joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44a247
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044c2e0
pop ecx
or eax, 0xffffffff
jmp 0x44a265
mov eax, ebx
and eax, 1
je 0x44a263
test byte [ebp + 0xc], 2
je 0x44a263
mov dword [0x497450], 0xd
or eax, 0xffffffff
jmp 0x44a265
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x44beb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x44bee2
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.0044bcf0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00446e60
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x44bf15
push 1
call fcn.00449f90
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.0044bcf0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x49c920], eax
mov dword [0x49c91c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44bf50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x44bf87
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x44bf73
inc eax
mov esi, eax
cmp byte [ebx], 0x3d
je 0x44bf85
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x44bf6e
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.00446e60
pop ecx
mov edi, eax
mov dword [0x49ca28], eax
test eax, eax
jne 0x44bfaa
push 1
call fcn.00449f90
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x44bfd9
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x44bfb4
inc eax
mov esi, eax
cmp byte [ebx], 0x3d
je 0x44bfd7
mov ecx, edi
mov edx, ebx
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x44bfca
pop eax
add edi, esi
add ebx, esi
cmp byte [ebx], 0
jne 0x44bfaf
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44dcc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0044de80
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x49c924]
cmp ebx, eax
jae 0x44dcfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x49c928]
test byte [edx + eax*8 + 4], 1
jne 0x44dd0d
mov dword [0x497450], 9
or eax, 0xffffffff
jmp 0x44de55
push 1
push 0
push ebx
call fcn.0044c8b0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x44dd37
push 2
push 0
push ebx
call fcn.0044c8b0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x44dd3f
or eax, 0xffffffff
jmp 0x44de55
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x44de07
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0044deb0
add esp, 8
mov dword [ebp - 0x10], eax
cmp esi, 0x1000
jl 0x44dd8f
mov dword [ebp - 0x1018], 0x1000
jmp 0x44dd95
mov dword [ebp - 0x1018], esi
mov edi, dword [ebp - 0x1018]
cmp esi, 0x1000
jl 0x44ddaf
mov dword [ebp - 0x101c], 0x1000
jmp 0x44ddb5
mov dword [ebp - 0x101c], esi
mov eax, dword [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call fcn.00449fa0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x44ddea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44dde5
mov dword [0x497450], 0xd
mov dword [ebp - 4], edi
jmp 0x44ddf8
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x44dd7b
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0044deb0
add esp, 8
jmp 0x44de43
test esi, esi
jge 0x44de43
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.0044c8b0
add esp, 0xc
push ebx
call fcn.0044c290
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x44de43
mov dword [0x497450], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.0044c8b0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404598
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x440008], 0x8088405
inc edx
mov dword [ebx + 0x440008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40e494
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40e53d
test eax, edx
je 0x40e540
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40e4bd
push edx
mov edx, eax
mov eax, esp
call fcn.00406d9c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40e4d3
push eax
lea eax, [esp + 8]
call fcn.00406d9c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40e4e2
movzx eax, word [eax]
sub eax, ecx
jmp 0x40e509
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40e523
add ecx, 4
js 0x40e4fa
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40e520
push eax
mov eax, ecx
mov edx, 2
call fcn.004063b4
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40e507
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40e509
xor eax, eax
ret
test eax, eax
je 0x40e550
test edx, edx
jne 0x40e4a4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4155fb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004066c4
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040a688
mov edi, eax
cmp edi, 0x104
jbe 0x41561e
mov eax, edi
add eax, eax
call fcn.004041b0
mov esi, eax
jmp 0x415620
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040a688
push edi
push esi
call fcn.0040a738
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415659
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415643
mov eax, esp
cmp esi, eax
je 0x415666
mov eax, esi
call fcn.004041cc
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4156a0
cmp bl, 0
je 0x41569c
cmp bl, 0x41
jl 0x415697
cmp bl, 0x5a
jg 0x415697
or bl, 0x20
xor al, bl
inc esi
jmp 0x41567b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4155e0
Function at 0x451c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x451d1c
test eax, eax
je 0x451d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x46cfe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x451d03
lea edi, [eax + 4]
jmp 0x451c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x451c7c
mov dword [ebp - 4], 2
jmp 0x451c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x451c93
mov dword [ebp - 4], 1
jmp 0x451c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x451d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x451cd6
mov byte [ecx], 0x3d
jmp 0x451ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x451ced
mov byte [ecx], 0x3d
jmp 0x451cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x451c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b477d
Capabilities:
Inspect section memory permissions

Disassembly:
pop ebp
jmp 0x4f2e41
or edx, 0x10
jmp 0x4fb1a2
test eax, 0x80000000
jmp 0x5fcc1d
jmp 0x4ef031
push ebp
rcr ebp, 0x76
xadd ax, bp
cmc
mov ebp, esp
not ax
mov eax, dword [ebp + 8]
cmp dl, 0xd5
cmc
clc
xor edx, edx
jmp 0x62632e
or edx, 1
movzx eax, si
setge al
mov eax, edx
cmovae ebp, eax
jmp 0x4501aa
ret 4
jmp 0x4ef031
test eax, 0x80000000
je 0x4ef028
or edx, 8
jmp 0x4ef031
or edx, 2
jmp 0x4a312b
je 0x633acd
or edx, 0x40
jmp 0x59c4e8
je 0x5af799
test eax, 0x40000000
jmp 0x604b4b
je 0x4fd514
test eax, 0x80000000
je 0x513c9d
or edx, 4
jmp 0x6338c1
jmp 0x4ef031
je 0x595723
or edx, 0x200
test eax, ebp
test eax, 0x20000000
jmp 0x5535b1
jmp 0x4ef031
test eax, 0x40000000
jmp 0x55552b
je 0x4839f9
or edx, 0x80
jmp 0x55b6ee
je 0x491630
test eax, 0x80000000
jmp 0x515590
test eax, 0x4000000
jmp 0x595715
jmp 0x4ef031
or edx, 0x20
jmp 0x417785
Function at 0x526c54
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x437e04]
jmp 0x4d4cce
mov byte [ebp - 0x11], 9
movzx ax, ah
mov byte [ebp - 0x10], 0x25
rdtsc
setl ah
mov byte [ebp - 0xf], 0xe
mov byte [ebp - 0xe], 0x1b
lea eax, [ebp - 0x1c]
movzx dx, ah
cwd
mov edx, 0xe
call fcn.005388c2
mov edx, dword [ebp - 0xc]
jmp 0x51d796
mov dword fs:[eax], edx
push 0x55b60e
nop
setno al
cwde
mov eax, dword [ebp - 4]
jmp 0x5ed22d
lea esp, [esp - 0x1c]
clc
cmp edi, ebx
test sp, 0x1fb4
push ebx
sub edx, edx
rcr bl, cl
mov dword [ebp - 8], edx
shr bh, cl
sal bh, cl
mov dword [ebp - 0xc], edx
mov ebx, eax
rcl dl, 0xbc
xor dl, 0xe4
xor eax, eax
mov dl, 0x55
push ebp
not dl
push 0x521464
push dword fs:[eax]
mov dword fs:[eax], esp
movsx eax, ax
mov dl, 1
mov eax, eax
jmp 0x44e758
call fcn.00439008
mov dword [ebp - 4], eax
test bp, 0x4ba9
bsf dx, dx
sal dl, cl
sub eax, eax
push ebp
push 0x4b3a99
mov edx, 0x20c03657
push dword fs:[eax]
movsx dx, bh
cmovl dx, dx
mov dword fs:[eax], esp
cdq
sets dl
mov edx, 0x80000002
mov eax, dword [ebp - 4]
jmp 0x5a81bf
call fcn.00439c68
mov edx, dword [ebp - 8]
setae ah
movzx eax, bp
cmovs ax, sp
mov eax, ebx
movzx ecx, di
bswap cx
mov ecx, 0x43c1a4
jmp 0x5858a8
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
jmp 0x512a66
push ebp
mov ebp, esp
jmp 0x4c153d
call fcn.00407048
sub eax, eax
mov cx, 0x4fc6
mov cx, si
pop edx
movsx ecx, ax
mov cx, di
pop ecx
pop ecx
jmp 0x48d1b8
call fcn.004390f0
sub ecx, ecx
mov edx, 0x43c144
bswap ax
cbw
movsx eax, sp
mov eax, dword [ebp - 4]
call fcn.00439238
lea ecx, [ebp - 0xc]
bswap dx
mov byte [ebp - 0x1c], 0xe1
xchg dx, ax
cwd
mov byte [ebp - 0x1b], 0x5c
cwd
cbw
movzx edx, bp
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0xf
rdtsc
jmp 0x641e96
mov byte [ebp - 0x13], 0x1c
cwd
cdq
mov byte [ebp - 0x12], 0x1e
jmp 0x484f49
call fcn.004051b0
ret
mov byte [ebp - 0x18], 0x1b
cmovl eax, ebx
rdtsc
bswap eax
mov byte [ebp - 0x17], 0x16
not dh
bswap ax
mov eax, 0x57705986
mov byte [ebp - 0x16], 0x29
cwd
rdtsc
mov byte [ebp - 0x15], 0x3a
cmovb dx, cx
cdq
mov byte [ebp - 0x14], 0x13
jmp 0x5d06ea
Function at 0x5ee487
Capabilities:
Parse pe header

Disassembly:
test ebx, ebx
jmp loc.0044ee75
push 4
push 0x2000
mov eax, edi
cmovs eax, ebx
mov eax, dword [ebp - 0xf8]
jmp 0x53dc85
call fcn.00545f3b
mov ebx, eax
jmp 0x586ef2
test bl, bl
je 0x488982
mov ecx, 0x40
cmp ch, ah
bsr edx, eax
mov edx, dword [ebp - 0xf8]
stc
xor eax, eax
jmp 0x49df6d
mov eax, dword [ebp - 0x14]
cdq
push edx
push eax
movsx eax, si
jmp 0x502bb8
call fcn.00406b98
sub eax, eax
cmovge cx, ax
mov cl, dh
pop edx
pop ecx
not ch
pop ecx
jmp 0x57a761
mov eax, esi
call fcn.0041767c
lea edx, [ebp - 0x148]
mov ecx, 0xf8
call fcn.00404354
cmp dword [ebp - 0x148], 0x4550
jmp 0x552fed
push ebx
shr bx, 0xef
clc
ror ebx, 0xca
push esi
sbb bx, ax
sub ebx, 0x78c58f5
push edi
jmp 0x64b51c
push eax
call fcn.0040a6e0
mov ebx, eax
test ebx, ebx
jne 0x4185b0
push 4
push 0x2000
bswap eax
mov eax, dword [ebp - 0xf8]
push eax
push 0
jmp loc.004185a1
push eax
cwde
movzx ax, bl
mov eax, dword [ebp - 0x114]
jmp 0x53b698
je 0x4a5f6f
mov eax, 0x446ea8
cmp cx, sp
clc
xor edx, edx
jmp 0x4e8980
mov dword fs:[eax], edx
jmp loc.004182db
jmp 0x4185b0
jmp loc.004182db
mov dword fs:[eax], edx
jmp 0x5d9ae9
push ebp
bt bp, 0x81
mov ebp, esp
test ch, 0xe9
cmp dl, 0x5c
lea esp, [esp - 0x148]
jmp 0x51cfa3
mov dword [ebp - 8], ecx
inc bh
mov esi, edx
sub bx, 0x1810
xchg ecx, ebx
xor ebx, 0x26184601
mov ebx, eax
sub eax, eax
mov dword [ebp - 0x10], eax
sbb ch, 0x4d
mov eax, dword [ebp - 8]
bts ecx, ecx
movzx ecx, dx
btr ecx, 0xd1
xor edx, edx
bt cx, 0x4f
bt cx, cx
shr ecx, 0x19
mov dword [eax], edx
xchg cx, cx
sub eax, eax
cmp di, cx
mov dword [ebp - 0xc], eax
rol al, cl
xor edx, edx
push ebp
push 0x5e752f
push dword fs:[edx]
lahf
cbw
mov dword fs:[edx], esp
lea edx, [ebp - 0x50]
mov eax, esi
mov ecx, 0x40
call fcn.00404354
cmp word [ebp - 0x50], 0x5a4d
je 0x4e6306
mov eax, 0x446ea8
sub edx, edx
call fcn.00406b98
xor eax, eax
xchg dh, cl
movzx cx, dh
pop edx
pop ecx
movsx ecx, bp
pop ecx
jmp 0x5e9315

Function at 0x606c08
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
jmp 0x5779ce
push 0x521be2
push dword fs:[eax]
jmp 0x66c6a9
push ebp
mov ebp, esp
xchg cx, cx
not ch
mov ecx, 0x2a
push 0
push 0
dec ecx
jmp 0x65826d
jne 0x606c15
push ecx
push ebx
clc
push esi
push edi
cmp bx, bx
sub eax, eax
cmp ebx, edi
push ebp
test di, 0x767e
push 0x5f975d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, dx
cmp cl, 0x7e
xor eax, eax
jmp 0x549205
mov dword fs:[eax], esp
jmp loc.0043ba12
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000f197
pop dword [ebp - 0x44]
mov eax, 0x1000f197
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x396a9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4958
mov esi, eax
mov edi, 0x10018600
add edi, dword [ebp - 0x44]
mov edx, 0xc0573a7c
add edx, 0x2dcf84e3
sub dword [ebp - 0x10], esi
mov ebx, dword [edi]
sub dword [ebp - 0x2c], 0x7a23834a
xor ebx, edx
sub dword [ebp - 0xc], eax
mov dword [esi], ebx
add esi, 0x55bfbed2
sub esi, 0x55bfbece
add edi, 0x5b666990
sub edi, 0x5b66698c
loop 0x1000f1e0
add eax, 0x4383bde1
add eax, 0xbc7d5a52
mov ebx, eax
add eax, 0x55107b4e
sub eax, 0x55107b49
mov ecx, 0xdc6534ee
add ecx, 0x339acb12
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10009e5f
Capabilities:
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x10043820], 0
push ebx
mov ebx, dword [esp + 0x134]
push ebp
mov ebp, dword [esp + 0x124]
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x13c]
je 0x10009fd9
and dword [esp + 0x10], 0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x10]
jne 0x10009eaa
sub ecx, edx
push 1
sar ecx, 1
lea eax, [ecx + 1]
xor edx, edx
push edx
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x24], eax
add eax, eax
push eax
push edx
push 0x78
lea ecx, [esp + 0x40]
mov dword [esp + 0x28], eax
call fcn.1000b93e
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10009f88
xor ecx, ecx
push ecx
push ecx
push dword [esp + 0x18]
push eax
push dword [esp + 0x28]
push esi
push ecx
push ecx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x138]
test esi, esi
je 0x10009fd3
cmp esi, 2
jbe 0x10009f22
cmp esi, 7
jne 0x10009fd3
test ebx, ebx
jne 0x10009f41
xor eax, eax
push eax
push edi
push esi
push dword [esp + 0x140]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x10009f8b
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov eax, ebx
shr eax, 1
push eax
push edi
push ecx
push ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push 1
xor ecx, ecx
push ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0xb4]
push eax
push ebx
push ecx
push 0x78
lea ecx, [esp + 0x34]
call fcn.1000b93e
mov ebx, dword [esp + 0x20]
test ebx, ebx
jne 0x10009f98
lea ecx, [esp + 0x1c]
call fcn.100089b8
push 0xe
pop esi
lea ecx, [esp + 0x28]
call fcn.100089b8
mov eax, esi
jmp 0x10009ff1
xor eax, eax
push eax
push eax
push dword [esp + 0x18]
push ebx
push dword [esp + 0x28]
push edi
push eax
push eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push dword [esp + 0x10]
push ebx
push esi
push dword [esp + 0x140]
push dword [esp + 0x24]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.100089b8
jmp 0x10009f8b
push ebx
jmp 0x10009f29
push ebx
push edi
push dword [esp + 0x140]
push dword [esp + 0x140]
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10029dae
add esp, 0x118
ret 0x18
Function at 0x1000a463
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x84], eax
cmp dword [0x10043820], 0
push esi
mov esi, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0x94]
je 0x1000a4ff
push ebx
mov ecx, esi
push ebp
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000a499
push 1
sub ecx, edx
push ebx
sar ecx, 1
lea eax, [esp + 0x24]
push eax
lea ebp, [ecx*2 + 2]
push ebp
push ebx
push 0x78
lea ecx, [esp + 0x28]
call fcn.1000b93e
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1000a4e1
xor eax, eax
push eax
push eax
push ebp
push ebx
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1000a4e6
push 0xe
pop esi
jmp 0x1000a4f0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
lea ecx, [esp + 0x10]
call fcn.100089b8
pop ebp
mov eax, esi
pop ebx
jmp 0x1000a507
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.10029dae
add esp, 0x88
ret 8

Function at 0x1000a520
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x88
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x84], eax
cmp dword [0x10043820], 0
push ebx
mov ebx, dword [esp + 0x98]
push esi
mov esi, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0xa4]
je 0x1000a5b5
push ebp
push 1
push 0
lea ecx, [esp + 0x24]
push ecx
lea eax, [edi + edi]
push eax
push 0
push 0x78
lea ecx, [esp + 0x28]
call fcn.1000b93e
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x1000a5a2
lea eax, [edi + edi]
push eax
push ebp
push dword [esp + 0xa8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x1000a5a7
push edi
push ebx
push 0xffffffffffffffff
push ebp
push eax
push eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000a5a7
mov esi, 0x8007000e
lea ecx, [esp + 0x10]
call fcn.100089b8
mov eax, esi
pop ebp
jmp 0x1000a5c5
push edi
push ebx
push dword [esp + 0xa4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10029dae
add esp, 0x88
ret 0x10
Function at 0x1000b115
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100436e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2a
call dword [sym.imp.user32.dll_GetSystemMetrics]
test eax, eax
je 0x1000b26b
push ebx
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b26a
push 0x1003a274
lea eax, [ebp - 0x10c]
push ebx
push eax
call dword [sym.imp.msvcr100.dll_strcat_s]
add esp, 0xc
test eax, eax
jne 0x1000b26a
mov ebx, dword [sym.imp.kernel32.dll_FreeLibrary]
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_SetErrorMode]
cmp dword [0x10043820], eax
je 0x1000b1d1
push 0x8000
call edi
push str.USER32.DLL
mov esi, eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push esi
mov dword [0x10043da4], eax
call edi
mov eax, dword [0x10043da4]
test eax, eax
je 0x1000b1d1
push str.SendIMEMessageExA
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x10043d58], eax
test eax, eax
jne 0x1000b1d1
push dword [0x10043da4]
call ebx
and dword [0x10043da4], 0
push 0x8000
call edi
mov esi, eax
push str.IMM32.DLL
lea eax, [ebp - 0x10c]
push eax
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.1000b93e
test eax, eax
je 0x1000b268
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push esi
mov dword [0x10043d5c], eax
call edi
mov ecx, dword [0x10043d5c]
test ecx, ecx
je 0x1000b268
xor esi, esi
cmp dword [0x1003a068], esi
je 0x1000b268
xor eax, eax
mov edi, 0x1003a068
push dword [eax + 0x1003a06c]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [edi]
mov dword [ecx], eax
test eax, eax
je 0x1000b259
inc esi
mov eax, esi
shl eax, 3
lea edi, [eax + 0x1003a068]
cmp dword [edi], 0
je 0x1000b268
mov ecx, dword [0x10043d5c]
jmp 0x1000b22b
push dword [0x10043d5c]
call ebx
and dword [0x10043d5c], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029dae
leave
ret
Function at 0x1000b93e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000b94d
pop dword [ebp - 0x3c]
mov eax, 0x4975dc0e
add eax, 0xc68add3f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x1fdc206d
sub dword [ebp - 0x4c], 0xd189db22
mov dword [ebp - 0x48], 0x76bbfeb2
sub dword [ebp - 0x48], 0x4488b26d
mov dword [ebp - 0x44], 0x66f14556
add dword [ebp - 0x44], 0xe55afed8
mov dword [ebp - 0x40], 0x233cf70c
add dword [ebp - 0x40], 0xdcc308f4
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x80f05008
sub eax, 0x70ecbea0
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8ca7d59e
add dword [ebp - 0x4c], 0xe7ca93b8
mov dword [ebp - 0x48], 0x19a563c
sub dword [ebp - 0x48], 0xc02df4c7
mov dword [ebp - 0x44], 0x1e12df69
sub dword [ebp - 0x44], 0xbaa372fd
mov dword [ebp - 0x40], 0xef03b0db
sub dword [ebp - 0x40], 0xef03b0db
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xbfc3094c
sub eax, 0xafbf78ec
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2bc
push 0
call eax
mov ecx, 0x2644cd88
add ecx, 0xd9bb89bd
xor ebx, ebx
add ebx, eax
mov edx, 0x9ad5c170
sub edx, 0x8ad08970
add edx, dword [ebp - 0x3c]
mov edi, 0x89a28d29
sub edi, 0x394b92c1
add dword [ebp - 0x34], esi
mov esi, dword [edx]
mov dword [ebp - 0x1c], 0x3ca6a430
xor esi, edi
add dword [ebp - 0x14], 0x9c7b6e83
mov dword [ebx], esi
xor dword [ebp - 0xc], ebx
add ebx, 0x627a0a68
add ebx, 0x9d85f59c
add edx, 0xede9fb64
sub edx, 0xede9fb60
loop 0x1000ba71
add eax, 0x4449d83
sub eax, 0x4434d9c
mov ebx, eax
add eax, 0x340a30c5
sub eax, 0x340a30c0
mov ecx, 0x94aed3e1
add ecx, 0x7b512c1f
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret