joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426258
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a28
xor eax, eax
push ebp
push 0x4262de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.00406a34
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x4262f4
mov edx, dword [ebp - 4]
call fcn.0040488c
mov eax, dword [ebp - 0x28]
call fcn.00404a38
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4262e5
lea eax, [ebp - 0x28]
call fcn.00404588
lea eax, [ebp - 4]
call fcn.00404588
ret
Function at 0x438c99
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
add ecx, esi
sub esi, 0xd3bddc6b
call fcn.00438cde
mov esi, 0x4413448
add esi, 1
xor dword [eax], ebx
add esi, 1
or esi, esi
sub esi, ecx
inc eax
add esi, ecx
sub esi, 0x8c5128f3
dec esi
cmp eax, edx
jne fcn.00438c99
mov ecx, 0xfc249967
ret
Function at 0x66add7c8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6714e018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6714e018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x66add85a
jmp 0x66add8cc
jmp 0x66add93e
jmp 0x66add9b0
jmp 0x66adda22
jmp 0x66adda94
jmp 0x66addb06
jmp 0x66addb78
jmp 0x66addbea
jmp 0x66addc5c
jmp 0x66addcce
jmp 0x66addd40
jmp 0x66adddb2
jmp 0x66adde24
jmp 0x66adde96
mov dword [ebp - 0x14], 0
jmp 0x66addf0f
jmp 0x66addf81
jmp 0x66addff3
jmp 0x66ade065
jmp 0x66ade0d7
jmp 0x66ade149
jmp 0x66ade1bb
jmp 0x66ade22d
jmp 0x66ade29f
jmp 0x66ade311
jmp 0x66ade383
jmp 0x66ade3f5
jmp 0x66ade467
jmp 0x66ade4d9
jmp 0x66ade54b
mov dword [ebp - 0x18], 0
jmp 0x66ade5c4
jmp 0x66ade636
jmp 0x66ade6a8
jmp 0x66ade71a
jmp 0x66ade78c
jmp 0x66ade7fe
jmp 0x66ade870
jmp 0x66ade8e2
jmp 0x66ade954
jmp 0x66ade9c6
jmp 0x66adea38
jmp 0x66adeaaa
jmp 0x66adeb1c
jmp 0x66adeb8e
jmp 0x66adec00
mov dword [ebp - 0x10], 0
jmp 0x66adec79
jmp 0x66adeceb
jmp 0x66aded5d
jmp 0x66adedcf
jmp 0x66adee41
jmp 0x66adeeb3
jmp 0x66adef25
jmp 0x66adef97
jmp 0x66adf009
jmp 0x66adf07b
jmp 0x66adf0ed
jmp 0x66adf15f
jmp 0x66adf1d1
jmp 0x66adf243
jmp 0x66adf2b5
mov dword [ebp - 0x10], 0
jmp 0x66ae146f
jmp 0x66adf333
jmp 0x66adf3a5
jmp 0x66adf417
jmp 0x66adf489
jmp 0x66adf4fb
jmp 0x66adf56d
jmp 0x66adf5df
jmp 0x66adf651
jmp 0x66adf6c3
jmp 0x66adf735
jmp 0x66adf7a7
jmp 0x66adf819
jmp 0x66adf88b
jmp 0x66adf8fd
jmp 0x66adf96f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6714e014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x66adf9f2
jmp 0x66adfa64
jmp 0x66adfad6
jmp 0x66adfb48
jmp 0x66adfbba
jmp 0x66adfc2c
jmp 0x66adfc9e
jmp 0x66adfd10
jmp 0x66adfd82
jmp 0x66adfdf4
jmp 0x66adfe66
jmp 0x66adfed8
jmp 0x66adff4a
jmp 0x66adffbc
jmp 0x66ae002e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6714e01c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x66ae00b1
jmp 0x66ae0123
jmp 0x66ae0195
jmp 0x66ae0207
jmp 0x66ae0279
jmp 0x66ae02eb
jmp 0x66ae035d
jmp 0x66ae03cf
jmp 0x66ae0441
jmp 0x66ae04b3
jmp 0x66ae0525
jmp 0x66ae0597
jmp 0x66ae0609
jmp 0x66ae067b
jmp 0x66ae06ed
mov eax, dword [0x6714e008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x66ae077d
jmp 0x66ae07ef
jmp 0x66ae0861
jmp 0x66ae08d3
jmp 0x66ae0945
jmp 0x66ae09b7
jmp 0x66ae0a29
jmp 0x66ae0a9b
jmp 0x66ae0b0d
jmp 0x66ae0b7f
jmp 0x66ae0bf1
jmp 0x66ae0c63
jmp 0x66ae0cd5
jmp 0x66ae0d47
jmp 0x66ae0db9
add dword [ebp - 0xc], 0x28
jmp 0x66ae0e2f
jmp 0x66ae0ea1
jmp 0x66ae0f13
jmp 0x66ae0f85
jmp 0x66ae0ff7
jmp 0x66ae1069
jmp fcn.66ae10db
mov eax, dword [0x6714e018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x66adf2c1
nop
leave
ret
Function at 0x10114960
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10114b44
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd5000]
push edi
jmp 0x1011498a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10114991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10114980
mov eax, 1
add ebx, ebx
jne 0x101149a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101149b4
jne 0x101149d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101149d3
dec eax
add ebx, ebx
jne 0x101149c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10114998
add ebx, ebx
jne 0x101149cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10114a25
xor ecx, ecx
sub eax, 3
jb 0x101149eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10114a5a
sar eax, 1
mov ebp, eax
jmp 0x101149f6
add ebx, ebx
jne 0x101149f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101149c4
inc ecx
add ebx, ebx
jne 0x10114a04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101149c4
add ebx, ebx
jne 0x10114a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10114a06
jne 0x10114a22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10114a06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10114a44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10114a36
jmp 0x10114986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10114a44
add edi, ecx
jmp 0x10114986
pop esi
mov edi, esi
mov ecx, 0xfdd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10114a62
cmp byte [edi], 0x11
jne 0x10114a62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10114a67
lea edi, [esi + 0x111000]
mov eax, dword [edi]
or eax, eax
je 0x10114ad6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x114000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x114118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10114a94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11411c]
or eax, eax
je 0x10114ad0
mov dword [ebx], eax
add ebx, 4
jmp 0x10114ab1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10114b07
cmp al, 0xef
ja 0x10114afa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10114adc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10114ae9
mov ebp, dword [esi + 0x114120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10114b3b
sub esp, 0xffffff80
jmp 0x10040d71
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x28c28a2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0xba31dde
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x46ca0e9d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x643f38eb
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43a7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x43a805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x43a878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x43a83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x43a86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43a86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x43a831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x43a7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100015b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10001685
lea eax, [ebp - 0x20]
push eax
push 0x28
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000167b
lea edx, [ebp - 0xc]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1000167b
mov dword [ebp - 0x1c], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp + ecx - 0x14], eax
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 0x10], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000167b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x1000166e
mov dword [ebp - 0x28], 1
jmp 0x10001675
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000795c
mov esp, ebp
pop ebp
ret

Function at 0x10001870
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10001ae0
add esp, 8
test eax, eax
je 0x10001930
cmp dword [ebp - 0xc], 0
je 0x100018ae
mov dword [ebp - 0x1c], str..pipe_qjbuhuoxcpcemczsyoc
jmp 0x100018b5
mov dword [ebp - 0x1c], str..pipe_qjbuhuoxxhpzmnrcano
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x10001930
push 0
lea eax, [ebp - 0x10]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
push 1
lea ecx, [ebp - 5]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001919
movzx eax, byte [ebp - 5]
cmp eax, 0x4d
jne 0x10001919
mov dword [ebp - 0x20], 1
jmp 0x10001920
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000795c
mov esp, ebp
pop ebp
ret
Function at 0x10001b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x1001a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xd4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10001c73
mov dword [ebp - 0xe4], 0
jmp 0x10001bdb
mov edx, dword [ebp - 0xe4]
add edx, 1
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xd4]
jae 0x10001c73
mov dword [ebp - 0xdc], 0x64
mov dword [ebp - 0xd8], 4
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0xe0]
push eax
push 0
lea ecx, [ebp - 0xdc]
push ecx
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10001c6e
cmp dword [ebp - 0xe0], 4
jne 0x10001c6e
mov edx, dword [ebp - 0xd0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10001a50
add esp, 8
test eax, eax
jne 0x10001c6e
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10001980
add esp, 8
jmp 0x10001bcc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000795c
mov esp, ebp
pop ebp
ret

Function at 0x10001f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x1001a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xd0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10002099
mov eax, dword [ebp + 0x10]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000794e
add esp, 4
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe4], 0
jmp 0x10001fbc
mov ecx, dword [ebp - 0xe4]
add ecx, 1
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0xd0]
jae 0x10002053
mov dword [ebp - 0xd8], 0x64
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0xe0]
push edx
lea eax, [ebp - 0xdc]
push eax
push 0
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1000204e
cmp dword [ebp - 0xdc], 1
jne 0x1000204e
mov edx, dword [ebp - 0xe0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10002200
add esp, 8
test eax, eax
jne 0x1000204e
mov ecx, dword [ebp - 0xe0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100020e0
add esp, 8
jmp 0x10001fad
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
push ecx
call fcn.10007957
add esp, 4
cmp dword [ebp - 0xe8], 0
jne 0x10002083
mov dword [ebp - 0xf0], 0
jmp 0x10002099
mov dword [ebp - 0xe0], 0x8123
mov edx, dword [ebp - 0xe0]
mov dword [ebp - 0xf0], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000795c
mov esp, ebp
pop ebp
ret
Function at 0x10002300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1001a8f8], 0
jne 0x10002326
push 0
push 0
push 0
push 0x10002590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1001a8f8], eax
pop ebp
ret

Function at 0x10002560
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1001a8f8], 0
je 0x10002584
push 0
mov eax, dword [0x1001a8f8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x1001a8f8], 0
pop ebp
ret
Function at 0x10004ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10004e70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10004d7d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10004cea
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001a004]
ja 0x10004cea
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10004cba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10008da0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10004d0f
jmp 0x10004d7d
cmp dword [ebp - 0x14], 0x10000
jne 0x10004d63
cmp dword [ebp - 0x18], 0x10000
jb 0x10004d63
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004d46
mov eax, dword [ebp - 8]
jmp 0x10004d7f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10004d56
xor eax, eax
jmp 0x10004d7f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10004d78
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10004e70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10004cba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10004d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10004ea0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10004e65
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10004dd5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001a004]
ja 0x10004dd5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10004da5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10008da0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10004dfa
jmp 0x10004e65
cmp dword [ebp - 0x14], 0x10000
jne 0x10004e4e
cmp dword [ebp - 0x18], 0x10000
jb 0x10004e4e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004e31
mov eax, dword [ebp - 8]
jmp 0x10004e67
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10004e41
xor eax, eax
jmp 0x10004e67
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10004e60
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10004ea0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10004da5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10004ed0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100052c0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1001a938], 0
jne 0x10004f0d
cmp dword [0x1001a934], 0
je 0x10004f0d
mov eax, dword [0x1001a934]
mov dword [0x1001a938], eax
cmp dword [0x1001a938], 0
je 0x10004f8a
mov ecx, dword [0x1001a938]
cmp dword [ecx + 8], 0
je 0x10004f8a
mov edx, dword [0x1001a938]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10004f8a
mov ecx, dword [0x1001a938]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10004f8a
mov eax, dword [0x1001a938]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10004f59
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10004f60
xor eax, eax
jmp 0x100050a9
mov ecx, dword [0x1001a938]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10008da0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100050a9
mov edx, dword [0x1001a934]
mov dword [0x1001a938], edx
jmp 0x10004fa6
mov eax, dword [0x1001a938]
mov ecx, dword [eax + 4]
mov dword [0x1001a938], ecx
cmp dword [0x1001a938], 0
je 0x10004fe6
cmp dword [0x1001a938], 0
je 0x10004fe4
mov edx, dword [0x1001a938]
cmp dword [edx + 8], 0
je 0x10004fe4
mov eax, dword [0x1001a938]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10004fe4
mov edx, dword [0x1001a938]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10004fe4
jmp 0x10004f3e
jmp 0x10004f98
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100050b0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100050a7
mov eax, dword [ebp - 0x18]
mov dword [0x1001a938], eax
mov ecx, dword [0x1001a938]
mov dword [ecx], 0x52727464
mov edx, dword [0x1001a938]
mov dword [edx + 8], 0
mov eax, dword [0x1001a938]
mov ecx, dword [0x1001a934]
mov dword [eax + 4], ecx
mov edx, dword [0x1001a938]
mov dword [0x1001a934], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1001a938]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10005077
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10005097
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1000506e
mov eax, dword [0x1001a938]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10004f3e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10005df0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001a934]
mov dword [ebp - 4], eax
jmp 0x10005e09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10005e30
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10005e2e
call sub.KERNEL32.dll_GetLastError
jmp 0x10005e32
jmp 0x10005e00
xor eax, eax
mov esp, ebp
pop ebp
ret