joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10083d3a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100de6f4
call fcn.100ac440
sub esp, 0x148
mov eax, dword [0x1011c710]
push ebx
xor eax, ebp
push esi
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.10083788
push 0xffffffffffffffff
xor ebx, ebx
lea ecx, [esi + 0x64]
push ebx
call fcn.100c0b0a
mov dword [ebp - 0x11c], ebx
push edi
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x120], eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x120]
push str.Search_d
push eax
mov dword [ebp - 4], ebx
call fcn.10001d75
add esp, 0xc
push 0x40
pop ecx
xor eax, eax
mov word [ebp - 0x114], bx
lea edi, [ebp - 0x112]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x118]
push eax
push str.SoftwarePPStream_recent_
push 0x80000001
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10083ec9
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push dword [ebp - 0x120]
mov dword [ebp - 0x124], 1
push dword [ebp - 0x118]
mov dword [ebp - 0x12c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10083eaf
lea eax, [ebp - 0x114]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x10083e95
lea eax, [ebp - 0x114]
lea edi, [esi + 0x5c]
push eax
mov ecx, edi
call fcn.10001f92
lea ecx, [esi + 0x64]
mov eax, dword [ecx + 8]
push edi
push eax
call fcn.100c0cb9
push 0x28
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.100ab720
add esp, 0xc
lea eax, [ebp - 0x114]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x154]
push eax
push ebx
push 0x1007
push dword [esi + 0x1c]
mov dword [ebp - 0x154], 0x11
mov dword [ebp - 0x150], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x118], ebx
je 0x10083ec9
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x118], ebx
cmp dword [ebp - 0x118], ebx
je 0x10083ec9
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x118], ebx
mov ecx, dword [ebp - 0x120]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10001199
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], 7
jl 0x10083d71
mov ecx, esi
call fcn.10083775
test eax, eax
pop edi
jle 0x10083f8d
lea ecx, [ebp - 0x128]
call fcn.10020a8b
push 0x149
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 1
call fcn.10020acd
push 0x28
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.100ab720
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x154], 0x11
call fcn.10083775
push ebx
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x150], eax
call fcn.1000192d
push 0xffffffffffffffff
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x140], eax
call fcn.1000170f
lea eax, [ebp - 0x154]
push eax
push ebx
push 0x1007
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.10020aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret
Function at 0x10084cee
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100de7b0
call fcn.100ac440
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x8c], ebx
jne 0x10084da3
push esi
call fcn.100cd841
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f89
push ebx
call esi
cmp eax, ebx
mov dword [edi + 0x8c], eax
jne 0x10084da2
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x104
push eax
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.1000192d
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000170f
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.10007475
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x10084d97
push 0x6a
push ebx
call esi
test eax, eax
je 0x10084d90
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x8c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001199
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1008bc3a
Capabilities:
Parse credit card information

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x1011c710]
and dword [ebp - 0x7c], 0
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0x394]
mov dword [ebp + 0x388], eax
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
test eax, eax
push esi
mov dword [ebp - 0x80], eax
lea esi, [ebp - 0x78]
jle 0x1008bceb
push edi
mov edi, 0x100e6fe0
push dword [ebp - 0x7c]
mov ecx, ebx
call fcn.10020bb8
movsx edx, al
mov ecx, edx
and ecx, 0xff
cmp al, 0x5c
jne 0x1008bc93
push 0x2f
jmp 0x1008bcc8
cmp al, 0x27
jne 0x1008bc9b
push 0x27
jmp 0x1008bcc8
test cl, cl
js 0x1008bccb
cmp al, 0x3f
je 0x1008bccb
cmp al, 0x22
je 0x1008bccb
cmp al, 0x3c
je 0x1008bccb
cmp al, 0x3e
je 0x1008bccb
cmp al, 0x25
je 0x1008bccb
cmp al, 0x2a
je 0x1008bccb
cmp al, 0x7c
je 0x1008bccb
cmp al, 0x20
je 0x1008bccb
cmp al, 0x3b
je 0x1008bccb
cmp al, 0x26
je 0x1008bccb
push edx
push edi
jmp 0x1008bcd1
push ecx
push str.___02X
push esi
call fcn.100acf5b
add esi, eax
add esp, 0xc
inc dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x80]
mov byte [esi], 0
jl 0x1008bc76
pop edi
lea eax, [ebp - 0x78]
push eax
mov ecx, ebx
call fcn.10001f92
mov ecx, dword [ebp + 0x388]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
add ebp, 0x38c
leave
ret 4
Function at 0x1008eb4b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1011c710]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.100b032e
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ac33f
leave
ret

Function at 0x1008eb92
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x118c
call fcn.100ab6e0
mov eax, dword [0x1011c710]
push 0x100e3ab4
push 0xffffffffffffffff
push str.tolog
xor eax, ebp
push str.player
mov dword [ebp - 4], eax
call fcn.100027f5
test eax, eax
jle 0x1008ed25
and word [ebp - 0x1188], 0
and word [ebp - 0x988], 0
and word [ebp - 0x108], 0
push esi
push edi
xor eax, eax
mov edx, 0x1ff
mov ecx, edx
lea edi, [ebp - 0x1186]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x986]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x106]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10002769
lea eax, [ebp - 0x108]
push 0x100e2ac4
push eax
call fcn.100ac910
lea eax, [ebp - 0x108]
push str.powerplayer.log
push eax
call fcn.100ac910
lea eax, [ebp - 0x108]
push 0x100e96bc
push eax
call fcn.100acdfd
mov esi, eax
lea eax, [ebp - 0x118c]
push eax
call fcn.100ad218
lea eax, [ebp - 0x118c]
push eax
call fcn.100afe43
add esp, 0x28
test eax, eax
jne 0x1008ec8a
push 0x100e3808
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1008eca4
push eax
push str._B__d__y__H:_M:_S
lea eax, [ebp - 0x188]
push 0x80
push eax
call fcn.100af24a
add esp, 0x10
test esi, esi
je 0x1008ecca
lea eax, [ebp - 0x188]
push eax
push str._s_PowerPlayer:
push esi
call fcn.100afde5
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
call fcn.100afd88
add esp, 0x18
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1188]
push eax
call fcn.100ac587
lea eax, [ebp - 0x1188]
push eax
lea eax, [ebp - 0x988]
push str.PowerPlayer:__s
push eax
call fcn.100acf5b
add esp, 0x18
lea eax, [ebp - 0x988]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
je 0x1008ed23
push 0x100eb370
push esi
call fcn.100afde5
push esi
call fcn.100acbf5
push esi
call fcn.100aca44
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ac33f
leave
ret
Function at 0x1008ed31
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x1011c710]
push 0x100e3ab4
push 0xffffffffffffffff
push str.debugfilter
xor eax, ebp
push str.Debug
mov dword [ebp - 4], eax
call fcn.100027f5
test eax, eax
jle 0x1008ee78
push esi
push edi
xor esi, esi
and word [ebp - 0x484], si
and word [ebp - 0x884], si
mov edx, 0xff
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x482]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp dword [ebp + 8], esi
mov ecx, edx
lea edi, [ebp - 0x882]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x1008edab
push 0x100e96bc
push dword [ebp + 8]
call fcn.100acdfd
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x888]
push eax
call fcn.100ad218
lea eax, [ebp - 0x888]
push eax
call fcn.100afe43
test eax, eax
pop ecx
pop ecx
jne 0x1008eddd
push 0x100e3808
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1008edf7
push eax
push str._B__d__y__H:_M:_S
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.100af24a
add esp, 0x10
test esi, esi
je 0x1008ee1d
lea eax, [ebp - 0x84]
push eax
push str._s_:
push esi
call fcn.100afde5
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
call fcn.100afd88
add esp, 0x18
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
push eax
call fcn.100ac587
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x884]
push str.NewPlayer_____s
push eax
call fcn.100acf5b
add esp, 0x18
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
je 0x1008ee76
push 0x100eb370
push esi
call fcn.100afde5
push esi
call fcn.100acbf5
push esi
call fcn.100aca44
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ac33f
leave
ret
Function at 0x1008f8c7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x1008f8d2
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x1008f995
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
inc edx
dec edi
jne 0x1008f8f2
pop edi
test eax, eax
je 0x1008f9af
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100f5e08]
inc edx
dec eax
jne 0x1008f999
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x1008f9b6
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
xor eax, eax
mov al, byte [esp + 8]
push esi
mov esi, 0xff
xor eax, edx
and eax, esi
mov eax, dword [eax*4 + 0x100f5e08]
shr edx, 8
xor eax, edx
mov dword [ecx], eax
and eax, esi
add eax, dword [ecx + 4]
imul eax, eax, 0x8088405
lea edx, [eax + 1]
mov eax, dword [ecx + 8]
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100f5e08]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x1008fe4f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x1008fe83
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1008fe7e
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x1008feab
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x1008fe94
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.100ab860
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x10090c1f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1011c710]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
test ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x10090c53
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10090c53
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [esi]
test al, al
je 0x10090cea
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x10090c6a
cmp al, 0x5c
jne 0x10090c6c
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10090c62
cmp edi, esi
je 0x10090c9f
sub edi, esi
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.100ab860
lea eax, [ebp - 0x20c]
push eax
push ebx
mov byte [ebp + edi - 0x20c], 0
call fcn.10090c1f
add esp, 0x14
test ebx, ebx
mov byte [ebp - 0x108], 0
pop edi
je 0x10090cba
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100ac900
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100ac910
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10090cea
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret

Function at 0x100922dd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10092385
cmp dword [esi + 4], 0xffffffff
jne 0x10092385
push edi
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call fcn.100ab7d0
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
pop ecx
je 0x1009232c
cmp al, 0x2f
je 0x1009232c
push 0x100e2ac4
push edi
call fcn.100ac910
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x1009234e
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1009234e
mov eax, 0x2000000
jmp 0x1009238a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1008fc7d
add esp, 0x10
test eax, eax
jne 0x1009236c
mov eax, dword [ebp + 0x10]
jmp 0x1009238a
push eax
call fcn.10091dc0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x1009238a
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x10092d1f
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
xor eax, eax
mov al, byte [esp + 8]
push esi
mov esi, 0xff
xor eax, edx
and eax, esi
mov eax, dword [eax*4 + 0x100f6670]
shr edx, 8
xor eax, edx
mov dword [ecx], eax
and eax, esi
add eax, dword [ecx + 4]
imul eax, eax, 0x8088405
lea edx, [eax + 1]
mov eax, dword [ecx + 8]
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100f6670]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x10092de8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x10092e5d
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x10092e14
cmp dword [esi + 0x40], edi
jae 0x10092e14
push eax
call fcn.100c6c35
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x10092e29
lea eax, [edi + edi]
push eax
call fcn.100c6c30
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.100ab860
add esp, 0xc
test edi, edi
jbe 0x10092e5a
mov eax, dword [esi + 0x3c]
movsx eax, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.10092d88
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x10092e3c
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10092e8c
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x10092e78
mov dword [esi + 0x14], 0x30000
jmp 0x10092eae
push edi
push edx
add eax, ecx
push eax
call fcn.100ab860
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x10092eb0
mov eax, dword [esi + 4]
test eax, eax
je 0x10092ea7
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x10092eb0
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100974fa
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0xe4]
sub esp, 0x164
mov eax, dword [0x1011c710]
xor eax, ebp
push ebx
push esi
mov esi, dword [ebp + 0xec]
mov dword [ebp + 0xe0], eax
mov eax, dword [ebp + 0xf0]
push edi
mov dword [ebp - 0x78], eax
call dword [0x1011a9fc]
mov edi, eax
push 0x27
lea eax, [ebp + 0x90]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov ebx, eax
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.100ab6e0
mov eax, esp
push edi
push esi
lea ecx, [ebp + 0x90]
push ecx
push eax
call fcn.10001059
cmp ebx, 0x27
mov dword [ebp - 0x7c], eax
je 0x1009757f
xor eax, eax
jmp 0x1009765f
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push str.InprocServer
push eax
mov esi, str.CLSID_s_s
lea eax, [ebp - 0x74]
push esi
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
mov edi, 0x80000000
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
lea eax, [ebp - 0x74]
jne 0x10097604
push 0x100f0730
push dword [ebp - 0x7c]
push esi
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
call fcn.100969ef
mov dword [esp], str.ToolboxBitmap32
push dword [ebp - 0x7c]
mov esi, eax
neg esi
lea eax, [ebp - 0x74]
sbb esi, esi
push str.CLSID_s_s
push eax
neg esi
call ebx
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test esi, esi
jmp 0x10097649
push dword [ebp - 0x7c]
push str.CLSID_s
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.10096ee1
push eax
call fcn.100969ef
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
cmp dword [ebp - 0x78], 0
pop ecx
je 0x1009765d
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1009765d
push dword [ebp - 0x78]
push edi
call fcn.10096ee1
test ebx, ebx
je 0x1009765b
push eax
call fcn.100969ef
test eax, eax
pop ecx
je 0x1009765b
xor ebx, ebx
inc ebx
jmp 0x1009765d
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe0]
xor ecx, ebp
call fcn.100ac33f
add ebp, 0xe4
leave
ret 8
Function at 0x10097a7e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x10097ad1
call fcn.100cd841
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10097ad1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10097ac7
xor eax, eax
jmp 0x10097bea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x10097b01
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x10097b01
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x10097be7
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x10097b2e
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.10094b9c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x10097be7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10097b77
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x10097b77
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x10097b71
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.10094b9c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x10097bd7
and dword [ebp + 0xc], 0
jmp 0x10097bd7
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x10097bd7
push 0xc
call fcn.100c6c05
mov esi, eax
test esi, esi
pop ecx
je 0x10097bb9
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x10097bbb
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x10097bd2
push dword [ebp - 8]
call fcn.100c108f
jmp 0x10097bd7
call fcn.100c1066
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x10097b3c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1009e31f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi - 4]
add esi, 0xffffff20
xor ebx, ebx
cmp eax, ebx
push edi
je 0x1009e35d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
push dword [ebp + 0xc]
mov edi, dword [esi]
mov dword [ebp + 8], eax
je 0x1009e362
call fcn.100c3d27
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [edi + 0x138]
jmp 0x1009e376
mov edi, dword [esi]
push dword [ebp + 0xc]
call fcn.100c3d27
push eax
push dword [esi + 0x88]
mov ecx, esi
call dword [edi + 0x130]
cmp eax, ebx
je 0x1009e422
xor edi, edi
inc edi
push edi
push dword [ebp + 0x10]
mov ecx, esi
call fcn.1000f805
push ebx
mov ecx, esi
mov dword [esi + 0xbc], edi
call fcn.100c3578
lea eax, [esi + 0x84]
cmp dword [eax], ebx
mov dword [esi + 0xb4], ebx
je 0x1009e3bd
mov dword [eax], ebx
mov eax, dword [esi + 0xa8]
cmp eax, ebx
je 0x1009e3bd
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov eax, dword [esi + 0xc4]
cmp eax, ebx
mov dword [esi + 0xbc], ebx
je 0x1009e3da
push eax
call fcn.100c6c35
pop ecx
mov dword [esi + 0xc4], ebx
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_EnumChildWindows]
push esi
push 0x1009dee8
push eax
mov dword [esi + 0xc0], ebx
call edi
mov eax, dword [esi + 0xc0]
cmp eax, ebx
jle 0x1009e40c
shl eax, 3
push eax
call fcn.100c6c05
pop ecx
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0x1c]
push esi
push 0x1009def8
push eax
mov dword [esi + 0xc0], ebx
call edi
xor eax, eax
jmp 0x1009e427
mov eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 0x10