joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d5e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b783
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], 0
lea ecx, [ebp - 0x6c]
call fcn.1000b050
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax + 0x2c]
test ecx, ecx
je 0x1002d63b
mov dword [ebp - 0x84], 1
jmp 0x1002d645
mov dword [ebp - 0x84], 0
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x20], edx
push 4
lea eax, [ebp - 0x20]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0x7c]
cmp dword [eax + 0x40], 0
je 0x1002d689
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + 0x40]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax + 0x44]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 1
jmp 0x1002d69e
mov dword [ebp - 0x18], 0x124f80
mov dword [ebp - 0x14], 0x7d0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x24], 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0xc
lea eax, [ebp - 0x78]
push eax
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
push 0x98000004
mov edx, dword [ebp - 0x7c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
jne 0x1002d781
mov byte [ebp - 0x6c], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [ebp - 0xc4]
push ecx
call fcn.1000af50
add esp, 8
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x8c]
push eax
push 0x1008a61c
lea ecx, [ebp - 0xac]
push ecx
call fcn.10012cf0
add esp, 0xc
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
lea ecx, [ebp - 0x68]
call fcn.10010150
lea ecx, [ebp - 0xac]
call fcn.10005610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc4]
call fcn.10005610
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000e8a0
mov ecx, dword [ebp - 0x80]
or ecx, 1
mov dword [ebp - 0x80], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000d220
mov eax, dword [ebp + 8]
jmp 0x1002d7b9
mov byte [ebp - 0x6c], 1
push 0x10089471
lea ecx, [ebp - 0x68]
call fcn.10010200
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000e8a0
mov eax, dword [ebp - 0x80]
or eax, 1
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000d220
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d7e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b7b8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x5c]
call fcn.1000b050
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + 0x2c]
test ecx, ecx
je 0x1002d835
mov dword [ebp - 0x68], 1
jmp 0x1002d83c
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [ebp - 0x5c], 1
push 0x10089472
lea ecx, [ebp - 0x58]
call fcn.10010200
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000e8a0
mov ecx, dword [ebp - 0x60]
or ecx, 1
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000d220
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret 4
Function at 0x10032b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x44], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x44], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x100375a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.10020e50
add esp, 8
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.100055c0
mov ecx, dword [ebp - 0x228]
or ecx, 1
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x224]
call fcn.10005610
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret
Function at 0x10037ac0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c26b
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0x1008950a
lea ecx, [ebp - 0x234]
call fcn.10005580
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x10037b3b
jmp 0x10037bce
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x208
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.1004dd30
add esp, 0xc
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x10037b8d
jmp 0x10037bce
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x260]
push eax
call fcn.100377e0
add esp, 8
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x234]
call fcn.10010150
lea ecx, [ebp - 0x260]
call fcn.10005610
xor edx, edx
jne 0x10037b2d
cmp dword [ebp - 0x238], 0
je 0x10037bee
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x234]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100055c0
mov edx, dword [ebp - 0x23c]
or edx, 1
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10005610
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret
Function at 0x1003ec80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b7b8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10096748]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x5c]
call fcn.1000b050
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + 0x4e]
test ecx, ecx
je 0x1003ecd5
mov dword [ebp - 0x68], 1
jmp 0x1003ecdc
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [ebp - 0x5c], 1
push 0x10089586
lea ecx, [ebp - 0x58]
call fcn.10010200
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000e8a0
mov ecx, dword [ebp - 0x60]
or ecx, 1
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000d220
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004910b
mov esp, ebp
pop ebp
ret 4
Function at 0x1005108f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x404b14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
and dword [esp + 4], 0
push ebx
push esi
push edi
pushal
xor eax, eax
dec eax
xor ebx, eax
mov dword [esp + 0x30], ebx
popal
push str.V3.5_n
call dword [sym.imp.MSVCR90.dll_printf]
cmp dword [0x4093a8], 0
pop ecx
jne 0x404b4d
call fcn.0040435c
cmp dword [0x4093a4], 0
jne 0x404b5b
call fcn.0040429c
call fcn.0040459d
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi]
call fcn.00404144
lea eax, [esp + 0x14]
push eax
call fcn.00403faf
mov dword [0x4093ac], eax
lea eax, [esp + 0x38]
push eax
call fcn.00403f65
push dword [esp + 0xc]
push dword [esi]
call fcn.00404033
push eax
mov dword [0x4093b0], eax
call dword [sym.imp.MSVCR90.dll__msize]
pop ecx
mov esi, eax
push esi
call fcn.00403fe4
mov eax, esi
imul eax, eax, 3
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0040327f
test edi, edi
je 0x404bf3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x10]
push edi
call fcn.004043b2
lea eax, [esp + 0x38]
push eax
call dword [0x409398]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404267
int3

Function at 0x407f97
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x407f97
lcall 0x5de5, 0x8b10c483
jmp fcn.007ab92c
Function at 0x4017c7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405120], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40508e], ecx
mov dword [0x405124], 0x30
mov dword [0x405128], 3
mov dword [0x405130], 0
mov dword [0x405134], 0
mov dword [0x40512c], 0x4030d6
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x405086], ebx
mov dword [0x405138], ebx
mov dword [0x405144], 0xf
mov dword [0x40514c], 0x405067
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40513c], eax
mov dword [0x405150], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x405140], eax
push 0x405124
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x405086]
push 0
push 0
push 0x2bc
push 0x1f4
push 0xa0
push 0x12c
push 0x40000
push str.Hello_word
push str.2class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x405118], eax
push 0
push dword [0x405118]
call sub.user32.dll_ShowWindow
push dword [0x405118]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x405154
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4018eb
push 0x405154
call sub.user32.dll_TranslateMessage
push 0x405154
call sub.user32.dll_DispatchMessageA
jmp 0x4018c1
mov eax, dword [0x40515c]
mov esi, dword [0x4051b4]
lea ecx, [0x405086]
add esi, eax
call esi
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10016df
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebx, [esi + 4]
mov dword [esi], edi
mov ecx, ebx
call fcn.01003a4b
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x3c], edi
push 0x1006284
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edi
push 0xa
mov ecx, ebx
call fcn.010019e6
mov ecx, dword [ebp + 8]
cmp eax, edi
mov dword [ecx], eax
jl 0x1001786
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push 0x64
push edi
push edi
call ebx
cmp eax, edi
mov dword [esi], eax
je 0x100175e
push edi
push 1
push edi
push edi
call ebx
cmp eax, edi
mov dword [esi + 0x48], eax
je 0x100175e
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1001825
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x4c], eax
jne 0x1001781
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x100176e
call edi
jmp 0x100177a
call edi
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x1001786
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1001e29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
jne 0x1001e42
xor esi, esi
jmp 0x1001e71
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.01004d80
mov esi, esp
push ebx
push ebx
push edi
and byte [esi], 0
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], esi
jne 0x1001eae
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1001e99
call esi
mov esi, eax
jmp 0x1001f45
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1001f45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
jne 0x1001edf
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1001eef
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1001f3c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x1001ef3
jmp 0x1001ec1
call esi
jmp 0x1001f3a
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, esi
cmp byte [ebx + esi], 0
je 0x1001f2e
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.01004d80
mov ecx, edi
mov eax, esp
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + ebx], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push eax
call fcn.01001fac
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1002963
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.01002925
mov edi, eax
cmp edi, esi
je 0x10029a3
cmp dword [ebp - 4], esi
je 0x100299c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1002a40
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1002a14
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.01002963
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x1002a01
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x10029c6
cmp dword [ebp - 4], esi
je 0x1002a0f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x1002a40
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1002a27
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x1002a3e
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1002a47
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.01004d80
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.01002106
xor edi, edi
cmp eax, edi
jl 0x1002bfc
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.01002c09
test eax, eax
jne 0x1002a90
mov eax, 0x80020009
jmp 0x1002bfc
mov ecx, esi
call fcn.010020de
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.01002106
cmp eax, edi
jl 0x1002bfc
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x1002bc4
sub eax, 9
je 0x1002b2b
dec eax
dec eax
jne 0x1002beb
lea eax, [ebp - 0x1014]
test eax, eax
je 0x1002b08
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.01004d80
mov edi, esp
push esi
push edi
lea ecx, [ebp - 0x1014]
xor eax, eax
push 0xffffffffffffffff
push ecx
push eax
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push esi
push esi
push edi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push esi
jmp 0x1002bdd
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x1002b6f
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.01004d80
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - 4], esp
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
jne 0x1002b79
mov eax, 0x80004005
jmp 0x1002bfc
cmp dword [ebp - 8], edi
jle 0x1002bb1
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.01002c92
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x1002b7e
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
jmp 0x1002be5
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
push edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.01002106
test eax, eax
jl 0x1002bfc
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x51a4ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x51a562
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jae 0x51a5a4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0051a45f
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x51a5a2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
jmp 0x51a5a6
jmp 0x51a559
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x51cc23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
fldz
push esi
push edi
fst qword [esp + 0xc]
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
fstp qword [esp + 0x14]
push edi
call fcn.0040aeea
inc dword [0x423d7c]
mov esi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
add esp, 4
fadd dword [0x424314]
fadd qword [0x41f378]
fld dword [0x424388]
mov ecx, dword [0x423d7c]
fsub qword [0x41f370]
mov dword [esp + 0x24], ecx
fiadd dword [esp + 0x24]
fcompp
fnstsw ax
test ah, 0x41
jp 0x4013d8
fld qword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [0x425970]
mov dword [esp + 0x24], edx
fild dword [esp + 0x24]
mov dword [esp + 0x24], eax
fsubp st(1)
fsub qword [0x41f368]
fild dword [esp + 0x24]
faddp st(1)
call fcn.0040adf0
mov dword [0x425970], eax
push ebx
mov ebx, dword [esp + 0x24]
push edi
push ebx
push esi
call fcn.0040afc0
mov eax, dword [0x427804]
sub eax, 0x423004
add esp, 0xc
add edi, esi
add eax, ebx
mov ecx, esi
pop ebx
cmp esi, edi
je 0x40140a
lea ecx, [ecx]
mov dl, byte [eax]
xor byte [ecx], dl
inc ecx
inc eax
cmp ecx, edi
jne 0x401400
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret