx, [ebp - 0x255]
call fcn.00409dbb
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409c4e
push dword [ebp - 0x25c]
jmp 0x409bfb
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x409c8b
cmp word [ebp - 0x226], 0
je 0x409cac
cmp word [ebp - 0x226], ax
jne 0x409c8b
cmp word [ebp - 0x224], 0
je 0x409cac
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00409aea
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x409cf8
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x409c65
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x409ce0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x409d05
push 0x40991a
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040ed00
add esp, 0x10
jmp 0x409cd5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401ac5
leave
ret
Function at 0x411fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411fdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411fdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402c00
pop dword [ebp - 0x18]
mov eax, 0x78ac438c
sub eax, 0x786c178c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd1208d42
add dword [ebp - 0x28], 0x7d31b809
mov dword [ebp - 0x24], 0xdde930f9
add dword [ebp - 0x24], 0x544a1b4c
mov dword [ebp - 0x20], 0xa9104a2e
sub dword [ebp - 0x20], 0x5cc40600
mov dword [ebp - 0x1c], 0xded47198
add dword [ebp - 0x1c], 0x212b8e68
lea eax, [ebp - 0x28]
push eax
mov eax, 0x166c8eef
add eax, 0xe9d3e175
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc8342d37
sub dword [ebp - 0x28], 0x53c1c3e1
mov dword [ebp - 0x24], 0xcea8572
sub dword [ebp - 0x24], 0xcb7e23fd
mov dword [ebp - 0x20], 0x8dc3306a
sub dword [ebp - 0x20], 0x2a53c3fe
mov dword [ebp - 0x1c], 0x67668dc7
add dword [ebp - 0x1c], 0x98997239
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x33a52
push 0
call eax
mov ecx, 0x3bd3
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x18]
mov esi, 0xd3063c76
sub esi, 0xc32a1549
mov ebx, dword [edi]
xor ebx, esi
sub dword [ebp - 8], 0x8e00a647
mov dword [edx], ebx
add dword [ebp - 4], ebx
add edx, 4
add edi, 0x9c10b7fc
sub edi, 0x9c10b7f8
loop 0x402d11
add eax, 0x2aea5697
add eax, 0xd5168b88
xor ebx, ebx
add ebx, eax
add eax, 0x43a17e6f
add eax, 0xbc5e8196
mov ecx, 0x879fc3f9
add ecx, 0x78a03c07
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401508
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x401577
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x4015a5
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403064
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015bf
pop esi
ret
push edi
push 0
push 0x11c3b7
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015f4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401601
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401652
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40165e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401660
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x1005520e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b5ec
push 0x1001b5e4
push 0x1001b5ec
push 0x1e
call fcn.100550c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10055242
push dword [ebp + 8]
mov ecx, esi
call dword [0x1013f49c]
call esi
jmp 0x10055248
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10055298
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b610
push 0x1001b608
push 0x1001b610
push 0x20
call fcn.100550c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100552cf
push dword [ebp + 8]
mov ecx, esi
call dword [0x1013f49c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1006072d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1013cc50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1006076d
cmp byte [ebx], 0xa
jne 0x1006076d
or byte [eax + edi + 0x28], 4
jmp 0x10060772
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10060870
mov al, byte [edx]
cmp al, 0x1a
je 0x10060852
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100607a1
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100607c6
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100607d0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10060783
jmp 0x10060870
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006084d
cmp dword [ebp - 0xc], 0
je 0x1006084d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1013cc50]
test byte [eax + edi + 0x28], 0x48
je 0x10060827
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10060812
mov byte [esi], dl
jmp 0x10060823
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1013cc50]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10060870
cmp byte [ebp - 1], 0xa
jne 0x10060836
cmp esi, ebx
jne 0x10060836
mov byte [esi], 0xa
jmp 0x1006086f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1005efa0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10060870
mov byte [esi], 0xd
jmp 0x1006086f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1013cc50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006086c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10060870
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006087f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1013cc50]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100608c2
cmp word [esi], dx
jne 0x100608c2
or byte [edi + eax + 0x28], 4
jmp 0x100608c7
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10060a1a
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100609fa
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10060909
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1006093f
cmp eax, edx
jae 0x1006094b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100608e1
jmp 0x10060a1a
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100609f6
cmp dword [ebp - 0x14], 0
je 0x100609f6
mov eax, dword [ebx*4 + 0x1013cc50]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100609ce
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10060997
mov word [esi], cx
jmp 0x100609ca
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1013cc50]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1013cc50]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1013cc50]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x10060a1a
pop ebx
cmp word [ebp - 4], bx
jne 0x100609df
cmp esi, dword [ebp + 0xc]
jne 0x100609df
mov word [esi], bx
jmp 0x10060a17
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1005efa0
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10060a1a
push 0xd
jmp 0x10060a13
mov ecx, dword [ebx*4 + 0x1013cc50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10060a11
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10060a1a
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10061140
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100611dd
push ebx
push esi
call fcn.10061103
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10056fa2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006118a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100611dc
push edi
push eax
call fcn.100506c1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100611aa
call fcn.1005075f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100611db
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10056fa2
add esp, 0x20
test eax, eax
jne 0x100611c9
push edi
call fcn.1005075f
jmp 0x100611d1
push ebx
call fcn.1005075f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1006195a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x10061997
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x10061990
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x1006199c
add edx, 0x28
cmp edx, esi
jne 0x10061981
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x10061999
Function at 0x100695fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10069294

Function at 0x1006960f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10069429

Function at 0x10069a21
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10062d60
mov eax, dword [0x1013c2b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1005395c
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10069a63
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10069bbf
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100625c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1013cc50]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1005ef7c
mov ecx, dword [esi*4 + 0x1013cc50]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10069bb8
cmp eax, dword [edi + ecx + 0x24]
jne 0x10069bb8
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10069bb8
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005ef7c
add esp, 0x14
test edx, edx
jl 0x10069bb8
jg 0x10069b2e
test eax, eax
jb 0x10069bb8
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10069bb8
jl 0x10069b48
cmp dword [ebp - 0x1008], eax
ja 0x10069bb8
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10069b66
test ebx, ebx
je 0x10069b9f
cmp ecx, edi
jae 0x10069b9f
mov al, byte [ecx]
cmp al, 0xd
jne 0x10069b80
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10069b8c
cmp byte [ecx + 1], 0xa
jne 0x10069b8c
inc ecx
jmp 0x10069b8c
movzx eax, al
movsx eax, byte [eax + 0x1013c1b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10069b66
cmp edx, ebx
jne 0x10069b66
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10069bbd
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1006190b
leave
ret
Function at 0x1006a280
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1006a2be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1006a2b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1006a2c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1006a2a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1006a3a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1006a3d1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1006a3d1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1006a3d1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10070e99
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10070f04
cmp dword [ebp - 4], 1
je 0x10070ed9
cmp dword [ebp - 4], 2
jne 0x10070ef4
mov ecx, dword [ebp - 8]
test esi, esi
je 0x10070efe
test ecx, ecx
je 0x10070ef9
test cl, 1
jne 0x10070ef4
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x10070efe
push 0xd
pop eax
jmp 0x10070f04
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1007592d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x64
mov eax, 0x1010af12
call fcn.10062c32
push ecx
push 0x1013d750
lea ecx, [ebp - 0x70]
call fcn.1006b5df
xor ebx, ebx
mov ecx, 0x1013d744
mov dword [ebp - 4], ebx
call fcn.10076078
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push 0x20119
push 0x1002f7c8
push 0x80000002
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10070e51
mov esi, dword [ebp - 0x5c]
test eax, eax
jne 0x100759f8
push ecx
push 0x104
lea ecx, [ebp - 0x50]
call fcn.10075685
mov byte [ebp - 4], 2
mov edi, ebx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100759f0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push dword [ebp - 0x50]
call fcn.10075655
push eax
mov ecx, 0x1013d744
mov byte [ebp - 4], 3
call fcn.10076164
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1006af06
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
sub eax, ecx
sar eax, 1
inc edi
jmp 0x1007599f
lea ecx, [ebp - 0x50]
call fcn.10075865
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push 0x20219
push 0x1002f7c8
push 0x80000002
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.10070e51
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x10075ad9
push ecx
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.10075685
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
mov edi, dword [ebp - 0x50]
sar eax, 1
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x44]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10075a99
push dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x1c]
call fcn.10075655
push eax
mov ecx, 0x1013d744
mov byte [ebp - 4], 6
call fcn.10076164
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.1006af06
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
inc ebx
jmp 0x10075a46
lea ecx, [ebp - 0x1c]
call fcn.10075865
test edi, edi
je 0x10075aac
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ab7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov edi, ebx
mov ebx, 0x80
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x10002784
call fcn.1006d7a9
mov eax, edi
mov edx, ebx
call fcn.10062bca
ret
cmp eax, 2
je 0x10075b11
cmp eax, 3
je 0x10075b11
call fcn.100758f8
mov edi, eax
mov ebx, edx
or edi, dword [ebp - 0x44]
or ebx, 0x112a
cmp dword [ebp - 0x50], 0
je 0x10075b04
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ac0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10075ac0
cmp dword [ebp - 0x50], 0
je 0x10075b20
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ab9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10075ab9