joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a9e5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49aa89
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49aa89
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49aa07
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x5005ac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x5019d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x5019fe
cmp eax, 5
je 0x501a35
mov dword [ebp - 0x20], 0
jmp 0x501aea
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x501aea
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.0043da1c
mov dword [ebp - 0x14], eax
jmp 0x501ac0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x501a79
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x501a79
xor eax, eax
jmp 0x501a7c
xor eax, eax
inc eax
cmp eax, 0
je 0x501ab5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044b276
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x501ad8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x501ad8
jmp 0x501adc
xor eax, eax
jmp 0x501adf
xor eax, eax
inc eax
cmp eax, 0
jne 0x501a54
mov eax, dword [0x53dd0c]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x5024dd
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x50250b
cmp eax, 0xf
je 0x502539
mov eax, 0
jmp 0x502780
push dword [ebp + 8]
call fcn.0043d9e6
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0043d912
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x502537
mov eax, 0
jmp 0x502780
jmp 0x50254b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x50277d
Function at 0x504817
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov eax, 1
mov dword [ebp - 0x28], 1
mov eax, 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [0x5489f8]
dec eax
mov edx, eax
mov eax, dword [0x5489f4]
add eax, edx
mov dword [ebp - 0x30], eax
jmp 0x5049d5
call fcn.0050437b
xor al, 1
cmp eax, 0
je 0x504877
jmp 0x5049de
mov eax, dword [0x5489f4]
mov edi, dword [0x5489f8]
dec edi
mov al, byte [eax + edi]
mov byte [ebp - 0x2c], al
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
jne 0x50489c
mov dword [ebp - 0xc], 1
jmp 0x5049d5
mov al, byte [ebp - 0x2c]
cmp al, 0x30
jb 0x5048ac
mov al, byte [ebp - 0x2c]
cmp al, 0x39
ja 0x5048ac
jmp 0x5048b0
xor eax, eax
jmp 0x5048b3
xor eax, eax
inc eax
cmp eax, 0
je 0x5048e5
mov eax, dword [ebp - 0x10]
push edx
mov edx, 0xa
mov ecx, edx
imul ecx
pop edx
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x2c]
sub al, 0x30
mov edx, eax
mov eax, dword [ebp - 0x10]
and edx, 0xff
add eax, edx
mov dword [ebp - 0x10], eax
jmp 0x5049d5
mov al, byte [ebp - 0x2c]
cmp al, 0x3b
jne 0x50490d
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x2c]
cmp al, 0x40
jb 0x50492b
mov al, byte [ebp - 0x2c]
cmp al, 0x7e
ja 0x50492b
mov al, byte [ebp - 0x2c]
cmp al, 0x3c
je 0x50492b
mov al, byte [ebp - 0x2c]
cmp al, 0x5b
je 0x50492b
jmp 0x50492f
xor eax, eax
jmp 0x504932
xor eax, eax
inc eax
cmp eax, 0
je 0x5049c9
mov eax, dword [ebp - 0x10]
xchg edx, eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
dec edi
mov dword [eax + edi*4], edx
mov eax, 0
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x2c]
cmp al, 0x4d
je 0x504980
cmp al, 0x6d
je 0x504999
cmp al, 0x52
je 0x5049b2
mov eax, dword [0x5489f8]
dec eax
mov edx, eax
mov eax, dword [0x5489f4]
add eax, edx
push eax
push dword [ebp - 0x30]
call fcn.005045b6
jmp 0x5049c4
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x504997
push dword [ebp - 0x24]
push 0
push dword [ebp - 0xc]
call fcn.005043ac
jmp 0x5049c4
mov eax, dword [ebp - 0x28]
cmp eax, 3
jne 0x5049b0
push dword [ebp - 0x24]
push 1
push dword [ebp - 0xc]
call fcn.005043ac
jmp 0x5049c4
mov eax, dword [ebp - 0x28]
cmp eax, 2
jne 0x5049c4
push dword [ebp - 0x24]
call fcn.00504591
jmp 0x5049de
mov al, byte [ebp - 0x2c]
cmp al, 0x1b
jne 0x5049d5
jmp 0x5049de
xor eax, eax
inc eax
jne 0x504864
leave
ret
Function at 0x507d5f
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x24
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004429fd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x5b
je 0x507d9c
mov eax, 0
jmp 0x50868f
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x14], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
Function at 0x512f27
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push dword [0x548e34]
push dword [0x515008]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x512f6c
mov eax, 0xffffffff
jmp 0x5130ae
mov eax, dword [0x548e34]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0
jne 0x512f98
mov eax, 1
mov dword [ebp - 0x14], 1
jmp 0x512ffd
mov eax, dword [ebp - 0x10]
and eax, 0xe0
cmp eax, 0xc0
jne 0x512fb5
mov eax, 2
mov dword [ebp - 0x14], 2
jmp 0x512ffd
mov eax, dword [ebp - 0x10]
and eax, 0xf0
cmp eax, 0xe0
jne 0x512fd2
mov eax, 3
mov dword [ebp - 0x14], 3
jmp 0x512ffd
mov eax, dword [ebp - 0x10]
and eax, 0xf8
cmp eax, 0xf0
jne 0x512fef
mov eax, 4
mov dword [ebp - 0x14], 4
jmp 0x512ffd
call fcn.00512ff4

Function at 0x5134ad
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e88]
mov ecx, edx
cdq
idiv ecx
pop edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
mov edx, dword [0x548e88]
mov ecx, edx
cdq
idiv ecx
mov eax, edx
bt eax, 0x1f
jae 0x5134eb
bt ecx, 0x1f
jae 0x5134e9
neg ecx
add eax, ecx
pop edx
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00513683
cmp eax, 0
je 0x513511
mov eax, dword [0x548e88]
mov edx, dword [ebp - 0xc]
sub eax, edx
cmp eax, 1
jne 0x513511
jmp 0x513515
xor eax, eax
jmp 0x513518
xor eax, eax
inc eax
cmp eax, 0
je 0x513532
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x548e2c]
mov edx, dword [ebp - 0x10]
add eax, edx
shl eax, 0x10
mov edx, dword [ebp - 0xc]
or eax, edx
push eax
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
leave
ret 0xc
Function at 0x513a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
jge 0x513a3b
mov eax, 2
mov dword [ebp - 0xc], 2
push dword [ebp + 8]
call fcn.004425f7
push eax
push dword [ebp + 0xc]
call fcn.004425f7
pop edx
xchg edx, eax
add eax, edx
push eax
push dword [ebp - 0xc]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
shl eax, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x548e84]
cmp eax, edx
jle 0x513add
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [0x548e84], eax
push dword [0x548e3c]
call dword [sym.imp.MSVCRT.DLL_free]
add esp, 4
push dword [0x548e84]
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x548e3c], eax
mov eax, 0
mov edx, dword [0x548e3c]
cmp eax, edx
jne 0x513add
push 0
push dword [ebp - 0x14]
push 2
push 0
push str.Cannot_allocate_memory:_init_buffer:
push 6
push 0x18
lea esi, [esp + 4]
push esi
push 2
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [0x548e3c]
mov dword [0x548e40], eax
leave
ret 8

Function at 0x51493d
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00442639
push eax
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x514987
push 0
push str.SetConsoleTitle_failed_
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219c6
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
call fcn.0051359f
call fcn.00513662
push 5
push dword [0x54798c]
call fcn.0044c49f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x5149cd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, 0
cmp eax, edx
je 0x5149cd
xor eax, eax
jmp 0x5149d0
xor eax, eax
inc eax
cmp eax, 0
je 0x5149f5
mov eax, 0x50
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, 0x32
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
leave
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2911232d
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..rsrc
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x479265cd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1003aae0
Capabilities:
Delete file

Disassembly:
sub esp, 0x108
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
lea ecx, [esp]
push esi
push 0x104
push ecx
push eax
mov esi, 0xfffff8ed
call fcn.10116150
test eax, eax
js 0x1003ab26
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
mov ecx, dword [esp + 0x108]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10117cfd
add esp, 0x108
ret 4

Function at 0x1003ad60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xd0
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0xcc], eax
mov eax, dword [0x10004140]
movdqu xmm0, xmmword [0x10004118]
mov dword [esp + 0x78], eax
movzx eax, word [0x10004144]
mov word [esp + 0x7c], ax
movzx eax, word [0x10004158]
movdqu xmmword [esp + 0x50], xmm0
mov word [esp + 0x20], ax
lea eax, [esp + 8]
movdqu xmm0, xmmword [0x10004128]
push eax
push 1
movdqu xmmword [esp + 0x68], xmm0
lea eax, [esp + 0x58]
mov dword [esp + 0x14], 4
movq xmm0, qword [0x10004138]
push 0
movq qword [esp + 0x7c], xmm0
movdqu xmm0, xmmword [0x10004148]
push eax
push reloc.mswstr10.dll_Ordinal_2
movdqu xmmword [esp + 0x24], xmm0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ae27
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 4], eax
sete al
test eax, eax
je 0x1003af09
movdqu xmm0, xmmword [0x1000415c]
movzx eax, word [0x10004194]
mov word [esp + 0xb8], ax
mov al, byte [0x10004196]
movdqu xmmword [esp + 0x80], xmm0
mov byte [esp + 0xba], al
movdqu xmm0, xmmword [0x1000416c]
movzx eax, word [0x10004158]
mov word [esp + 0x40], ax
lea eax, [esp + 8]
movdqu xmmword [esp + 0x90], xmm0
push eax
movdqu xmm0, xmmword [0x1000417c]
push 1
push 0
movdqu xmmword [esp + 0xac], xmm0
lea eax, [esp + 0x8c]
mov dword [esp + 0x10], 0
movq xmm0, qword [0x1000418c]
movq qword [esp + 0xbc], xmm0
movdqu xmm0, xmmword [0x10004148]
push eax
push reloc.mswstr10.dll_Ordinal_2
movdqu xmmword [esp + 0x44], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003af00
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 4], eax
sete al
mov ecx, dword [esp + 0xcc]
xor ecx, esp
call fcn.10117cfd
mov esp, ebp
pop ebp
ret
Function at 0x1003b440
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push edi
xor edi, edi
mov eax, dword [ebx]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003b477
lea ecx, [esp + 0x20]
push ecx
push 1
push edi
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003b4c4
lea edi, [eax + 1]
mov eax, dword [esp + 0x20]
jmp 0x1003b47f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push esi
push ebx
push ebp
push ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebx]
cmp eax, dword [esp + 0x10]
jge 0x1003b4b2
cmp dword [esp + 0x18], 1
jne 0x1003b4b2
test esi, esi
jne 0x1003b4b2
mov byte [eax + ebp], 0
test edi, edi
je 0x1003b4c0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret 0x14
Function at 0x10047ee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor edx, edx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebp, ebp
push edi
lea eax, [ebx + 0x10]
mov ecx, ebx
mov edi, eax
sub edi, ebx
mov dword [esi], 0
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ebp
test edi, edi
je 0x10047f1c
mov edi, edi
mov eax, dword [ecx]
lea ecx, [ecx + 4]
xor dword [esi], eax
inc edx
cmp edx, edi
jb 0x10047f10
mov ebx, dword [ebx]
mov edi, dword [esp + 0x14]
or ebx, 1
mov dword [esp + 0x1c], ebx
xor ebp, ebp
mov eax, ebx
lea ecx, [ecx]
xor ebx, ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], ebx
cmp dword [esi], ebx
je 0x10047fd7
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx*4 + 0x1013a1c0]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10047f81
push 0x80400000
push 0x1000498c
lea eax, [esp + 0x28]
push eax
push ecx
push edi
call fcn.1003bbc0
test eax, eax
js 0x10047fd3
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 1
jmp 0x10047f85
mov dword [esp + 0x20], eax
push 0x10005160
push eax
push edi
call fcn.1003d250
test eax, eax
js 0x10047fbe
push 1
push 4
push esi
push dword [esp + 0x2c]
push edi
call fcn.1003ca80
test eax, eax
js 0x10047fbe
push 1
push dword [esp + 0x24]
push edi
call fcn.1003d090
test eax, eax
mov eax, 1
cmovs ebx, eax
cmp dword [esp + 0x14], 0
je 0x10047fcf
push dword [esp + 0x20]
push edi
call fcn.1003c120
test ebx, ebx
jne 0x10047ff2
mov eax, dword [esp + 0x1c]
add dword [esi], eax
inc ebp
cmp ebp, 0x7fffffff
jl 0x10047f30
pop edi
pop esi
pop ebp
mov eax, 0xffffb1bc
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x10050990
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
je 0x100509cf
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
lea edi, [edi + 1]
shr ecx, 8
shl eax, 8
movzx edx, byte [ecx + 0x10007e18]
movzx ecx, byte [edi - 1]
add ecx, eax
mov eax, edx
shl eax, 0xd
xor ecx, edx
xor eax, edx
shl eax, 2
xor eax, ecx
and eax, 0xffff
dec esi
jne 0x100509a0
pop edi
pop esi
ret 8
Function at 0x1005cf80
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x60
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push ebx
mov ebx, dword [esp + 0x68]
push ebp
mov ebp, dword [esp + 0x74]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [esi + 0xec], 0x10
mov ecx, esi
mov dword [esp + 0x10], eax
je 0x1005d006
push 0
call fcn.1005e740
mov ecx, esi
test eax, eax
je 0x1005cfd4
push 0
mov edi, 1
call fcn.100604b0
jmp 0x1005d040
push 1
call fcn.1005e740
test eax, eax
je 0x1005cfff
push 1
mov ecx, esi
xor edi, edi
call fcn.100604b0
and dword [esi + 0xec], 0xffffffef
mov ecx, ebp
push 0xee3
call fcn.10063180
jmp 0x1005d040
mov edi, 1
jmp 0x1005d040
push 1
call fcn.1005e740
test eax, eax
je 0x1005d01e
push 1
mov ecx, esi
xor edi, edi
call fcn.100604b0
jmp 0x1005d040
push 0xee4
mov ecx, ebp
mov edi, 1
call fcn.10063180
or dword [esi + 0xec], 0x10
jmp 0x1005d040
mov dword [esi + 0x64], 1
jmp 0x1005d050
push dword [esi + 0x64]
mov ecx, ebx
mov dword [esp + 0x1c], 1
call fcn.100623b0
cmp eax, 0x100
jb 0x1005d188
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x64]
push 1
cmp edi, 1
jne 0x1005d096
add eax, 0x100000ff
push eax
call fcn.1006acf0
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x64]
push edi
add eax, sym.msjet40.dll_Ordinal_60
push eax
call fcn.1006acf0
mov eax, dword [esp + 0x18]
test al, 1
jne 0x1005d0b7
cmp dword [esp + 0x1c], 0xfffffbff
je 0x1005d18c
test eax, 0xfffffffe
je 0x1005d0c7
lea ecx, [esp + 0x18]
call fcn.10062fa0
cmp dword [esi + 0x64], 0x100
jb 0x1005d105
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x10]
sub ecx, eax
add ecx, 0x1388
cmp ecx, 0x80000000
jb 0x1005d040
cmp dword [esi + 0x64], 0x100
jb 0x1005d105
push 1
push 0xfffffbdd
mov ecx, ebp
call fcn.10063120
test byte [ebp], 8
jne 0x1005d1bf
push 0x40
lea eax, [esp + 0x30]
push 0x20
push eax
call fcn.10117f50
add esp, 0xc
lea eax, [esp + 0x2c]
mov ecx, 0x10138ce8
push ebp
push 0x20
push eax
call fcn.10083630
test byte [ebp], 8
jne 0x1005d1bf
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1c]
call fcn.10116110
test eax, eax
js 0x1005d1b1
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x2c]
push ebp
push 0x40
push eax
mov eax, dword [esi + 0x64]
dec eax
shl eax, 6
push eax
call fcn.1006b450
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10117cfd
add esp, 0x60
ret 0xc
mov eax, dword [esp + 0x18]
test eax, 0xfffffffe
je 0x1005d19c
lea ecx, [esp + 0x18]
call fcn.10062fa0
inc dword [esi + 0x64]
cmp dword [esi + 0x64], 0x100
jb 0x1005d050
jmp 0x1005d0c7
push 1
push 0xfffffc15
mov ecx, ebp
call fcn.10063120
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10117cfd
add esp, 0x60
ret 0xc
Function at 0x1005e880
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
je 0x1005e9d4
mov eax, dword [esi + 0x40]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], 1
push edi
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x5c]
mov dword [esp + 0x10], eax
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.1005e510
mov ecx, dword [esp + 0x14]
test cl, 8
je 0x1005e919
nop
mov eax, edi
dec edi
test eax, eax
je 0x1005e919
lea ecx, [esp + 0x14]
call fcn.10063060
call ebp
sub ebx, eax
mov eax, dword [esp + 0x10]
add eax, ebx
cmp eax, 0x80000000
jae 0x1005e8f8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.1005e510
mov ecx, dword [esp + 0x14]
test cl, 8
jne 0x1005e8d0
pop edi
pop ebp
pop ebx
test cl, 1
jne 0x1005e9b3
mov ecx, dword [esp + 0xc]
cmp ecx, 0xfffffbae
jl 0x1005e9b3
cmp ecx, 0xfffffbaf
jle 0x1005e945
cmp ecx, 0xfffffbb2
jne 0x1005e9b3
test byte [esi + 0xec], 0x10
je 0x1005e965
mov eax, dword [esp + 0x28]
test eax, eax
push 1
cmove eax, ecx
mov ecx, dword [esp + 0x30]
push eax
call fcn.10063120
jmp 0x1005e9c1
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.1005f380
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x1005e98d
test byte [esp + 8], 1
mov edx, 0
mov ecx, dword [esp + 0xc]
cmovne ecx, edx
test eax, eax
je 0x1005e9a5
cmp eax, dword [esi + 0x64]
je 0x1005e9a5
push dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.1005fd90
jmp 0x1005e9c1
push 1
push ecx
mov ecx, dword [esp + 0x34]
call fcn.10063120
jmp 0x1005e9c1
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
call fcn.10062ed0
test dword [esp + 8], 0xfffffffe
je 0x1005e9d4
lea ecx, [esp + 8]
call fcn.10062fa0
pop esi
add esp, 0x18
ret 0x10

Function at 0x1005f2b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add eax, 0x100000
shl eax, 9
cmp edx, 0xffffffff
je 0x1005f2c7
add eax, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
jmp fcn.1005e880