joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1028737
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1037388]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x1028783
call esi
mov edi, eax
cmp edi, ebx
je 0x1028769
mov dword [0x1037388], 1
jmp 0x1028788
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x102877e
push 2
pop eax
mov dword [0x1037388], eax
jmp 0x1028783
mov eax, dword [0x1037388]
cmp eax, 1
jne 0x1028800
cmp edi, ebx
jne 0x1028794
call esi
mov edi, eax
cmp edi, ebx
je 0x1028809
cmp word [edi], bx
mov eax, edi
je 0x10287a9
inc eax
inc eax
cmp word [eax], bx
jne 0x102879b
inc eax
inc eax
cmp word [eax], bx
jne 0x102879b
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10287f7
push eax
call fcn.0102a18a
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x10287f7
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x10287f4
push dword [ebp - 4]
call fcn.01027037
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1028858
cmp eax, 2
je 0x102880d
cmp eax, ebx
je 0x102880d
xor eax, eax
jmp 0x102885a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1028809
cmp byte [esi], bl
je 0x102882a
inc eax
cmp byte [eax], bl
jne 0x1028820
inc eax
cmp byte [eax], bl
jne 0x1028820
sub eax, esi
inc eax
mov edi, eax
push edi
call fcn.0102a18a
cmp eax, ebx
pop ecx
je 0x1028851
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1028aa7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x103621c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1028b09
push 0x88
push 1
call fcn.0102d6fe
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1028b01
push esi
push dword [0x103621c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1028b01
push esi
call fcn.01028a8a
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1028b09
push 0x10
call fcn.01026ac0
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x1028c91
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
call fcn.0102a1a6
test eax, eax
je 0x1028caa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x103621c], eax
jne 0x1028cb2
call fcn.01028a67
xor eax, eax
ret
push esi
push 0x88
push 1
call fcn.0102d6fe
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1028cf2
push esi
push dword [0x103621c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1028cf2
push esi
call fcn.01028a8a
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
pop esi
ret
call fcn.01028a67
xor eax, eax
pop esi
ret

Function at 0x102e027
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1037500], ebx
push esi
push edi
jne 0x102e0a9
push 0x100a318
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x102e0e4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100a30c
push edi
call esi
test eax, eax
mov dword [0x1037500], eax
je 0x102e0e4
push 0x100a2fc
push edi
call esi
push 0x100a2e8
push edi
mov dword [0x1037504], eax
call esi
cmp dword [0x1037238], 2
mov dword [0x1037508], eax
jne 0x102e0a9
push 0x100a2cc
push edi
call esi
test eax, eax
mov dword [0x1037510], eax
je 0x102e0a9
push 0x100a2b4
push edi
call esi
mov dword [0x103750c], eax
mov eax, dword [0x103750c]
test eax, eax
je 0x102e0ee
call eax
test eax, eax
je 0x102e0d5
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1037510]
test eax, eax
je 0x102e0d5
test byte [ebp - 8], 1
jne 0x102e0ee
cmp dword [0x1037244], 4
jb 0x102e0e8
or byte [ebp + 0x12], 0x20
jmp 0x102e10d
xor eax, eax
jmp 0x102e11d
or byte [ebp + 0x12], 4
jmp 0x102e10d
mov eax, dword [0x1037504]
test eax, eax
je 0x102e10d
call eax
mov ebx, eax
test ebx, ebx
je 0x102e10d
mov eax, dword [0x1037508]
test eax, eax
je 0x102e10d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1037500]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102e840
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x102e871
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x102e878
cmp ebx, dword [ebp + 8]
jae 0x102e878
xor eax, eax
jmp 0x102ea68
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x102e889
xor eax, eax
inc eax
jmp 0x102ea67
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x102e89f
cmp ecx, edx
jae 0x102e9e4
cmp dword [eax + 4], 0
je 0x102e8a8
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x102e890
cmp dword [ebp + 8], 0
je 0x102e8ca
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x102e9e4
cmp eax, esi
jae 0x102e9e4
mov eax, dword [0x1037520]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x102e8ef
cmp dword [esi*4 + 0x1037528], edi
je 0x102e9e8
inc esi
cmp esi, eax
jl 0x102e8dd
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102ea64
cmp dword [ebp - 8], 0x1000000
jne 0x102ea64
test byte [ebp - 0xc], 0xcc
je 0x102e96d
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x102ea64
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x102ea64
cmp word [eax + 0x18], 0x10b
jne 0x102ea64
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x102ea64
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x102e96d
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x102e96d
test byte [ecx + 0x27], 0x80
jne 0x102e9e4
push 1
push 0x1037568
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x102e881
mov ecx, dword [0x1037520]
test ecx, ecx
mov edx, ecx
jle 0x102e9a1
lea eax, [ecx*4 + 0x1037524]
cmp dword [eax], edi
je 0x102e9a1
dec edx
sub eax, 4
test edx, edx
jg 0x102e995
test edx, edx
jne 0x102e9d2
push 0xf
pop ebx
cmp ecx, ebx
jg 0x102e9ae
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x102e9c6
lea eax, [edx*4 + 0x1037528]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x102e9b4
cmp ecx, 0x10
jge 0x102e9d2
inc ecx
mov dword [0x1037520], ecx
push 0
push 0x1037568
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x102e881
xor eax, eax
jmp 0x102ea67
test esi, esi
jle 0x102e881
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x1037568
call ebx
test eax, eax
jne 0x102e881
cmp dword [esi*4 + 0x1037528], edi
je 0x102ea3e
mov eax, dword [0x1037520]
lea esi, [eax - 1]
test esi, esi
jl 0x102ea2c
cmp dword [esi*4 + 0x1037528], edi
je 0x102ea28
dec esi
jns 0x102ea1c
test esi, esi
jge 0x102ea3c
cmp eax, 0x10
jge 0x102ea37
inc eax
mov dword [0x1037520], eax
lea esi, [eax - 1]
jmp 0x102ea3e
je 0x102ea56
xor ecx, ecx
test esi, esi
jl 0x102ea56
lea eax, [ecx*4 + 0x1037528]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x102ea44
push 0
push 0x1037568
call ebx
jmp 0x102e881
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102efd9
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01028ee0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102f03f
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1037238]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x102f043
xor eax, eax
jmp 0x102f050
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102f8a9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x10360ac]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x41c], ecx
jne 0x102f8e0
xor eax, eax
jmp 0x102fa93
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1038980]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x102f915
push 2
push ecx
push ecx
push dword [ebp + 8]
call fcn.0103229a
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x102f9e3
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x40c], ecx
jbe 0x102fa61
jmp 0x102f93c
xor ecx, ecx
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x102f992
mov edx, dword [ebp - 0x414]
inc dword [ebp - 0x414]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x102f97d
inc dword [ebp - 0x41c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x410]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x410]
cmp dword [ebp - 0x410], 0x400
jl 0x102f954
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x102fa10
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x418], eax
cmp eax, edi
jl 0x102fa1c
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0x10]
jb 0x102f93a
jmp 0x102fa1c
push ecx
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x102fa10
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x418], eax
jmp 0x102fa1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x102fa8b
cmp dword [ebp - 0x40c], eax
je 0x102fa5b
push 5
pop esi
cmp dword [ebp - 0x40c], esi
jne 0x102fa4d
call fcn.0102d665
mov dword [eax], 9
call fcn.0102d673
mov dword [eax], esi
jmp 0x102fa86
push dword [ebp - 0x40c]
call fcn.0102d681
pop ecx
jmp 0x102fa86
mov edi, dword [ebp - 0x420]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x102fa73
cmp byte [edi], 0x1a
jne 0x102fa73
xor eax, eax
jmp 0x102fa91
call fcn.0102d665
mov dword [eax], 0x1c
call fcn.0102d673
and dword [eax], 0
or eax, 0xffffffff
jmp 0x102fa91
