joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018d12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.10019640
lea edi, [esi + 0x80]
mov eax, dword [edi]
test eax, eax
je 0x10018d3b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
lea edi, [esi + 0x90]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x18]
call fcn.10030591
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x18]
call fcn.10030591
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10018d77
cmp esi, dword [esp + 0x18]
je 0x10018d7c
call fcn.10062168
mov ebx, dword [esp + 0x14]
cmp ebx, dword [esp + 0x1c]
jae 0x10018dc7
test esi, esi
jne 0x10018dbf
call fcn.10062168
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x10018d9b
call fcn.10062168
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jne 0x10018dc3
call fcn.10062168
cmp ebx, dword [esi + 0x10]
jb 0x10018db6
call fcn.10062168
add ebx, 0x1c
mov dword [esp + 0x14], ebx
jmp 0x10018d5d
mov eax, dword [esi]
jmp 0x10018d91
mov esi, dword [esi]
jmp 0x10018dac
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x18]
call fcn.10030591
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x10]
call fcn.10030591
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push edi
call fcn.10019e67
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
xor edi, edi
cmp eax, edi
je 0x10018e2a
push dword [esi + 0x74]
push eax
call ebx
push dword [esi + 0x60]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esi + 0x70]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x60], edi
mov dword [esi + 0x70], edi
mov eax, dword [esi + 0x64]
cmp eax, edi
je 0x10018e4f
push dword [esi + 0x6c]
push eax
call ebx
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esi + 0x68]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
push edi
push edi
push edi
push edi
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov dword [esi + 0x8c], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi + 0x3c], 0xffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10018e97
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [esi + 0x5c], edi
je 0x10018ed3
mov ecx, esi
call fcn.10019848
test eax, eax
je 0x10018ed8
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x1001922e
push edi
push edi
call fcn.10061b68
add esp, 0x18
mov dword [esi + 0x78], eax
cmp eax, edi
je 0x10018ed3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
leave
ret
mov eax, dword [esi + 0x80]
cmp eax, edi
je 0x10018ed3
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x80]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x80]
push edi
mov ecx, dword [eax]
neg edx
push edx
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [esi + 0x38]
push dword [esi + 0x34]
push edi
push edi
push dword [esi + 0x60]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x10018ed3
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
inc eax
jmp 0x10018ed5

Function at 0x10018f35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x10099890
push 0x7d
push dword [0x100b2778]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10018fe6
push esi
push dword [0x100b2778]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10018fe6
push esi
push dword [0x100b2778]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10018fdf
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10018fd8
cmp dword [ebp - 4], 0
je 0x10018fd8
push edi
push eax
push dword [ebp - 4]
call fcn.10062810
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [ebp + 8]
push edi
push esi
call fcn.10018a02
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
jmp 0x10018fe8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10022a61
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe34
mov eax, dword [0x100b02c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.1001a54d
cmp byte [eax + 0x1b5], 0
jne 0x10022bb0
call fcn.1001a54d
mov byte [eax + 0x208], 1
push 0x208
lea eax, [ebp - 0x828]
push eax
push dword [0x100b2774]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, pe_nt_image_headers32
push eax
lea ecx, [ebp - 0xe30]
push ecx
push eax
lea ecx, [ebp - 0xc30]
push ecx
push eax
lea eax, [ebp - 0x418]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.10062399
xor eax, eax
mov word [ebp - 0x218], ax
add esp, 0x24
lea eax, [ebp - 0xc]
push eax
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10060a93
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10060a93
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x620]
push esi
push eax
call fcn.10060b10
add esp, 0xc
push str.OCSetupHlp.nsh
lea eax, [ebp - 0x620]
push esi
push eax
call fcn.10060a93
lea eax, [ebp - 0x620]
add esp, 0xc
push eax
call fcn.10007ac9
pop ecx
test al, al
jne 0x10022bb0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa30]
push esi
push eax
call fcn.10060b10
add esp, 0xc
push str.OCAPIUnitTest.exe
lea eax, [ebp - 0xa30]
push esi
push eax
call fcn.10060a93
lea eax, [ebp - 0xa30]
add esp, 0xc
push eax
call fcn.10007ac9
pop ecx
test al, al
jne 0x10022bb0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea eax, [ebp - 0x828]
push eax
call esi
push 4
push 0
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005fc2b
leave
ret
Function at 0x10025c21
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push 0x198
mov eax, 0x100832b4
call fcn.1006a107
lea esi, [ebp - 0x1a0]
mov dword [ebp - 4], 2
call fcn.1002d074
mov byte [ebp - 4], 3
mov bl, byte [0x100b4029]
mov al, byte [0x100b402a]
mov cl, byte [0x100b402b]
mov dl, byte [0x100b402c]
mov byte [ebp - 0x195], al
mov byte [ebp - 0x1a1], cl
mov byte [ebp - 0x1a2], dl
test bl, bl
jne 0x10025cb9
test al, al
jne 0x10025cb9
test cl, cl
jne 0x10025cb9
test dl, dl
jne 0x10025cb9
xor esi, esi
cmp dword [ebp - 0x1a0], esi
je 0x10025c95
push dword [ebp - 0x1a0]
call fcn.10060146
pop ecx
cmp dword [ebp + 0xc], esi
je 0x10025ca3
push dword [ebp + 0xc]
call fcn.10060146
pop ecx
cmp dword [ebp + 0x14], esi
je 0x10025cb1
push dword [ebp + 0x14]
call fcn.10060146
pop ecx
cmp dword [ebp + 0x1c], esi
jmp 0x10025e73
lea eax, [ebp + 0x1c]
call fcn.1002d199
test al, al
je 0x10025cd2
push str.empty
lea esi, [ebp + 0x1c]
call fcn.1002d486
push str._r_nAPI_version:
lea esi, [ebp + 0x1c]
call fcn.1002d4f1
push 0x1009de84
call fcn.1002d4f1
mov eax, dword [ebp + 8]
xor edi, edi
sub eax, edi
je 0x10025e04
dec eax
je 0x10025df4
dec eax
je 0x10025d39
dec eax
je 0x10025d22
sub eax, 3
jne 0x10025e40
cmp byte [ebp - 0x1a2], al
je 0x10025e40
push str.GenErr:
jmp 0x10025e0d
cmp byte [ebp - 0x195], 0
je 0x10025e40
push str.Info:
jmp 0x10025e0d
cmp byte [ebp - 0x1a1], 0
je 0x10025e40
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call edi
movzx eax, ax
mov ebx, 0x1009def0
push ebx
push eax
push str.OLANGS:
lea esi, [ebp - 0x1a0]
call fcn.1002d486
call fcn.1002d548
mov esi, eax
call fcn.1002d4f1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push ebx
push eax
lea eax, [ebp - 0x1a0]
call fcn.1002d548
mov esi, eax
call fcn.1002d4f1
mov esi, 0x80
push esi
lea eax, [ebp - 0x194]
push eax
push 0x59
call edi
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x194]
push esi
push eax
call fcn.10030760
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
lea esi, [ebp - 0x1a0]
call fcn.1002d4f1
push dword [ebp - 0x1a0]
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0xc]
push str.da30be9bcd4ad240be8c12290485c41b
push str.b2339614c111441ba9365e0dd24ca788
call fcn.10038044
add esp, 0x10
xor edi, edi
jmp 0x10025e40
cmp byte [ebp - 0x195], 0
je 0x10025e40
push str.ODF:
jmp 0x10025e0d
test bl, bl
je 0x10025e40
push str.ORC:
lea esi, [ebp - 0x1a0]
call fcn.1002d486
push dword [ebp + 0x14]
mov esi, eax
call fcn.1002d4f1
push dword [ebp - 0x1a0]
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0xc]
push str.da30be9bcd4ad240be8c12290485c41b
push str.b2339614c111441ba9365e0dd24ca788
call fcn.10038044
add esp, 0x10
cmp dword [ebp - 0x1a0], edi
je 0x10025e54
push dword [ebp - 0x1a0]
call fcn.10060146
pop ecx
cmp dword [ebp + 0xc], edi
je 0x10025e62
push dword [ebp + 0xc]
call fcn.10060146
pop ecx
cmp dword [ebp + 0x14], edi
je 0x10025e70
push dword [ebp + 0x14]
call fcn.10060146
pop ecx
cmp dword [ebp + 0x1c], edi
je 0x10025e7e
push dword [ebp + 0x1c]
call fcn.10060146
pop ecx
call fcn.1006a18a
ret
Function at 0x1002b407
Capabilities:
Delete file

Disassembly:
push 0x30
mov eax, 0x10084bfd
call fcn.1006a09e
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push eax
mov ecx, str.16282F95_E0BC_4589_B27D_3A41D9261168
call fcn.10002a34
push ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], esp
mov esi, esp
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x1009fd58
call fcn.10002a34
push esi
call fcn.10007c00
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea esi, [ebp - 0x1c]
call fcn.10009d65
pop ecx
pop ecx
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
push 3
push eax
push closesocket
mov byte [ebp - 4], 2
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
call fcn.1000b010
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x1002b5db
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x34]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call fcn.1000afda
mov edi, dword [ebp - 0x34]
lea eax, [edi + 1]
push eax
call fcn.1005fb39
pop ecx
mov esi, eax
push edi
push esi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x20], esi
mov byte [esi], 0
call fcn.1000af9d
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0x14], 0
je 0x1002b4d2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
test bl, bl
je 0x1002b5c4
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
mov byte [edi + esi], 0
push 1
lea edi, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.10010021
test al, al
je 0x1002b5bc
push esi
mov eax, edi
call fcn.10010821
test al, al
je 0x1002b5bc
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push eax
mov ecx, str.OfferId
call fcn.10002a34
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
push eax
mov ecx, str.Offer
mov byte [ebp - 4], 4
call fcn.10002a34
mov eax, edi
push eax
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10010088
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x18]
push dword [eax - 0xc]
mov esi, edi
call fcn.10002938
push eax
lea esi, [ebp - 0x3c]
call fcn.1002d125
mov esi, edi
mov byte [ebp - 4], 6
call fcn.10002668
lea esi, [ebp - 0x28]
call fcn.1002d074
push ecx
push ecx
lea eax, [ebp - 0x3c]
mov esi, esp
mov dword [ebp - 0x2c], esp
push eax
mov byte [ebp - 4], 7
call fcn.1002d0e2
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.100287d1
cmp dword [ebp - 0x28], 0
je 0x1002b59f
push dword [ebp - 0x28]
call fcn.10060146
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x1002b5ae
push dword [ebp - 0x3c]
call fcn.10060146
pop ecx
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10002b29
mov esi, dword [ebp - 0x20]
lea edi, [ebp - 0x34]
call fcn.1000ff27
push esi
call fcn.10060146
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x1002b5e9
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10002b29
mov al, bl
call fcn.1006a176
ret 4
Function at 0x1002b743
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x10080748
call fcn.1006a09e
mov esi, dword [ebp + 8]
and dword [ebp - 0x18], 0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10002aac
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 0x18], edi
mov edi, str._OCTracking
push edi
call fcn.100041e8
cmp eax, 0xffffffff
je 0x1002b84d
mov eax, dword [0x100b27b4]
mov ecx, 0x100b27b4
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
push str.track_dlm_debug_info
mov byte [ebp - 4], 2
call fcn.100041e8
cmp eax, 0xffffffff
jne 0x1002b7ba
push str.track_dlm_debug_info_false_
lea eax, [ebp - 0x10]
push eax
call fcn.1000407f
mov ebx, dword [ebp - 0x10]
push str.track_dlm_debug_error
call fcn.100041e8
cmp eax, 0xffffffff
jne 0x1002b7da
push str.track_dlm_debug_error_false_
lea eax, [ebp - 0x10]
push eax
call fcn.1000407f
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 0xc], 0
je 0x1002b843
push edi
call fcn.100041e8
lea edi, [eax + 0xc]
mov ecx, edi
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.1000a926
mov byte [ebp - 4], 3
push dword [ebx - 0xc]
lea eax, [ebp - 0x14]
push ebx
call fcn.10004293
lea eax, [ebp - 0x1c]
push eax
mov edx, edi
mov eax, esi
call fcn.1000a8c7
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 4], 4
call fcn.10004067
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10002b29
lea eax, [ebp - 0x14]
mov edi, esi
call fcn.100023e1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
lea eax, [ebx - 0x10]
call fcn.10002b29
jmp 0x1002b858
push str._r_n_OCTracking_track_dlm_debug_info_false__track_dlm_debug_error_false____
push esi
call fcn.1000407f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, esi
call fcn.1006a176
ret
Function at 0x1002f851
Capabilities:
Acquire debug privileges

Disassembly:
push edi
push str.SeCreateGlobalPrivilege
push esi
call fcn.1002f7eb
push str.SeBackupPrivilege
push esi
mov edi, eax
call fcn.1002f7eb
push str.SeCreatePagefilePrivilege
push esi
call fcn.1002f7eb
push str.SeCreateSymbolicLinkPrivilege
push esi
call fcn.1002f7eb
push str.SeDebugPrivilege
push esi
call fcn.1002f7eb
push str.SeImpersonatePrivilege
push esi
call fcn.1002f7eb
push str.SeIncreaseBasePriorityPrivilege
push esi
call fcn.1002f7eb
push str.SeIncreaseQuotaPrivilege
push esi
call fcn.1002f7eb
add esp, 0x40
push str.SeLoadDriverPrivilege
push esi
call fcn.1002f7eb
push str.SeManageVolumePrivilege
push esi
call fcn.1002f7eb
push str.SeProfileSingleProcessPrivilege
push esi
call fcn.1002f7eb
push str.SeRemoteShutdownPrivilege
push esi
call fcn.1002f7eb
push str.SeRestorePrivilege
push esi
call fcn.1002f7eb
push str.SeSecurityPrivilege
push esi
call fcn.1002f7eb
push str.SeSystemEnvironmentPrivilege
push esi
call fcn.1002f7eb
push str.SeSystemProfilePrivilege
push esi
call fcn.1002f7eb
add esp, 0x40
push str.SeSystemtimePrivilege
push esi
call fcn.1002f7eb
push str.SeTakeOwnershipPrivilege
push esi
call fcn.1002f7eb
add esp, 0x10
mov eax, edi
pop edi
ret
Function at 0x1002fc07
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
cmp byte [esi], 1
jne 0x1002fc19
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x20c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret
Function at 0x100305b1
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, eax
lea eax, [edi + 4]
push eax
mov dword [ebp - 8], eax
call fcn.1005fb39
pop ecx
xor ecx, ecx
mov esi, eax
mov dword [esi], 1
cmp dword [ebp + 0x10], ecx
je 0x1003060a
cmp edi, ecx
jbe 0x1003060a
push ebx
push 0x18
mov eax, edi
xor edx, edx
pop ebx
div ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor edx, edx
push 0x18
pop ebx
div ebx
mov al, byte [edx + 0x100b196c]
mov edx, dword [ebp + 0x10]
xor al, byte [ecx + edx]
inc ecx
inc dword [ebp - 4]
mov byte [esi + ecx + 3], al
cmp ecx, edi
jb 0x100305e7
pop ebx
push dword [ebp - 8]
push esi
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call fcn.10060146
pop ecx
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop esi
leave
ret

Function at 0x10030631
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
or edi, 0xffffffff
mov esi, eax
cmp dword [ebp + 0x14], ebx
jne 0x10030697
cmp esi, ebx
je 0x10030697
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffffc
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003067c
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
test eax, eax
je 0x10030734
xor ecx, ecx
cmp eax, 0xea
setne cl
dec ecx
dec ecx
mov eax, ecx
jmp 0x10030734
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 4], eax
je 0x100306aa
push eax
call fcn.1005fb39
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030715
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add edi, 0xfffffffc
xor ecx, ecx
mov dword [esi], edi
cmp eax, ecx
je 0x100306da
mov edx, dword [ebx]
mov dword [eax], edx
cmp dword [ebp + 0x14], ecx
je 0x10030711
cmp edi, ecx
jbe 0x10030711
push 0x18
mov eax, edi
xor edx, edx
pop esi
div esi
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
push 0x18
pop esi
div esi
mov al, byte [edx + 0x100b196c]
xor al, byte [ebx + ecx + 4]
mov edx, dword [ebp + 0x14]
mov byte [ecx + edx], al
inc ecx
inc dword [ebp - 8]
cmp ecx, edi
jb 0x100306ef
xor edi, edi
jmp 0x10030727
cmp eax, 0xea
jne 0x10030727
mov eax, dword [ebp - 4]
add eax, 0xfffffffc
push 0xfffffffffffffffe
mov dword [esi], eax
pop edi
test ebx, ebx
je 0x10030732
push ebx
call fcn.10060146
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10030b0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1074
call fcn.10067670
mov eax, dword [0x100b02c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1070]
call fcn.10042f21
push 0x100a0bf4
push ecx
call fcn.100690ce
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10030b51
mov byte [0x100b3534], al
mov eax, 0x100b3534
jmp 0x10030c11
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1018]
push 1
push eax
call fcn.1006480e
add esp, 0x10
jmp 0x10030b91
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1070]
call fcn.10042f45
push edi
push esi
lea eax, [ebp - 0x1018]
push 1
push eax
call fcn.1006480e
add esp, 0x18
test eax, eax
jg 0x10030b6b
lea eax, [ebp - 0x14]
push eax
lea ebx, [ebp - 0x1070]
call fcn.10042fe8
push edi
call fcn.1006628c
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
push str._02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x_02.2x
push 0x21
mov esi, 0x100b3534
push esi
call fcn.10066dc9
add esp, 0x54
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fc2b
leave
ret
Function at 0x10036c15
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [0x100b410c], bl
jne 0x10036ce3
call fcn.10036b63
call fcn.10036bb6
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov byte [eax + 0xc], bl
mov byte [eax + 0xd], bl
mov dword [eax + 0x10], ecx
xor eax, eax
push esi
mov ecx, dword [eax*4 + 0x100b3d68]
cmp byte [ecx + 8], 1
jne 0x10036c64
cmp byte [ecx + 9], 1
je 0x10036c86
inc eax
cmp eax, 8
jl 0x10036c51
mov eax, 0x100b3d68
mov esi, dword [eax]
cmp esi, ebx
je 0x10036c7a
cmp byte [esi + 8], bl
je 0x10036cc4
add eax, 4
cmp eax, 0x100b3d88
jl 0x10036c6f
jmp 0x10036ce2
lea esi, [eax*4 + 0x100b3d68]
mov eax, dword [esi]
cmp dword [eax], ebx
je 0x10036c9f
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
mov dword [eax], ebx
mov eax, dword [esi]
mov byte [eax + 9], bl
mov eax, dword [esi]
mov byte [eax + 8], 1
mov eax, dword [esi]
add eax, 4
push eax
push ebx
push ebx
push 0x1003667b
push ebx
push ebx
call fcn.10061b68
mov ecx, dword [esi]
mov dword [ecx], eax
jmp 0x10036cdf
lea eax, [esi + 4]
push eax
push ebx
push ebx
push 0x1003667b
push ebx
push ebx
mov byte [esi + 9], bl
mov byte [esi + 8], 1
call fcn.10061b68
mov dword [esi], eax
add esp, 0x18
pop esi
pop ebx
pop ebp
ret