joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x1001d024
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1001d00e
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10055b90
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1001cff2
lea eax, [ebp - 0x210]
push eax
jmp 0x1001d029
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x214], 0
push 0x1008f490
mov ecx, esi
call fcn.1000c060
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100535a4
mov esp, ebp
pop ebp
ret 8

Function at 0x1001d050
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10055b90
add esp, 0xc
cmp dword [ebx + 0x10], 0
je 0x1001d0e8
cmp dword [ebx + 0x14], 7
jbe 0x1001d0a2
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 7
jbe 0x1001d0aa
mov edi, dword [edi]
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [ebp + 0x18], 0
je 0x1001d0e0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001d0e0
push eax
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 0x10], 0
je 0x1001d12e
jmp 0x1001d10b
cmp dword [esi + 0x10], 0
je 0x1001d12e
cmp dword [edi + 0x14], 7
jbe 0x1001d0f6
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.10061eeb
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp dword [esi + 0x14], 7
jbe 0x1001d120
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.10069913
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
call fcn.1000c060
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100535a4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10020320
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100a4070], 0
jne 0x100204d3
push 0x48
call fcn.10058c73
add esp, 4
mov dword [0x100a4064], eax
test eax, eax
je 0x10020374
push 0x1000
call fcn.10058c73
add esp, 4
mov dword [0x100a4068], eax
test eax, eax
jne 0x1002037c
push dword [0x100a4064]
call fcn.10058c58
add esp, 4
mov dword [0x100a4064], 0
xor al, al
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x100a406c], 0
xor edx, edx
nop dword [eax + eax]
mov eax, dword [0x100a4064]
mov ecx, dword [edx + 0x100913e8]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x48
jl 0x10020390
push esi
xor eax, eax
push edi
nop word [eax + eax]
mov esi, 0x100
nop word [eax + eax]
mov ecx, dword [0x100a4068]
mov edx, dword [eax + 0x100903e8]
mov dword [eax + ecx], edx
add eax, 4
sub esi, 1
jne 0x100203c0
cmp eax, 0x1000
jl 0x100203b0
mov ecx, 0x24
xor edi, edi
push ebx
xor ebx, ebx
mov dword [ebp - 8], ecx
nop dword [eax + eax]
lea eax, [edi + 1]
mov esi, dword [0x100a4064]
cdq
idiv ecx
movzx eax, byte [edi + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
shl eax, 8
movzx ecx, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
or ecx, eax
lea eax, [edi + 2]
cdq
idiv dword [ebp - 8]
shl ecx, 8
movzx eax, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
or ecx, eax
lea eax, [edi + 3]
cdq
idiv dword [ebp - 8]
shl ecx, 8
movzx eax, byte [edx + str.a7b863b0_61b0_4825_a7d4_d93c6a2fad6e]
or ecx, eax
lea eax, [edi + 4]
xor dword [esi + ebx], ecx
mov ecx, 0x24
cdq
add ebx, 4
idiv ecx
mov edi, edx
cmp ebx, 0x48
jl 0x100203f0
pop ebx
mov dword [ebp - 8], 0
xor esi, esi
mov dword [ebp - 4], 0
nop
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1001fed0
mov ecx, dword [0x100a4064]
mov eax, dword [ebp - 4]
mov dword [esi + ecx], eax
mov eax, dword [0x100a4064]
mov ecx, dword [ebp - 8]
mov dword [esi + eax + 4], ecx
add esi, 8
cmp esi, 0x48
jl 0x10020460
xor esi, esi
nop
mov edi, 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1001fed0
mov ecx, dword [0x100a4068]
mov eax, dword [ebp - 4]
mov dword [esi + ecx], eax
mov eax, dword [0x100a4068]
mov ecx, dword [ebp - 8]
mov dword [esi + eax + 4], ecx
add esi, 8
sub edi, 1
jne 0x10020495
cmp esi, 0x1000
jl 0x10020490
pop edi
pop esi
mov byte [0x100a4070], 1
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020890
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x307]
mov byte [ebp - 0x308], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x420], esi
call fcn.10055b90
add esp, 0xc
mov byte [ebp - 0x108], 0
lea eax, [ebp - 0x107]
push 0xff
push 0
push eax
call fcn.10055b90
add esp, 0xc
mov dword [ebp - 0x40c], 0x100
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.10055b90
add esp, 0xc
mov byte [ebp - 0x408], 0
lea eax, [ebp - 0x407]
push 0xff
push 0
push eax
call fcn.10055b90
add esp, 0xc
mov dword [ebp - 0x418], 0x100
lea eax, [ebp - 0x414]
mov dword [ebp - 0x410], 0x100
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push 1
push str.S__lu_
mov edi, eax
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.10020d30
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x418], eax
add esp, 0x10
