joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040687a
and dword [ebp - 0x14], 0
cmp dword [0x411cfc], 0
mov dword [ebp - 0x18], eax
jne 0x40a25e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411cfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411d00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411d04], eax
call edi
push eax
call esi
mov dword [0x411d0c], eax
test eax, eax
je 0x40a25e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411d08], eax
mov eax, dword [0x411d08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a2b7
cmp dword [0x411d0c], ecx
je 0x40a2b7
push eax
call esi
push dword [0x411d0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a2b7
test ebx, ebx
je 0x40a2b7
call edi
test eax, eax
je 0x40a2ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a2ae
test byte [ebp - 8], 1
jne 0x40a2b7
or dword [ebp + 0x10], 0x200000
jmp 0x40a2ea
mov eax, dword [0x411d00]
cmp eax, dword [ebp - 0x18]
je 0x40a2ea
push eax
call esi
test eax, eax
je 0x40a2ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a2ea
mov eax, dword [0x411d04]
cmp eax, dword [ebp - 0x18]
je 0x40a2ea
push eax
call esi
test eax, eax
je 0x40a2ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411cfc]
call esi
test eax, eax
je 0x40a306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403bfe
leave
ret

Function at 0x4200d9
Capabilities:
Authenticate hmac

Disassembly:
xor edx, ebx
mov dword [esp], eax
shr ax, cl
bswap edx
not ecx
inc ecx
dec edx
neg edx
dec edx
ror edx, 1
and dword [esp + ecx*2 - 0x7c792df0], 0x439109a2
bts eax, 0xb2
mov dword [esp + ecx - 0x3e3c96f4], 0x241903a3
not edx
jae 0x4b5895
Function at 0x448a82
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
adc edi, eax
movzx eax, dx
lea esi, [esi + edx - 1]
call fcn.004a8089
mov eax, 0x46321626
mov ecx, eax
movzx edx, cl
mov ecx, dword [ebp + ecx - 0x46321626]
div dl
mov edx, dword [edx + ecx - 0x26]
mov dword [ebp + eax - 0x46320895], edx
lea edx, [eax + eax*2 + 0x161103]
lea esi, [esi + eax - 0x46320899]
neg edx
jo 0x4be68f
mov edx, dword [edx + esi - 0x2d53d53e]
btr ax, 0xa7
movzx ecx, ax
xor edx, ebx
sar eax, 0x41
rol al, 0x41
bswap eax
dec edx
add ecx, ecx
xor edx, 0x7681ac05
ror al, 0xa3
xor cx, ax
not al
not edx
inc edx
ror cl, 0xa1
rol edx, 1
push ecx
xor word [esp + eax - 0x1404199b], cx
xor ebx, edx
xchg word [esp + eax - 0x1404199b], cx
add edi, edx
lea eax, [ecx*2 - 0x11e0f875]
sar ax, 0xd
mov dword [esp + ecx], edi
ret
mov dword [esp], eax
xor ecx, ebx
call fcn.004de68f
jae 0x4393f7
lea edx, [eax + edx + 0x17969d7a]
lea eax, [ecx*2 + 0x44986c29]
rol ax, 0x4a
rol edx, 2
btc ax, 0x8d
xor ax, cx
neg edx
ror ecx, 0xb
sbb edx, 0xe99daf2a
sar ecx, 0xa3
sbb cx, ax
xor ebx, edx
bt cx, ax
setae cl
add ebp, edx
rol ecx, 0x44
setb al
sbb esi, 3
mov edx, dword [esi]
cwde
xor edx, ebx
xadd ecx, eax
not edx
call fcn.004828f6
mov edx, 0x5005aa1b
dec edx
lea esi, [esi + edx - 0x5005aa1b]
movsx eax, dx
movzx edx, byte [esi + edx - 0x5005aa1a]
lea ecx, [eax*2 + 0x172442a8]
jno 0x4c2d15
mov eax, ecx
mov eax, ebp
sub edx, 0xf0b24bb1
xadd dword [esp + ecx*8 - 0x44c803c0], edx
lea ebp, [ebp + ecx*2 - 0x113200f4]
xadd dx, cx
mov dword [ebp + ecx*4 - 0x2267fe5c], eax
movzx eax, dx
inc ecx
adc eax, 0x62361987
pop edx
jno fcn.004e90f3
not byte [esp + 1]
ja 0x4da839
setae al
sub eax, eax
bswap ecx
xor ebx, ecx
or al, ah
sar al, 0xc7
cwd
adc edi, ecx
shl dl, 0x86
xor eax, dword [ebp + eax*2]
bts dx, dx
rol edx, 0x1a
add edx, edx
mov cx, word [ebp + edx - 0x7fffffc]
lea ebp, [ebp + edx*2 - 0xffffffa]
inc edx
jb 0x4ab875
jne 0x4b356e
mov word ss:[edx + eax - 0x8000001], cx
movsx eax, dl
call fcn.004c942e
movsx eax, dx
lea esi, [eax + esi - 0x271]
shl ecx, cl
mov ecx, dword [esi + edx - 0x2fc4026d]
neg dl
xor ecx, ebx
jmp 0x428e76
btc edx, edx
cdq
lea ecx, [ecx + eax*4 + 0xd333a64]
jae 0x47ce97
imul ecx, eax
xor dl, bl
dec dl
neg dl
or ecx, ecx
shl ax, 0x42
sbb dl, 6
shl eax, 0xe1
ror dl, 1
or ax, 0x6e93
xor bl, dl
btr ax, ax
imul eax, eax
neg eax
add edx, esp
mov eax, dword [edx + ecx - 0x64ef6a58]
lea ebp, [ecx + ebp - 0x64ef6a5c]
not ecx
lea edx, [ecx + ecx*2 - 0x3fe127d6]
mov dword [ebp], eax
sub edx, 0x618c96b2
jns 0x4b9b11
adc ebp, 2
not ax
rol dword [esp], 0x17
not dx
or ax, dx
mov word [ebp], ax
mov ecx, dword [edi]
add edi, 4
mov edx, 0xc2924fab
xor ecx, ebx
rol ecx, 3
lea eax, [edx + edx + 0xfbee4a4]
inc ecx
rol dl, 0x27
inc edx
bswap ecx
ror dx, 0x41
sub word [esp + 2], ax
sbb eax, eax
xor ecx, 0xd4bdfca9
cwd
ror dword [esp + eax*2], 0xd7
rol ecx, 3
shr dx, 0x6e
mul al
xor ebx, ecx
sub dword [esp + eax], edx
and dword [esp + eax*8], edx
xor eax, dword [esp + eax*2]
adc esi, ecx
btc edx, 0x27
mov dword [esp + eax - 0x42920000], esi
ret
Function at 0x4ceef6
Capabilities:
Authenticate hmac

Disassembly:
bt edx, eax
sbb ax, dx
inc ecx
not edx
call fcn.0042c5b3
mov eax, 0x61102201
movzx ecx, ax

Function at 0x4e2009
Capabilities:
Authenticate hmac

Disassembly:
movsx eax, dx
mov dword [esp + edx*2 - 0xa65fd64], esi
ret 4
sbb edx, 0x91911d04
xor cx, cx
btc cx, 0x8b
bswap edx
not edx
dec cx
call fcn.004d7024
neg eax
neg edx
dec dword [esp + eax - 0x415bb3e3]
bswap edx
sar dword [esp + eax - 0x415bb3e3], 0x84
push ecx
sub al, ah
xor ebx, edx
dec byte [esp + eax - 0x415bb32d]
or byte [esp + eax - 0x415bb32d], cl
ja 0x4b48a5
mov eax, 0x6b04ee9d
sar al, 0x63
mov eax, dword [eax + edi - 0x6b04eef3]
mov ecx, 0x69166592
mov ecx, dword [ecx + edi - 0x6916658e]
mov edx, 0xceb0ac9e
push edx
adc edi, 3
sub dx, dx
shl dx, 0xcf
shl edx, 0x2d
and eax, ecx
mov ecx, edx
not cl
dec dword [esp + edx]
not eax
mov dword [edi + edx*8], eax
js 0x4f0a9a
pop eax
mov eax, 0xbea44c1d
neg edx
mov dword [esp], eax
shr cl, 0x64
bswap edx
sbb cx, 0x829f
add cl, 0x96
sar byte [esp], 0x61
lea edx, [ecx + edx - 0x21fd81bb]
jne 0x4be1ef
mov ecx, 0x3c82071b
lea edx, [ecx*4 + 0x4613e5a7]
mov eax, dword [edi + ecx*2 - 0x79040e36]
lea edi, [edi + edx - 0x381c020f]
and cx, 0xd230
xor eax, ebx
lea eax, [eax + edx*2 + 0xbe39489]
push edx
xor eax, 0xa6a99f26
inc ecx
push edx
dec eax
ror dl, 0xe5
neg eax
ror edx, 0x34
bswap edx
neg edx
xor ebx, eax
btr edx, ecx
adc esi, eax
sar cl, 0xc5
sub edx, ecx
pop eax
mov eax, dword [ebp + ecx - 0x3c820200]
shl word [esp + ecx - 0x3c8201ff], 0xee
setns dl
mov cx, word [ecx + ebp - 0x3c8201fc]
xor dword [esp + edx - 0x41fad400], 0x52165a3c
or dword [esp + edx - 0x41fad400], edx
lea ebp, [ebp + edx - 0x41fad3fa]
neg edx
push edx
lea edx, [edx + edx*4 + 0x4f1922b2]
mov word ss:[edx + eax - 0x532feb2], cx
jno 0x483b34
shld dx, ax, cl
call fcn.004ef2a6
mov eax, ecx
mov cl, byte [esi + 4]
lea eax, [eax*4 - 0x4eece576]
add esi, 2
shr edx, cl
bts eax, eax
lea ecx, [eax + eax*2 - 0x69e51c5a]
mov dword [esi], edx
jb 0x48a718
mov edx, dword [edi]
xor cl, 0xb4
neg eax
sbb eax, ecx
lea edi, [edi + eax*2 - 0x787afdd6]
xchg ecx, eax
sub cx, 0xa5b3
xor edx, ebx
rol al, 0x81
xor eax, 0x582b2919
js 0x4b010d
mov edi, dword [esp + 0xc]
call fcn.00426a61
je 0x49c8fd
mov ecx, dword [esi + edx*8]
movsx eax, byte [esp + edx]
neg byte [esp + edx*2]
adc ax, word [esp + edx*2 + 2]
lea esi, [esi + edx*2 + 4]
or dword [esp + edx], 0xcc9d8105
rol byte [esp + edx + 1], 0x84
xor ecx, ebx
sal byte [esp + edx*2 + 3], 0xe6
or dx, ax
add dx, dx
not ecx
xor edx, 0x95180f01
call fcn.00416563
ror edx, 0xdd
add ebp, ecx
mov ecx, dword [edi]
or al, byte [esp + 7]
neg eax
mul eax
movzx ax, byte ss:[edx + ecx]
lea edi, [edi + edx*2 + 2]
mov word [edi + edx*4], ax
or byte [esp + edx*2 + 3], dh
mov dword [esp + edx*4], ebp
ret 4
Function at 0x4f421f
Capabilities:
Authenticate hmac

Disassembly:
dec ecx
call fcn.0042acc7
add edi, ecx
shl ax, 0x61
mov ecx, dword [edx + esi]
xor dl, byte ss:[edx + ecx]
mov ecx, 0x5609b282
call fcn.0045d24b
sal edx, 0x98
jbe 0x41e95e
mov edx, 0x7faab928
push edx
mov cx, word [ebp + edx - 0x7faab928]
shl dl, 0xc7
mov dx, word [ebp + edx - 0x7faab8fe]
mov eax, 0x2bae0a37
mov byte [esp + eax - 0x2bae0a37], 0xab
bts eax, eax
lea ebp, [ebp + eax - 0x2bae0a35]
not cx
dec eax
sar ax, 0x41
not dx
rol eax, 0xd6
and dword [esp + eax - 0x46caeb81], eax
inc al
and cx, dx
movzx edx, byte [esp + eax - 0x46caeb82]
mov word [ebp + eax - 0x46caeb82], cx
mov ecx, 0x932c8c17
not byte [esp + edx - 0x7f]
btc ax, 0x2b
lea esi, [esi + eax - 0x46cae386]
call fcn.0046f30c
xor ecx, ebx
sub ecx, 0x91911d04
bswap ecx
rol ax, 0x8b
not ecx
jae 0x47714c
mov eax, 0x20104a24
mov edx, eax
rol al, 0xc1
mov ecx, dword [eax + esi - 0x20104a48]
inc al
push edx
lea esi, [esi + edx*2 - 0x40209444]
sete dl
add dl, ah
sbb eax, dword [esp + eax - 0x20104a49]
mov dword [esp + eax - 0x25], ecx
imul dl
adc eax, eax
movsx ecx, al
popfd
xchg ah, cl
add cx, ax
mov edx, dword [edi + eax - 0x6565]
inc ecx
sal cx, 0xee
sbb eax, ecx
lea edi, [edi + ecx*2 - 0x17ffc]
xor edx, ebx
not edx
sar ecx, 0xf
shr ecx, 0x5c
dec edx
rol edx, 2
not edx
rol edx, 1
or ecx, ecx
xor al, ch
sbb ecx, eax
xor ebx, edx
call fcn.004e5964
mov edx, 0x1a17df92
mov edx, dword [esi + edx*2 - 0x342fbf24]
mov ecx, 0x513c3735
mov cl, byte [esi + ecx - 0x513c3731]
mov eax, 0x322d0022
lea eax, [eax + eax + 0x17396722]
lea esi, [esi + eax - 0x7b936764]
bts ax, 0xaf
btc eax, eax
shr edx, cl
lea ecx, [eax - 0x25705ec6]
or ax, cx
mov dword [esi + ecx - 0x56238860], edx
bswap ecx
imul cl
mov eax, dword [edi + eax - 0x7b932244]
jno 0x450bee
lea edi, [ecx + edi - 0x60882352]
jno 0x4c703a
add cx, 0x7f9f
dec cx
xor eax, ebx
and ecx, ecx
mov edx, ecx
sbb eax, 0x91911d04
lea edx, [ecx + edx - 0x40da8ff0]
neg ecx
jp 0x43fe00
xor cl, bl
xadd word [esp + edx - 0x61325fa2], dx
rol cl, 1
not dl
sub cl, dl
call fcn.004d4ae5
movzx ecx, dl
ror cx, 0xa3
mov eax, dword [edx + esi - 0x2eae51a2]
add ecx, 0x232efd33
lea esi, [esi + ecx - 0x232f3d43]
dec ecx
lea edx, [ecx + ecx*2 - 0x4b600858]
bt edx, 0x33
xor eax, ebx
and cx, dx
neg edx
push ecx
lea eax, [ecx + eax - 0x4fe8083]
not eax
movsx edx, cl
mov cl, byte [esi + ecx - 0x22159c93]
pop edx
mov edx, 0xff341896
shl edx, 0x85
adc esi, 1
rol edx, 0xe6
shl edx, 0x5e
shr eax, cl
mov dword [esi + edx - 0x40000000], eax
lea eax, [edx*4 + 0x5f20693e]
movsx ecx, dx
or ecx, dword [edi + edx - 0x40000000]
mul edx
neg edx
btc edx, edx
lea edi, [edi + eax - 0x7ffffffc]
jb 0x4bac48
adc ebp, ecx
movsx ecx, dx
mov dword [esp + ecx*4 - 0xf20c], ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x6a63fda
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7f8b3f07
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10014018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ebx
lea edx, [eax + 2]
jmp 0x10001020
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001020
push esi
sub eax, edx
push edi
sar eax, 1
lea edi, [eax + 1]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, 0x104
sub esi, edi
push esi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, eax
jae 0x1000107d
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b730
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_wcsncat_s]
push 1
push 0x1000e324
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x1000106b
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100010a4
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call esi
add esp, 0x10
test eax, eax
jne 0x1000106b
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000b730
mov esp, ebp
pop ebp
ret

Function at 0x10002b10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10002b4b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10002b32
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10002b43
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10002b4d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10002b28
xor eax, eax
pop edi
pop esi
ret
Function at 0x10002ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.10002ae0
push eax
push esi
push dword [ebp + 8]
call fcn.10002a95
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10002ae0
push eax
push esi
push dword [ebp + 8]
call fcn.10002a95
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10002ad0
xlatb
int1
clc
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10002ad0
wait
fisttp dword [ebx + 0x7c858d39]
invalid

Function at 0x10005c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005cde
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10005cad
cmp eax, 2
jne 0x10005cc8
mov eax, dword [ebp - 4]
test esi, esi
je 0x10005cd8
test eax, eax
je 0x10005cd3
test al, 1
jne 0x10005cc8
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x10005cd8
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10005ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000cae8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10014018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
test edi, edi
jne 0x10005f37
xor al, al
jmp 0x10006005
mov dword [ebp - 0x34], 0x20019
call fcn.100010f0
test al, al
je 0x10005f4e
mov dword [ebp - 0x34], 0x20119
xor edx, edx
push 0x1b
mov eax, str.SOFTWAREIntelIntelAMTUNS_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.10001ce0
mov eax, esi
mov dword [ebp - 4], 0
mov byte [ebp - 0x2d], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005f81
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x2c]
call fcn.100067d0
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x10005fab
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x38]
push ecx
push edx
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005ff0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
push edi
lea ecx, [ebp - 0x44]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005fe6
mov byte [ebp - 0x2d], 1
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
jb 0x10006002
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b730
mov esp, ebp
pop ebp
ret
Function at 0x10006220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000cab0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10014018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], edi
xor edx, edx
push 0x1b
mov eax, str.SOFTWAREIntelIntelAMTUNS_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.10001ce0
mov eax, esi
mov byte [ebp - 4], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10006292
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x2c]
call fcn.100067d0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x100062b8
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
push ecx
push 0x20119
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000633f
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x30]
push edx
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
push edi
push edx
push esi
mov ebx, esi
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000633f
cmp dword [ebp - 0x34], 4
jne 0x1000633f
cmp dword [ebp - 0x18], 8
mov ax, word [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov word [ecx], ax
jb 0x10006320
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
cmp esi, edi
je 0x1000633b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1000636f
cmp dword [ebp - 0x18], 8
jb 0x10006352
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
cmp ebx, edi
je 0x1000636d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b730
mov esp, ebp
pop ebp
ret
Function at 0x10006390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000cab0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10014018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], edi
xor edx, edx
push 0x1b
mov eax, str.SOFTWAREIntelIntelAMTUNS_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.10001ce0
mov eax, esi
mov byte [ebp - 4], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10006402
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x2c]
call fcn.100067d0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10006428
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
push ecx
push 0x20119
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100064ad
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x30]
push edx
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
push edi
push edx
push esi
mov ebx, esi
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100064ad
cmp dword [ebp - 0x34], 4
jne 0x100064ad
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jb 0x1000648e
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
cmp esi, edi
je 0x100064a9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x100064dd
cmp dword [ebp - 0x18], 8
jb 0x100064c0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
cmp ebx, edi
je 0x100064db
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b730
mov esp, ebp
pop ebp
ret