joyce8/EMBER2024-capa huggingface dataset:
Function at 0x651d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x651d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x651d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x651d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x651d94
push eax
push esi
call fcn.0065420b
add esp, 8
pop esi
ret 0x10

Function at 0x651da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x651e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x651e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x66a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00653dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x651dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x651e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x651ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x651eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x66a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00653dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x651eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x651e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x652000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x652131
push esi
call fcn.00655145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00644080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x652131
push 0
push ebp
call fcn.006443a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00644260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x65208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006442f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x652121
push 0x66a918
push edi
call fcn.006533f0
push eax
push ebx
push esi
call fcn.00651f60
push 0x66a8f8
push edi
call fcn.006533f0
push eax
push ebx
push esi
call fcn.00651f60
push 0x66a8d8
push edi
call fcn.006533f0
push eax
push ebx
push esi
call fcn.00651f60
push 0x66a8c0
push edi
call fcn.006533f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00651f60
push 0x66a8a0
push edi
call fcn.006533f0
push eax
push ebx
push esi
call fcn.00651f60
push 0x66a888
push edi
call fcn.006533f0
push eax
push ebx
push esi
call fcn.00651f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6531b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00653140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00653140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00653140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00653140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x653bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x653c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x66587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x653c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x653c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001190
Capabilities:
Get disk information

Disassembly:
sub esp, 0x30
push esi
lea eax, [esp + 0x14]
mov esi, ecx
push edi
mov dword [esp + 8], eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x20]
push ecx
push 4
push edx
push eax
call sub.KERNEL32.dll_FindClose
test eax, eax
je 0x100011cc
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.1000e670
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
mov word [edx], 0x500
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
mov word [eax + 2], 0x500
mov eax, dword [esp + 0x10]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ecx, dword [esp + 0x14]
push ecx
call fcn.100188de
mov edx, dword [esp + 0x10]
add esp, 4
push edx
call sub.KERNEL32.dll_GetDriveTypeA
mov ecx, dword [esp + 8]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x30
ret 4

Function at 0x10002c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002c90
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x10002cac
cmp al, 0x40
jne 0x10002cac
mov al, 1
ret
xor al, al
ret

Function at 0x10002dc0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10019093
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.1000ef80
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x1001a6d0
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.100188d8
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x10002e27
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.10003700
jmp 0x10002e29
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x10007220
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.10007c40
push 1
push ebx
push ebx
push esi
push 0x10001620
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.10007c40
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100060e0
Capabilities:
Resume thread

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ebx, eax
cmp ebx, esi
je 0x10006246
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.WINMM.dll_mixerClose]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x1001a368]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.100188d8
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x10006216
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x10006202
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x1001a388]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.1000d670
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x100061b6
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.10006670
mov eax, dword [esp + 0x28]
push eax
call dword [0x1001a364]
push ebp
call fcn.100188de
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4

Function at 0x100063d0
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.1000f490
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x10006405
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100232b8]
xor eax, edx
inc ecx
dec esi
jne 0x100063e6
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006421
push esi
push 0x10021414
push eax
call dword [0x1001a490]
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x10006800
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x1001a1bc]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x100211cc
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x1001a14c]
lea edx, [esp + 0x14]
push edx
call dword [0x1001a118]
lea ebx, [esp + eax + 0x14]
mov eax, dword [str._nnzzzz__.___a_vx_nJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ_JJJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10005180
mov edi, str.6z
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x1001a194]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100069a1
mov esi, dword [str._nnzzzz__.___a_vx_nJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ_JJJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x1001a314]
push eax
call dword [0x1001a360]
mov edi, dword [0x1001a374]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x1001a6d8]
call fcn.10018930
test al, al
je 0x10006911
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x1000692f
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x1001a1a0]
push ebx
call dword [0x1001a144]
mov edi, 0x10021ff4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.10001ed0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret

Function at 0x100087d0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi], 0x1001a6f4
test eax, eax
je 0x100087e7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, esi
call fcn.1000e6d0
pop esi
ret
Function at 0x10008d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x10008e3d
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x10008ddb
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x10008df9
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.10007ce0
add esp, 4
push eax
push edi
call fcn.100063d0
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x10008dc6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x10008d83
jmp 0x10008df9
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x10008df9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x10008e3d
cmp eax, ecx
jb 0x10008e3d
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x10008e3f
cmp eax, esi
jb 0x10008e3f
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x10008e3f
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x10008e3d
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x10008e4a
cmp byte [esi], 0
jne 0x10008e2d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x10008e3d
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.10015390
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.10010510
push 0
push esi
mov edi, eax
call fcn.10007ce0
add esp, 4
push eax
push esi
call fcn.100063d0
and eax, 0x7fffffff
push eax
push edi
call fcn.10008d30
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x10009a00
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x490
or ecx, 0xffffffff
xor eax, eax
push esi
mov esi, dword [esp + 0x498]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10009b7e
mov ecx, 0xff
lea edi, [esp + 0x99]
mov byte [esp + 0x98], al
mov dword [esp + 0xc], 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x10021e64
push 0x80000000
call dword [0x1001a0a4]
test eax, eax
jne 0x10009b7e
lea ecx, [esp + 0xc]
lea edx, [esp + 0x98]
push ecx
push edx
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [0x1001a0a8]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea edx, [esp + 0x98]
push edx
call dword [0x1001a118]
test eax, eax
je 0x10009b7e
lea eax, [esp + 0x98]
push 0x10021e60
push eax
call dword [0x1001a37c]
add esp, 8
test eax, eax
je 0x10009b7e
push esi
push eax
call dword [0x1001a12c]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4a0]
mov dword [esp + 0x54], 0x44
test eax, eax
mov dword [esp + 0x80], 1
mov word [esp + 0x84], ax
je 0x10009b40
mov ecx, dword [0x10021e58]
mov dl, byte [0x10021e5c]
mov dword [esp + 0x20], ecx
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], dl
mov esi, dword [0x1001a14c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x10021e50
push eax
call esi
lea ecx, [esp + 0x20]
push 0x10021e48
push ecx
call esi
lea edx, [esp + 0x20]
mov dword [esp + 0x5c], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb4]
push 0
push edx
push 0
call dword [0x1001a23c]
test eax, eax
je 0x10009b7e
mov eax, dword [esp + 0x14]
mov esi, dword [0x1001a144]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
xor al, al
pop esi
add esp, 0x490
ret

Function at 0x1000a8f0
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x10021fbc
push 0x80000002
call dword [0x1001a094]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0x10021fb4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [esp + 0xc]
add esp, 0x10
ret
Function at 0x1000ad30
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x1001924b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
push ebp
push eax
xor ebp, ebp
push 0x1001dd1c
push 1
push ebp
push 0x1001ddac
mov byte [esp + 0x1b], 0
call dword [0x100231a0]
cmp eax, ebp
je 0x1000ad87
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ebp
push edx
mov ecx, dword [eax]
push 0x1001dd9c
push eax
mov dword [esp + 0x844], ebp
call dword [ecx + 0xc]
cmp eax, ebp
je 0x1000addc
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebp
je 0x1000adc4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebp
jne 0x1000aeef
push ebx
mov ebx, dword [0x1001a128]
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [0x1001a118]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x1001a7a8
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1000aec4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push 0x10022cd0
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1000aeba
mov eax, dword [esp + 0x30]
push eax
call dword [0x1001a338]
add esp, 4
test eax, eax
jbe 0x1000aeba
test esi, esi
je 0x1000aeb6
mov edx, dword [esp + 0x30]
push 0
push 0
lea ecx, [esp + 0x40]
push 0x800
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call ebx
lea eax, [esp + 0x38]
push 0x64
push eax
push esi
call dword [0x1001a388]
add esp, 0xc
push esi
call edi
push esi
lea ebp, [eax + ebp + 1]
call edi
mov ecx, dword [esp + 0x30]
lea esi, [esi + eax + 1]
push ecx
call dword [0x10023130]
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x1000ae1a
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0x840]
test eax, eax
je 0x1000aefc
mov dword [eax], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
test eax, eax
je 0x1000af15
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x82c]
mov al, byte [esp + 7]
pop ebp
mov dword fs:[0], ecx
add esp, 0x834
ret
Function at 0x1000af30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [str._nnzzzz__.___a_vx_nJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ_JJJ2srdyyxxd_8_JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x1001a12c]
lea edx, [esp + 0x10]
push 0x10021e24
push edx
call fcn.100065f0
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x1001a194]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000afed
push edi
push esi
push ebx
call dword [0x1001a190]
mov edi, eax
push edi
call dword [0x1001a368]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x1001a188]
xor eax, eax
test edi, edi
jbe 0x1000afc4
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x1000afb6
push edi
push esi
mov ecx, ebp
call fcn.1000d100
push esi
mov edi, eax
call dword [0x1001a364]
add esp, 4
push ebx
call dword [0x1001a144]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x1000b570
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x1002413c]
push ebx
push 0
push 0x80
push 4
push 0
push 3
add eax, 0xd
push 0x40000000
push eax
call dword [0x1001a194]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000b613
push 0
push ebx
mov dword [esp + 0xc], 0
call dword [0x1001a190]
cmp eax, 0x3200000
jae 0x1000b5bf
push 2
push 0
push 0
push ebx
call dword [0x1001a19c]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call dword [0x1001a118]
mov edi, eax
push edi
call fcn.100188d8
add esp, 4
mov esi, eax
test edi, edi
jle 0x1000b5f0
mov ecx, ebp
mov ebp, edi
sub ecx, esi
mov dl, byte [ecx + eax]
xor dl, 0x44
mov byte [eax], dl
inc eax
dec ebp
jne 0x1000b5e4
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [0x1001a1a0]
push ebx
call dword [0x1001a144]
push esi
call fcn.100188de
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret