joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d70b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d7a8
push ebx
push esi
call fcn.1001d6d4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001c69a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d755
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d7a7
push edi
push eax
call fcn.100174d8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d775
call fcn.100160f2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d7a6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001c69a
add esp, 0x20
test eax, eax
jne 0x1001d794
push edi
call fcn.100160f2
jmp 0x1001d79c
push ebx
call fcn.100160f2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d7ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1001d7bc
pop esi
ret
push ebx
push edi
push esi
call fcn.1001d6d4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100174d8
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1001d7e4
push ebx
push esi
push edi
call fcn.1000a230
add esp, 0xc
push 0
call fcn.100160f2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1001dbb4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001d7f9

Function at 0x10020341
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001392b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100203b0
cmp esi, dword [ebp - 4]
je 0x100203ab
cmp dword [ebp + 0xc], 0
je 0x100203ab
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10020388
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001fe93
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100203b2
xor eax, eax
inc eax
jmp 0x100203b2
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10020417
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10032048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1001392b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001392b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1002048e
cmp word [ecx], dx
je 0x1002048e
mov eax, dword [0x10027bb4]
push edi
dec eax
push eax
push 0x10027aa0
call fcn.100203b6
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10020501
cmp word [eax], dx
je 0x10020501
mov eax, dword [edi]
test eax, eax
je 0x100204b2
cmp word [eax], dx
je 0x100204b2
lea eax, [ebp - 0x10]
push eax
call fcn.1001fd99
jmp 0x100204bb
lea eax, [ebp - 0x10]
push eax
call fcn.1001fe34
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002052b
mov eax, dword [0x10027a9c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10027790
call fcn.100203b6
add esp, 0xc
test al, al
je 0x1002052b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100204f6
cmp word [eax], di
je 0x100204f6
lea eax, [ebp - 0x10]
push eax
call fcn.1001fd99
pop ecx
jmp 0x1002052d
lea eax, [ebp - 0x10]
push eax
call fcn.1001fe34
jmp 0x100204f3
mov eax, dword [edi]
test eax, eax
je 0x10020518
cmp word [eax], dx
je 0x10020518
lea eax, [ebp - 0x10]
push eax
call fcn.1001fd4e
pop ecx
jmp 0x1002052b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100205f6
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1002023b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100205f6
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100205f6
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100205f6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10020583
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10016da0
test ebx, ebx
je 0x100205f1
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10016da0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100205f6
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100205f6
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10022625
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100205f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008d1c
leave
ret
Function at 0x10022aa1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10022a1d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10022c10
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10022c10
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10022bc5
jg 0x10022afd
test eax, eax
je 0x10022bbb
push 1
push 0x1000
call fcn.10016670
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10022b20
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10022bb2
push 0x8000
push ebx
call fcn.1002294e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10022b49
jg 0x10022b44
cmp ecx, 0x1000
jb 0x10022b49
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10015ed6
add esp, 0x10
cmp eax, 0xffffffff
je 0x10022b8e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10022b44
jl 0x10022b75
test ecx, ecx
jne 0x10022b36
push dword [ebp - 0xc]
push ebx
call fcn.1002294e
push esi
call fcn.100160f2
add esp, 0xc
xor ebx, ebx
jmp 0x10022c1e
cmp byte [edi + 0x24], 0
je 0x10022ba5
cmp dword [edi + 0x20], 5
jne 0x10022ba5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10022bb0
mov ebx, dword [edi + 0x18]
jmp 0x10022bb2
xor ebx, ebx
push esi
call fcn.100160f2
pop ecx
jmp 0x10022c1e
test ecx, ecx
jg 0x10022b87
jl 0x10022bc5
test eax, eax
jae 0x10022b87
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001956c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10022be5
cmp byte [edi + 0x1c], 0
je 0x10022b87
jmp 0x10022c16
push ebx
call fcn.1001e1e0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10022b87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10022c1e
cmp byte [edi + 0x1c], 0
je 0x10022c1b
mov ebx, dword [edi + 0x18]
jmp 0x10022c1e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001956c
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10023430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002345d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002345d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6101db65
Capabilities:
Delete registry key

Disassembly:
push 0x18
mov eax, 0x6103f8d5
call fcn.6102b2d6
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d83e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d83e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.6100d83e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.6100d83e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.6100d83e
mov byte [ebp - 4], 5
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.610182a8
test al, al
je 0x6101dc31
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.610182a8
test al, al
je 0x6101dc31
push 0x61004820
lea ecx, [ebp - 0x1c]
call fcn.6100dfda
mov byte [ebp - 4], 6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.6101836c
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.6100d793
test bl, bl
jne 0x6101dc31
lea ecx, [ebp - 0x14]
call fcn.61011da0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jne 0x6101dc36
jmp 0x6101dc36
mov esi, 0x65b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.6100d793
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.6100d793
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 4

Function at 0x6101dc8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], ebx
jne 0x6101dcb4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
cmp eax, 4
jne 0x6101dcc5
mov dword [ebp - 4], 0x61003a98
jmp 0x6101dced
cmp eax, 9
jne 0x6101dcd3
mov dword [ebp - 4], 0x6100471c
jmp 0x6101dced
cmp eax, 0xa
jne 0x6101dce1
mov dword [ebp - 4], 0x610019dc
jmp 0x6101dced
cmp eax, 8
jne 0x6101dcab
mov dword [ebp - 4], 0x610046e8
call fcn.6101c80a
test eax, eax
je 0x6101dcab
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp + 8], ebx
push dword [esi + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x6101dcab
cmp dword [ebp + 8], 1
jbe 0x6101dcab
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102c0d4
mov edi, eax
pop ecx
cmp edi, ebx
je 0x6101dcab
push dword [ebp + 8]
push ebx
push edi
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push edi
push ebx
push ebx
push dword [ebp - 4]
push dword [eax + 0x10]
call esi
push edi
test eax, eax
je 0x6101dd5a
call fcn.6102b403
pop ecx
jmp 0x6101dcab
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.61019ecc
push edi
call fcn.6102b403
xor eax, eax
cmp dword [esi + 8], ebx
pop ecx
setne al
jmp 0x6101dcad
Function at 0x61021efe
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0x14
mov eax, 0x6104024e
call fcn.6102b2d6
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.6100d83e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.6100d83e
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0xc], ebx
jne 0x61021f5e
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.6100d793
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 0xc
push 0x61005fe0
lea ecx, [ebp - 0x1c]
call fcn.6100dfda
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.6101836c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.6100d793
push dword [0x610480cc]
lea ecx, [ebp - 0x20]
call fcn.6100dfda
mov byte [ebp - 4], 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.6101836c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.6100d793
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18]
call fcn.61011da0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x61021fe5
xor esi, esi
jmp 0x61022004
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 7
push ebx
push dword [0x610480d0]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x10], ebx
je 0x61021f31
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x61021f31
Function at 0x61025717
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x61025765
cmp dword [ebx + 4], 1
push edi
je 0x61025761
mov edi, 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x61025775
add dword [ebp - 4], edi
cmp dword [ebp - 4], 0x2710
ja 0x6102576a
cmp dword [ebx + 4], 1
jne 0x6102573e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x61025764

Function at 0x6102a6ad
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.6102a5ee
mov eax, 0x61000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x6102a720
cmp dword [ebp - 0x94], 5
jb 0x6102a741
jmp 0x6102a73d
cmp dword [ebp - 0x88], 1
jne 0x6102a741
cmp dword [ebp - 0x94], 4
ja 0x6102a73d
jne 0x6102a741
cmp dword [ebp - 0x90], 0
jbe 0x6102a741
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x6100aa70
call fcn.6102a485
test eax, eax
jge 0x6102a762
mov byte [0x61049484], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6102b2c1
leave
ret
Function at 0x6102aa20
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x6102ab21
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x6102aa65
xor eax, eax
jmp 0x6102abbc
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x6102aa80
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x610497e0], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x610497e8], esi
mov dword [0x610497ec], ecx
mov dword [0x610497f0], edx
mov dword [0x610497e4], eax
call fcn.6102e29f
pop ecx
test eax, eax
je 0x6102aa5e
call fcn.6102d8da
test eax, eax
jne 0x6102aacc
call fcn.6102e304
jmp 0x6102aa5e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6104b498], eax
call fcn.6102e101
mov dword [0x610497c8], eax
call fcn.6102da59
test eax, eax
jge 0x6102aaf1
call fcn.6102d568
jmp 0x6102aac5
call fcn.6102e00d
test eax, eax
jl 0x6102ab1a
call fcn.6102dceb
test eax, eax
jl 0x6102ab1a
push 0
call fcn.6102d257
pop ecx
test eax, eax
jne 0x6102ab1a
inc dword [0x610497c0]
jmp 0x6102abb9
call fcn.6102dc98
jmp 0x6102aaea
xor edi, edi
cmp eax, edi
jne 0x6102ab5c
cmp dword [0x610497c0], edi
jle 0x6102aa5e
dec dword [0x610497c0]
cmp dword [0x6104981c], edi
jne 0x6102ab46
call fcn.6102d3d2
cmp dword [ebp + 0x10], edi
jne 0x6102abb9
call fcn.6102dc98
call fcn.6102d568
call fcn.6102e304
jmp 0x6102abb9
cmp eax, 2
jne 0x6102abad
call fcn.6102d539
push 0x214
push 1
call fcn.6102cf43
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x6102aa5e
push esi
push dword [0x610481c0]
push dword [0x6104982c]
call fcn.6102d4b3
pop ecx
call eax
test eax, eax
je 0x6102aba1
push edi
push esi
call fcn.6102d5aa
pop ecx
jmp 0x6102abb8
push esi
call fcn.6102b701
pop ecx
jmp 0x6102aa5e
cmp eax, 3
jne 0x6102abb9
push edi
call fcn.6102d867
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.6102b2c1
leave
ret 0xc
Function at 0x402f51
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
push 1
call fcn.00402f26
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 4
call fcn.00402f26
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
cmp eax, ecx
jae 0x402f9a
xor eax, eax
jmp 0x402f9d
xor eax, eax
inc eax
leave
ret

Function at 0x407332
Capabilities:
Get keyboard layout
Terminate process

Disassembly:
call fcn.00403871
jmp fcn.0040298f
Function at 0x778f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x78d9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x779002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0077cdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x779002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007746e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0077d20b
push 0x10
call fcn.0077d1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x778fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007691c0
jmp 0x778fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00778b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x778ff0
mov ecx, edi
call fcn.007692c0
push edi
call fcn.0077d1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x779021
inc ebx
cmp ebx, 0x20
jb 0x778f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x77c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0077c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0077c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0077c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0077c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x77cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x77cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x78e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x77cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x77cc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x411401
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
lds ebx, [ecx]
or dword [0x9d6513c2], edx
push eax
rol cl, cl
push dword [eax + 0x23]
mul ebp
mov ch, 6
in eax, 0xb5
push es
sub dword [eax - 0x5e], edi
mov esp, dword [esi + 0xc]
push esp
sahf
xor byte [ecx - 0x113f6ba0], ah
sahf
and esp, dword [esp + ecx*2]
fnstcw word [ebp + 0x67563ea7]
add byte [edx], ch
jbe 0x411412
sbb cl, byte [ebx + 0x3bba957f]
cmc
insb byte es:[edi], dx
cwde
push ebx
push esi
sub byte [ebx + 0x68], bh
and al, 0xed
sbb dh, cl
xor ebp, dword [edi]
das
iretd

Function at 0x423474
Capabilities:
Encode data using xor

Disassembly:
fdivr st(1)
lcall 0x781, 0x119cd8bf
enter 0x1384, 0xffffffffffffffbf
scasb al, byte es:[edi]
fcomp qword [ecx - 0x67a407d8]
jecxz 0x4234b4
xchg esp, eax
invalid
test byte [ecx - 0x7f443b25], ah
jg 0x4234c1
jmp [eax - 0x11d9e4ff]
out dx, al
pop esi
stosd dword es:[edi], eax
mov esi, 0x9141d737
sub eax, dword [ecx + 0x61]
test dword [edi - 0x23], 0xd20bf2a2
jae 0x423513
bound edx, qword [ebx]
sbb ebx, dword [edi - 0x97161f2]
or edi, dword [ebx + 0x5070c61d]
loope 0x423522
invalid
daa
and eax, 0xcf61780e
out dx, eax
pop ecx
xor ebp, edx
mov eax, dword [0x28997d4d]
add eax, 0xd6c038f4
inc ebp
adc byte [edi], ch
mov al, 0x61
fsubr dword [ebx + esi + 0x6e144552]
inc byte [eax + ebp*2 + 0x3e]
adc al, 0x38
pop ebp
sti
mov al, byte [0xc75d95c4]
or eax, 0xba52defd
push esp
loopne 0x423584
invalid
push esp
aas
invalid

Function at 0x43a704
Capabilities:
Encode data using xor

Disassembly:
cmc
stosd dword es:[edi], eax
adc ch, byte [ebx + 0x7b]
xchg ecx, eax
movsb byte es:[edi], byte [esi]
adc eax, 0x17ce205a
fist word [ecx - 0x39dd196f]
jle 0x43a761
mov dl, 0xba
jb 0x43a6a1
push ebx
sbb ah, al
and dword [esp + esi + 0x60], esp
jae 0x43a74e
imul ecx, esp, 0xffffffa4
loop 0x43a794
test al, 0xb3
sbb byte [ecx + 0x3a883282], 0x33
cwde
nop
mov ebx, 0xdf20e860
add dl, byte [ebx - 4]
mov byte [ecx + 0xb], 0xe2
fstp dword [ebx + 0xb]
scasd eax, dword es:[edi]
cwde
sbb dh, byte [ebx + esi*4 + 0x23624220]
invalid
retf
xor bh, dl
arpl word [edx], dx
daa
iretd
fisttp dword [ecx + edi*2 + 0x5c]
sub dword [edx + 0x55], 0x60
and eax, 0x88b7a1da
aad 0x3a
add byte [eax + 0x49], ah
test eax, 0x6e8a52ca
xchg ebx, eax
psubb mm7, qword [edi + 0x3acace8a]
or cl, byte [ebx - 0x65057dd]
sub dword [esp + edx - 0x66], 0x4a
mov esp, 0x896df39c
adc byte [eax], bl
cmp ah, byte [edi - 0x17d806cd]
sub byte [edi], al
xor ch, byte [ebp - 0x6e]
pop edx
inc esp
leave
inc edx
test eax, 0x6585bf81
enter 0xffffffffffffb6fd, 0xffffffffffffffcb
cmp dword [ebx], edi
invalid