sub eax, dword [ebp - 0x41c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.0102699e
leave
ret
Function at 0x1032cdc
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
call fcn.0102f77d
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1032e23
push 2
push esi
push dword [ebp + 8]
call fcn.0102f77d
add esp, 0xc
cmp eax, ebx
je 0x1032e23
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x1032dc6
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1032d57
call fcn.0102d665
mov dword [eax], 0xc
or esi, 0xffffffff
jmp 0x1032e0e
push 0x8000
push dword [ebp + 8]
call fcn.010333f0
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp edi, ebx
mov eax, ebx
jge 0x1032d71
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0102f8a9
add esp, 0xc
cmp eax, 0xffffffff
je 0x1032d8d
sub edi, eax
test edi, edi
jg 0x1032d69
jmp 0x1032da5
call fcn.0102d673
cmp dword [eax], 5
jne 0x1032da2
call fcn.0102d665
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.010333f0
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1032e0e
jge 0x1032e0e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0102f77d
push dword [ebp + 8]
call fcn.0103116d
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x1032e0e
call fcn.0102d665
mov dword [eax], 0xd
call fcn.0102d673
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0102f77d
add esp, 0xc
mov eax, esi
pop edi
jmp 0x1032e25
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x1032e2e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1033006
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x1038980]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1033006
test cl, 0x48
je 0x1032e9b
cmp byte [eax + 5], 0xa
je 0x1032e9b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1032eed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x1032ed5
call fcn.0102d665
mov dword [eax], 9
call fcn.0102d673
mov dword [eax], esi
jmp 0x1032ee5
cmp eax, 0x6d
je 0x1033006
push eax
call fcn.0102d681
pop ecx
or eax, 0xffffffff
jmp 0x1033008
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x1033001
test eax, eax
je 0x1032f14
cmp byte [ebx], 0xa
jne 0x1032f14
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x1032f1d
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1032ffb
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1032feb
cmp al, 0xd
je 0x1032f4f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x1032fdd
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1032f69
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x1032f64
add dword [ebp + 0x10], 2
jmp 0x1032fbd
mov dword [ebp + 0x10], eax
jmp 0x1032fd9
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1032f91
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1032fd9
cmp dword [ebp - 0xc], 0
je 0x1032fd9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1032fb2
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1032fbd
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1032fdc
cmp ebx, dword [ebp + 0xc]
jne 0x1032fc2
cmp byte [ebp - 1], 0xa
jne 0x1032fc2
mov byte [ebx], 0xa
jmp 0x1032fdc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0103229a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1032fdd
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1032f33
jmp 0x1032ffb
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x1032ffb
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1033008
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001051
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
xor ecx, ecx
or eax, 0x20006
cmp dword [ebp + 8], esi
push str.SoftwareBaiduBDLOG
setne cl
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0xc]
call fcn.1000b627
test eax, eax
jne 0x100010c3
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push esi
push str.cur_version
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100010bb
inc edi
lea esi, [ebp - 0xc]
call fcn.1000b7ae
lea esi, [ebp - 0xc]
call fcn.1000b7ae
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10001eb3
Capabilities:
Create thread

Disassembly:
push 0x10028368
push 0
push 0x10028364
push 0x10001eec
push 0
push 0
call fcn.1000eed1
and dword [0x1002836c], 0
add esp, 0x18
mov dword [0x10028364], eax
test eax, eax
je 0x10001ee9
cmp eax, 0xffffffff
je 0x10001ee9
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x1000244a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x274], eax
xor eax, eax
push 0xee
mov word [ebp - 0x15c], ax
xor edi, edi
lea eax, [ebp - 0x15a]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x6c], 0x66296635
mov dword [ebp - 0x68], 0x66326620
mov dword [ebp - 0x64], 0x66276631
mov dword [ebp - 0x60], 0x66236634
mov dword [ebp - 0x5c], 0x6625663a
mov dword [ebp - 0x58], 0x6607660a
mov dword [ebp - 0x54], 0x66156615
mov dword [ebp - 0x50], 0x66156603
mov dword [ebp - 0x4c], 0x6622663a
mov dword [ebp - 0x48], 0x6614660f
mov dword [ebp - 0x44], 0x66056603
mov dword [ebp - 0x40], 0x66096612
mov dword [ebp - 0x3c], 0x661f6614
mov dword [ebp - 0x38], 0x6615663a
mov dword [ebp - 0x34], 0x6603660e
mov dword [ebp - 0x30], 0x660a660a
mov dword [ebp - 0x2c], 0x661e6603
mov dword [ebp - 0x28], 0x6625663a
mov dword [ebp - 0x24], 0x66166609
mov dword [ebp - 0x20], 0x662e661f
mov dword [ebp - 0x1c], 0x66096609
mov dword [ebp - 0x18], 0x662e660d
mov dword [ebp - 0x14], 0x66086607
mov dword [ebp - 0x10], 0x660a6602
mov dword [ebp - 0xc], 0x66146603
mov dword [ebp - 8], 0x66666615
call fcn.1000f470
add esp, 0xc
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x258], edi
xor eax, eax
xor byte [ebp + eax - 0x6c], 0x66
inc eax
cmp eax, 0x68
jb 0x10002555
call fcn.1000b059
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x6c]
push ecx
xor ecx, ecx
or eax, 0x20019
cmp esi, edi
setne cl
lea ebx, [ebp - 0x260]
add ecx, 0x80000001
push ecx
call fcn.1000b6ef
test eax, eax
jne 0x10002679
push 0x78
pop esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], edi
lea eax, [ebp - 0x27c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x250]
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10002695
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x260]
mov eax, 0x20019
lea ebx, [ebp - 0x26c]
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], edi
call fcn.1000b6ef
test eax, eax
jne 0x10002652
push edi
mov eax, ebx
mov dword [ebp - 0x270], esi
push eax
lea esi, [ebp - 0x270]
lea edi, [ebp - 0x24c]
call fcn.100056ce
test eax, eax
jne 0x10002645
mov eax, edi
push eax
push dword [ebp - 0x274]
call fcn.1000dfd1
pop ecx
pop ecx
test eax, eax
je 0x1000266b
lea esi, [ebp - 0x26c]
call fcn.1000b7ae
xor edi, edi
lea esi, [ebp - 0x26c]
call fcn.1000b7ae
inc dword [ebp - 0x250]
push 0x78
pop esi
jmp 0x100025a7
lea esi, [ebp - 0x26c]
call fcn.1000b7ae
xor edi, edi
inc edi
lea esi, [ebp - 0x260]
call fcn.1000b7ae
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d755
leave
ret
lea esi, [ebp - 0x260]
call fcn.1000b7ae
jmp 0x10002679
Function at 0x10003247
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], 0xcc83cc9f
mov dword [ebp - 0x74], 0xcc98cc8a
mov dword [ebp - 0x70], 0xcc8dcc9b
mov dword [ebp - 0x6c], 0xcc89cc9e
mov dword [ebp - 0x68], 0xcc81cc90
mov dword [ebp - 0x64], 0xccafcca5
mov dword [ebp - 0x60], 0xcca3ccbe
mov dword [ebp - 0x5c], 0xcca3ccbf
mov dword [ebp - 0x58], 0xccb8ccaa
mov dword [ebp - 0x54], 0xcc9bcc90
mov dword [ebp - 0x50], 0xcca2cca5
mov dword [ebp - 0x4c], 0xcca3cca8
mov dword [ebp - 0x48], 0xccbfccbb
mov dword [ebp - 0x44], 0xcc82ccec
mov dword [ebp - 0x40], 0xcc90cc98
mov dword [ebp - 0x3c], 0xccb9cc8f
mov dword [ebp - 0x38], 0xccbeccbe
mov dword [ebp - 0x34], 0xcca2cca9
mov dword [ebp - 0x30], 0xcc9accb8
mov dword [ebp - 0x2c], 0xccbecca9
mov dword [ebp - 0x28], 0xcca5ccbf
mov dword [ebp - 0x24], 0xcca2cca3
mov word [ebp - 0x20], 0xcccc
mov dword [ebp - 0x1c], 0xcca2cc85
mov dword [ebp - 0x18], 0xccb8ccbf
mov dword [ebp - 0x14], 0xcca0ccad
mov dword [ebp - 0x10], 0xcc88cca0
mov dword [ebp - 0xc], 0xccb8ccad
mov dword [ebp - 8], 0xcccccca9
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
xor eax, eax
xor byte [ebp + eax - 0x78], 0xcc
inc eax
cmp eax, 0x5a
jb 0x1000333c
push ebx
call fcn.1000b059
neg eax
sbb eax, eax
lea ecx, [ebp - 0x78]
and eax, 0x100
push ecx
or eax, 0x20019
push reloc.OLEAUT32.dll_SysReAllocString
lea ebx, [ebp - 0x88]
call fcn.1000b6ef
pop ebx
test eax, eax
jne 0x1000339e
xor byte [ebp + esi - 0x1c], 0xcc
inc esi
cmp esi, 0x18
jb 0x10003374
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000b773
lea esi, [ebp - 0x88]
call fcn.1000b7ae
mov edi, dword [ebp - 0x7c]
lea esi, [ebp - 0x88]
call fcn.1000b7ae
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000d755
leave
ret