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100209c0
movzx eax, byte [edi + 5]
sub ecx, edx
push eax
mov eax, 0x100
sub eax, ecx
push 0x10093d24
push eax
lea eax, [ebp - 0x108]
add eax, ecx
push eax
call fcn.10020d30
add dword [ebp - 0x418], eax
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor edi, edi
movzx eax, byte [eax]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10020a59
mov ebx, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov esi, eax
push edi
lea eax, [ebp - 0x208]
push eax
call ebx
push dword [eax]
mov eax, 0x100
sub eax, dword [ebp - 0x418]
push str.__lu
push eax
lea eax, [ebp - 0x108]
add eax, dword [ebp - 0x418]
push eax
call fcn.10020d30
add dword [ebp - 0x418], eax
inc edi
add esp, 0x10
cmp edi, esi
jl 0x10020a16
mov esi, dword [ebp - 0x420]
lea edx, [ebp - 0x108]
mov ecx, 0x100
sub edx, esi
lea eax, [ecx + 0x7ffffefe]
test eax, eax
je 0x10020a7f
mov al, byte [edx + esi]
test al, al
je 0x10020a7f
mov byte [esi], al
inc esi
sub ecx, 1
jne 0x10020a66
test ecx, ecx
lea eax, [esi - 1]
mov ecx, dword [ebp - 4]
cmovne eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
mov byte [eax], 0
mov al, 1
call fcn.100535a4
mov esp, ebp
pop ebp
ret
Function at 0x10020eb0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x1c], eax
push esi
push edi
test eax, eax
je 0x10021039
mov edi, dword [sym.imp.Secur32.dll_GetUserNameExW]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push ebx
push 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
call edi
test al, al
jne 0x10021039
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10058c73
mov esi, eax
add esp, 4
test esi, esi
je 0x10021039
lea eax, [ebp - 0x10]
push eax
push esi
push 2
call edi
test al, al
je 0x10021039
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x10021030
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10021030
push dword [ebp - 0x18]
call fcn.10058c73
mov edi, eax
add esp, 4
test edi, edi
je 0x10021030
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10058c73
add esp, 4
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10020fb3
push esi
call fcn.10058c58
push edi
call fcn.10058c58
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10021006
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x10021006
push ecx
push dword [ebp - 0xc]
mov edx, 0x64
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.10020e60
push dword [ebp - 0xc]
mov ebx, eax
not ebx
shr ebx, 0x1f
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0xc], 0
push esi
call fcn.10058c58
push edi
call fcn.10058c58
push dword [ebp - 0x20]
call fcn.10058c58
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
ret
push esi
call fcn.10058c58
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100535a4
mov esp, ebp
pop ebp
ret
Function at 0x10023830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100827af
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100a1040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x48
call fcn.10053c2b
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x100a3b9c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x34], 0x100a3b9c
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x34]
cmp dword [eax + 4], 0x18
ja 0x100238f7
mov dword [eax], 0
mov eax, dword [esi + 0x34]
mov byte [eax + 8], 0
jmp 0x1002390e
mov dword [esi + 0x34], 0x100a3b9c
cmp eax, 0x100a3b9c
je 0x1002390e
push eax
call fcn.100535b2
add esp, 4
push esi
mov ecx, edi
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.10023790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002a300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x1002a365
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x1002a358
test ecx, ecx
je 0x1002a365
test esi, esi
je 0x1002a365
mov ecx, dword [ebp - 4]
jmp 0x1002a31b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002a530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x100a49c0], ecx
inc eax
cmp eax, 0x100
jb 0x1002a545
cmp eax, 0x800
jae 0x1002a613
nop dword [eax]
mov edx, dword [eax*4 + 0x100a45c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x100a49c0]
mov dword [eax*4 + 0x100a49c0], edx
inc eax
cmp eax, 0x800
jb 0x1002a5f0
lea ecx, [ebp - 0x24]
mov dword [0x100a4090], 0x1002b390
call fcn.1002b490
test eax, eax
je 0x1002a6d6
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov esi, edi
mov eax, 0x100a1ca8
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
nop dword [eax]
mov ebx, dword [ebp - 0x20]
cmp dword [eax - 8], ebx
jne 0x1002a667
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x18]
jne 0x1002a667
cmp dword [eax], ebx
je 0x1002a684
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x1002a650
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
ret
sub ecx, 0
je 0x1002a6bd
sub ecx, 1
je 0x1002a6a1
sub ecx, 1
jne 0x1002a6d6
cmp esi, 6
jb 0x1002a6b2
jne 0x1002a6cc
cmp edi, 0xf
jae 0x1002a6cc
jmp 0x1002a6b2
cmp esi, 5
jb 0x1002a6b2
jne 0x1002a6cc
cmp edi, 6
jb 0x1002a6b2
cmp edi, 0xa
jne 0x1002a6cc
mov eax, 1
test eax, eax
jne 0x1002a6d6
jmp 0x1002a6cc
cmp esi, 6
jb 0x1002a6d6
jne 0x1002a6cc
cmp edi, 0x100c
je 0x1002a6d6
mov dword [0x100a4090], 0x1002b430
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100535a4
mov esp, ebp
pop ebp
ret
Function at 0x1002d1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x1002d200
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 4], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x1002d229
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x1002d226
inc esi
cmp esi, edx
jb 0x1002d217
mov ecx, dword [ebp - 8]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x1002d33f
cmp ecx, 3
jbe 0x1002d268
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x1002d2a6
cmp cl, 0xff
je 0x1002d2a6
mov edx, dword [ebp - 4]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x1002d210
dec ecx
shl eax, cl
and eax, 7
je 0x1002d240
cmp byte [eax + 0x10091f50], 0
je 0x1002d293
movzx ecx, byte [eax + 0x10091f58]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x1002d290
cmp cl, 0xff
jne 0x1002d240
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x1002d210
movzx ebx, cl
movzx ecx, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
sub ebx, edi
sub ebx, 5
test eax, eax
je 0x1002d30a
nop dword [eax]
movzx edx, byte [eax + 0x10091f58]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x1002d2f1
cmp dl, 0xff
jne 0x1002d30a
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor ebx, edx
sub ebx, edi
sub ebx, 5
jmp 0x1002d2d0
mov edx, dword [ebp - 4]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x1002d210
pop esi
pop ebx
cmp ecx, 3
jbe 0x1002d354
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002e150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x228], ebx
mov eax, dword [0x100a456c]
test al, 1
jne 0x1002e1c6
or eax, 1
mov dword [0x100a456c], eax
call fcn.10004070
mov ecx, eax
test ecx, ecx
je 0x1002e357
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x100862d0
mov dword [0x100a4570], eax
call fcn.10053bdc
add esp, 4
mov eax, dword [0x100a4570]
cmp dword [eax - 0xc], 0
jne 0x1002e326
mov esi, dword [0x100a4098]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
test esi, esi
je 0x1002e1fd
lock inc dword [esi + 4]
mov esi, dword [0x100a4098]
mov ecx, dword [0x100a4094]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov eax, dword [ecx]
push edx
call dword [eax + 0x30]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x1002e24c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1002e24c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x1002e24c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
push 0x201
push 0
push dword [ebp - 0x224]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e304
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10055b90
add esp, 0xc
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e2e3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x100a4570
call fcn.10007d40
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1002e326
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x100a4570]
add ecx, 0xfffffff0
call fcn.10007880
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001410
int3
Function at 0x1002fbd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082fcb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [0x100a4098]
test esi, esi
je 0x1002fc1b
lock inc dword [esi + 4]
mov esi, dword [0x100a4098]
mov ecx, dword [0x100a4094]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x21c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xec]
or edi, 0xffffffff
mov byte [ebp - 4], 4
test esi, esi
je 0x1002fc6a
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1002fc6a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x1002fc6a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10055b90
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x104
push eax
push 0x10093244
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x1002fce5
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002fcc0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.10007d40
mov esi, 1
jmp 0x1002fce7
xor esi, esi
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002fd08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002fd26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x1002fd45
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
ret