joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e6b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001e6d4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1001e736
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x1001e736
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1001e751
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021142
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100203a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.100204d0
add esp, 8
test al, al
je 0x100203c5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100203c5
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x100204d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x10020850
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002087b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1002087b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100646e2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x1002b450
test eax, eax
je 0x1002b450
test ebx, ebx
je 0x1002b450
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002b43f
cmp dword [ebp - 0x818], eax
je 0x1002b450
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.1003d850
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1002b43f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b421
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012840
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x1002b450
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002bc70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100647cd
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x24c], 0
push 0
push eax
call fcn.1003d850
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002bcfe
nop dword [eax]
lea eax, [ebp - 0x218]
push eax
call edi
sub esi, 1
jne 0x1002bcf0
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002bd24
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.10012840
xor eax, eax
mov dword [ebp - 4], 1
mov word [ebp - 0x248], ax
lea ecx, [ebp - 0x248]
mov eax, dword [ebp - 0x220]
add eax, 0x10
mov dword [ebp - 0x238], 0
push eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x24c], 1
call fcn.1001b2b0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
call fcn.100126b0
push 0x10
push 0x1006bc60
lea ecx, [ebp - 0x248]
call fcn.100126b0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x234]
mov esi, eax
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x1002be22
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002be18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bec0
push edx
push ecx
call fcn.10020dd1
add esp, 8
lea eax, [ebp - 0x218]
test esi, esi
je 0x1002be33
push str.ProductInfo.dat
jmp 0x1002be38
push str.utilsProductInfo.dat
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
mov ecx, ebx
call fcn.1002bed0
mov edx, dword [ebp - 0x21c]
mov bl, al
cmp edx, 8
jb 0x1002bea0
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002be96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bec5
push edx
push ecx
call fcn.10020dd1
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 4
call fcn.10040839
call fcn.10040839
int3
Function at 0x1002d180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100649ab
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
push 0
push eax
mov dword [ebp - 0x220], esi
call fcn.1003d850
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x1002d24f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001a290
test al, al
jne 0x1002d233
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002d215
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.100106c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003ae0
int3
Function at 0x1002d260
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100649e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10081100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002d3a9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002d3a9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002d3a9
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1002d3a9
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocString
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x1002d395
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1002d38e
cmp dword [ebp - 0x1c], ebx
jne 0x1002d38e
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x1002d32d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x1002d327
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x1002d339
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.10012530
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.10015ed3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x1002d38e
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100331b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065118
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10081100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1001ed80
mov edi, eax
add esp, 4
test edi, edi
je 0x1003324d
push 1
mov dword [ebp - 4], 0
call fcn.10015b33
add esp, 4
mov dword [edi + 4], eax
jmp 0x1003324f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10016705
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x100332b1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100332b1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x100332d4
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100332f7
cmp byte [ebp + 0xc], 0
je 0x100332e3
push esi
call fcn.1001610d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10033303
mov esi, str.ios_base::badbit_set
jmp 0x10033313
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.100052d0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10002eb0
push 0x1007ac48
lea eax, [ebp - 0x30]
push eax
call fcn.1003c930
int3
Function at 0x10037ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x100380b7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10038005
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100398a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100656b3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100821b8]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10039790
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10039a81
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.1003d850
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x1006ef48
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10039a81
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x10039975
cmp eax, 2
jne 0x10039a81
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x10039996
test cl, 1
jne 0x10039a81
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x1003999c
jmp 0x10039a81
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10039a81
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x10039aac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.10037a60
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x1006ef50
push eax
call fcn.10039f20
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.10037ff0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x10039a65
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10039a06
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10039ac0
push dword [0x100821c0]
lea eax, [ebp - 0x74]
push dword [0x100821bc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10039a42
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10039a5e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10039a83
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10039a81
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x10039a8e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003ae0
int3
Function at 0x10039c20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100656e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10081100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100821b8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10039790
test eax, eax
je 0x10039d48
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10039cf3
cmp dword [esi], 0
je 0x10039ce6
push 0x1006edfc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10039cb3
mov eax, 1
jmp 0x10039d14
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10039cec
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x10039d14
cmp dword [esi + 4], 0
jne 0x10039cf3
mov eax, 1
jmp 0x10039d14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10039d3e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10039d26
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x10039d4b
xor ebx, ebx
jmp 0x10039def
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x10039def
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10039da8
mov ecx, dword [ebx]
test ecx, ecx
je 0x10039e0e
push ecx
push eax
call fcn.10043389
add esp, 8
test eax, eax
je 0x10039da8
mov edx, dword [edi]
test edx, edx
je 0x10039da8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039d80
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10039db3
lea eax, [edx + 0xd]
jmp 0x10039de8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039dc0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1006ef48
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x10039dfa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003ae0
int3
Function at 0x1003b420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003b491
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1003b45f
cmp eax, 2
jne 0x1003b47b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1003b48b
test ecx, ecx
je 0x1003b486
test cl, 1
jne 0x1003b47b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1003b48b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1005a478
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005a138

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4011b5
pop dword [ebp - 0x24]
mov eax, 0xe9e1ae28
add eax, 0x165e638d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xe8466986
add dword [ebp - 0x34], 0x660bdbc5
mov dword [ebp - 0x30], 0xa7331558
sub dword [ebp - 0x30], 0x74ffc913
mov dword [ebp - 0x2c], 0x7fc13e53
add dword [ebp - 0x2c], 0xcc8b05db
mov dword [ebp - 0x28], 0x651a37b1
add dword [ebp - 0x28], 0x9ae5c84f
lea eax, [ebp - 0x34]
push eax
mov eax, 0xa62dbc7e
add eax, 0x5a1313d6
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xadac357e
sub dword [ebp - 0x34], 0x3939cc28
mov dword [ebp - 0x30], 0xf12a6aeb
add dword [ebp - 0x30], 0x5041f68a
mov dword [ebp - 0x2c], 0x66a59894
add dword [ebp - 0x2c], 0xfcc9d3d8
mov dword [ebp - 0x28], 0x482aaf2a
add dword [ebp - 0x28], 0xb7d550d6
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x397d7
push 0
call eax
mov ecx, 0x47cb
xor edx, edx
add edx, eax
mov esi, 0x47accfcf
sub esi, 0x476b1fcf
add esi, dword [ebp - 0x24]
mov ebx, 0x552e1929
sub dword [ebp - 0x1c], ecx
mov edi, dword [esi]
xor dword [ebp - 0xc], 0xf1265d82
sub edi, ebx
sub dword [ebp - 0xc], 0x602f52c5
mov dword [edx], edi
mov dword [ebp - 0x14], 0x642287bf
add edx, 0xb364b137
add edx, 0x4c9b4ecd
add esi, 0xe1078a0
sub esi, 0xe10789c
loop 0x4012c8
add eax, 0x67dc768c
add eax, 0x98249b73
mov ebx, eax
add eax, 0xe1777b77
sub eax, 0xe1777b72
mov ecx, 0x6f61f1c0
sub ecx, 0x6f21f1c0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53