joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f7fa0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x1124e94]
mov dword [esp + 0x14], 0xc9becb97
mov dword [esp + 0x18], 0xc55bc759
mov dword [esp + 0x1c], 0xc156c35b
mov dword [esp + 0x20], 0xfd6effbf
mov dword [esp + 0x24], 0xf986fb6c
mov dword [esp + 0x28], 0xf57af767
mov dword [esp + 0x2c], 0xf1a9f36b
mov word [esp + 0x30], 0xeff0
mov dword [esp + 0x32], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x21
ja 0x10f803b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.010fa300
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x22
jb 0x10f8010
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x10f805e
mov eax, 0xffffffff
jmp 0x10f8061
lea eax, [ebx + ebx]
push eax
call fcn.010dc790
add esp, 4
mov esi, eax
mov ebp, dword [0x1124e94]
mov dword [esp + 0x14], 0x69266b4f
mov dword [esp + 0x18], 0x6d0b6f19
mov dword [esp + 0x1c], 0x711e730b
mov dword [esp + 0x20], 0x75067737
mov dword [esp + 0x24], 0x793e7b04
mov dword [esp + 0x28], 0x7d0a7f1f
mov dword [esp + 0x2c], 0x81a9831b
mov word [esp + 0x30], 0x8780
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x10f80fb
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.010fa380
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x10f80d0
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x10f811b
mov eax, 0xffffffff
jmp 0x10f8122
lea eax, [eax*2 + 0x12]
push eax
call fcn.010dc790
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xf94afba8
mov dword [esp + 0x18], 0xfd5bff5f
mov dword [esp + 0x1c], 0xf155f361
mov dword [esp + 0x20], 0xf56df769
mov dword [esp + 0x24], 0xe9eaeb61
mov word [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x15
ja 0x10f819b
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.010fa400
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x16
jb 0x10f8170
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x10f81c1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10f81b0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x10f81f1
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10f81e0
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.011193d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x1120708]
Function at 0x10f8670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [0x1124e94]
mov dword [esp + 4], 0xf3b3f19d
mov dword [esp + 8], 0xff4efd4c
mov dword [esp + 0xc], 0xfb5bf9b4
mov dword [esp + 0x10], 0xc767c578
mov dword [esp + 0x14], 0xc366c1ad
mov dword [esp + 0x18], 0xcf66cd90
mov dword [esp + 0x1c], 0xcb7cc975
mov dword [esp + 0x20], 0xd77bd578
mov dword [esp + 0x24], 0xd370d162
mov dword [esp + 0x28], 0xdf6cdd75
mov dword [esp + 0x2c], 0xdb7ed974
mov dword [esp + 0x30], 0x27942574
mov dword [esp + 0x34], 0x238c2197
mov dword [esp + 0x38], 0x2f9a2d85
mov dword [esp + 0x3c], 0x2b992985
mov word [esp + 0x40], 0x3534
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x10f8746
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010fa690
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x10f8720
lea ebx, [esp + 0x48]
lea eax, [esp + 4]
push ebx
push 0
push 0
push 0x1e
push eax
push 0
call esi
mov ebp, dword [esp + 0x48]
test ebp, ebp
jns 0x10f8769
mov eax, 0xffffffff
jmp 0x10f8770
lea eax, [ebp*2]
push eax
call fcn.010dc790
add esp, 4
mov esi, eax
mov edi, dword [0x1124e94]
mov dword [esp + 4], 0xb7f789a5
mov dword [esp + 8], 0xb322b524
mov dword [esp + 0xc], 0xbfdfb1fc
mov dword [esp + 0x10], 0xbbdbbd20
mov dword [esp + 0x14], 0xa7c2b995
mov dword [esp + 0x18], 0xa3caa5d8
mov dword [esp + 0x1c], 0xaf3ca13d
mov dword [esp + 0x20], 0xabc7adc0
mov dword [esp + 0x24], 0xd7b8a936
mov dword [esp + 0x28], 0xd34cd5bd
mov dword [esp + 0x2c], 0xdfbad1bc
mov dword [esp + 0x30], 0xdb44ddac
mov dword [esp + 0x34], 0xc7acd94b
mov dword [esp + 0x38], 0xc356c5ad
mov dword [esp + 0x3c], 0xcf51c1ad
mov dword [esp + 0x40], 0xcdcc
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x10f8836
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010fa720
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x10f8810
push ebx
push ebp
push esi
push 0x1e
lea ebx, [esp + 0x14]
push ebx
push 0
call edi
mov dword [esp + 4], 0x31463f68
mov dword [esp + 8], 0x354c3347
mov dword [esp + 0xc], 0x49513750
mov dword [esp + 0x10], 0x4d284b3a
mov dword [esp + 0x14], 0x413c4f37
mov dword [esp + 0x18], 0x45424324
mov dword [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1b
ja 0x10f88b6
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010fa7a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1c
jb 0x10f8890
push 0
push 0
push ebx
push esi
push dword [esp + 0x70]
call fcn.010f2920
add esp, 0x14
jmp dword [0x1120740]
Function at 0x10fb9f0
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.010fba10
add esp, 4
test al, al
je 0x10fc170
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0x9c
xor edi, edi
mov ebx, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x1120f44]
Function at 0x10fe810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [0x1124e94]
mov dword [esp + 0x14], 0xe9adeb8f
mov dword [esp + 0x18], 0xed7eef78
mov dword [esp + 0x1c], 0xd175d3a8
mov dword [esp + 0x20], 0xd571d744
mov dword [esp + 0x24], 0xd966dbbf
mov dword [esp + 0x28], 0xdd4fdf6a
mov dword [esp + 0x2c], 0xc169c348
mov dword [esp + 0x30], 0xc561c750
mov dword [esp + 0x34], 0xc9a7cb60
mov dword [esp + 0x38], 0xcd72cfa5
mov dword [esp + 0x3c], 0x31993359
mov dword [esp + 0x40], 0x35a337a5
mov dword [esp + 0x44], 0x39ab3b9b
mov dword [esp + 0x48], 0x3d6c3faa
mov dword [esp + 0x4c], 0x21b123a4
mov dword [esp + 0x50], 0x2526278c
mov dword [esp + 0x54], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x10fe8e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.011012d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x10fe8c0
lea esi, [esp + 0x8c]
lea eax, [esp + 0x14]
push esi
push 0
push 0
push 0x1f
push eax
push 0
call edi
mov edi, dword [esp + 0x8c]
test edi, edi
jns 0x10fe90f
mov eax, 0xffffffff
jmp 0x10fe912
lea eax, [edi + edi]
push eax
call fcn.010dc790
add esp, 4
mov ebx, eax
mov ebp, dword [0x1124e94]
mov dword [esp + 0x14], 0x39f53bd7
mov dword [esp + 0x18], 0x25b627a8
mov dword [esp + 0x1c], 0x218d23e8
mov dword [esp + 0x20], 0x2d812fbc
mov dword [esp + 0x24], 0x298e2bc7
mov dword [esp + 0x28], 0x1587179a
mov dword [esp + 0x2c], 0x11b91388
mov dword [esp + 0x30], 0x1db11f80
mov dword [esp + 0x34], 0x19cf1bb0
mov dword [esp + 0x38], 0x5a207cd
mov dword [esp + 0x3c], 0x1a90399
mov dword [esp + 0x40], 0xd930f9d
mov dword [esp + 0x44], 0x99b0b9b
mov dword [esp + 0x48], 0xf524f79a
mov dword [esp + 0x4c], 0xf161f36c
mov dword [esp + 0x50], 0xfdfeff64
mov word [esp + 0x54], 0
mov byte [esp + 0x56], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x10fe9e6
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.01101360
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x10fe9c0
push esi
push edi
push ebx
push 0x1f
lea eax, [esp + 0x24]
push eax
push 0
call ebp
lea eax, [esp + 0x60]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.01119220
add esp, 0x14
not eax
shr eax, 0x1f
xor ebp, ebp
jmp dword [eax*4 + 0x112127c]
lidt [ecx]
ljmp 0x10f
Function at 0x11005f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x110064a
cmp edi, 1
je 0x110064a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x1100621
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x1100620
cmp ecx, 0x20
je 0x1100620
cmp ecx, 0x2b
mov edx, edi
je 0x1100640
cmp ecx, 0x2d
jne 0x110065f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x1100664
xor edi, edi
test eax, eax
je 0x110081d
mov dword [eax], 0x16
jmp 0x110081d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x110068d
cmp edx, 0x10
jne 0x11006a5
cmp byte [ebx], 0x30
jne 0x1100686
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x11006a7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x11006a7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x1100700
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x11007b8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x1100727
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x11007e8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x11007e8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x11006e0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x1100770
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x1100779
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x110079d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x11007cd
test bl, bl
jne 0x11007cd
mov ebx, dword [esp + 0x10]
jmp 0x11006f3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x11006d5
mov esi, edi
test bl, bl
jne 0x11007db
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x11006d5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x11007f6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x1100804
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x1100814
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x110081d
cmp byte [esp + 3], 0
jne 0x110081d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1107c60
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.010dea20
sub esp, 0x14
mov esi, esp
jmp 0x1107c75
call fcn.010dea20
push eax
mov edi, esp
jmp 0x1107c7f
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x1107c93
jmp 0x1107c95
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1107ca6
jmp 0x1107dd2
mov dword [ebp - 0x18], edi
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x1107dcc
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x1107cee
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call fcn.010dc930
add esp, 4
mov edx, eax
cmp edx, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1107d12
jmp 0x1107dbe
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [esi], 3
mov byte [esi + 1], 0x6d
mov byte [esi + 2], 0x6b
mov byte [esi + 3], 0x53
mov byte [esi + 4], 0x66
mov byte [esi + 5], 0x6a
mov byte [esi + 6], 0x67
mov byte [esi + 7], 0x55
mov byte [esi + 8], 0x6c
mov byte [esi + 9], 0x27
mov byte [esi + 0xa], 0x5e
mov byte [esi + 0xb], 0x53
mov byte [esi + 0xc], 0x58
mov byte [esi + 0xd], 0xcd
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x12
jne 0x1107d56
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jae 0x1107da0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov ebx, edx
call fcn.0110b800
mov edx, ebx
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1107d69
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.010dd590
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1107dcc
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1116720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx esi, word [edi]
mov dword [esp + 4], 0x494aadbf
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x1116776
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.01116d00
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x1116750
xor ecx, ecx
cmp dword [esp + 4], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x11234d0]
mov esi, dword [edi + 0x3c]
mov edi, dword [edi + esi]
mov dword [esp], 0x595a8094
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x11167d9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.01116d70
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x11167b0
xor ecx, ecx
cmp edi, dword [esp]
setne cl
xor eax, eax
mov edi, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x11234d8]
mov edx, dword [edi + esi + 0x78]
cmp dword [edi + esi + 0x7c], 0
sete al
test edx, edx
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
mov dword [esp + 0x14], edx
jmp dword [ecx*4 + 0x11234e0]
mov eax, dword [edi + edx + 0x20]
add eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [edi + edx + 0x24]
add eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [edi + edx + 0x1c]
add eax, edi
mov dword [esp + 0x1c], eax
mov esi, dword [0x1124e9c]
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x11234f8]
mov ecx, dword [case.0x1116781.1]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4018f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1034]
mov dword [esp + 0x38], eax
push eax
push ebx
push esi
push edi
mov esi, eax
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1034], 0
mov eax, 1
lea edx, [ebp - 0x102c]
lea ecx, [ebp - 0x1014]
call fcn.0040e9f0
call fcn.00410590
push eax
test eax, eax
jne 0x401a0d
lea eax, [ebp - 4]
push eax
call fcn.004018d0
or eax, 0x20019
push eax
push 0
mov eax, ebx
test ebx, ebx
jne 0x40195b
mov eax, 0x4563a0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
lea ebx, [ebp - 0x1008]
push 0
push 0
push ebx
push 0
mov eax, edi
test edi, edi
jne 0x40197a
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0x1008]
cmp eax, 1
je 0x4019ad
cmp eax, 2
je 0x4019ad
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x1038]
mov edx, 0
call fcn.0040a750
jmp 0x401a0d
mov dword [ebp - 0x1008], 0x1000
push ebx
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
mov eax, edi
test edi, edi
jne 0x4019ce
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push 1
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x1004]
mov cx, 0
mov edx, 0xfff
call fcn.0040b110
mov edx, dword [ebp - 0x1034]
mov eax, dword [ebp - 0x1038]
call fcn.0040a750
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
call fcn.0040ec70
lea eax, [ebp - 0x1034]
call fcn.00405a50
pop eax
test eax, eax
je 0x401a27
call fcn.0040eda0
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401a30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 8]
mov esi, eax
push 0
push edx
push 0
call fcn.004018d0
or eax, 0x2001b
push eax
push 0
push 0
push 0
mov eax, ebx
test ebx, ebx
jne 0x401a70
mov eax, 0x4563a0
push eax
mov eax, edi
push eax
call sub.advapi32.dll_RegCreateKeyExA
push 0
push 0
mov eax, esi
push eax
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x401a8e
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 2
je 0x401ab8
cmp eax, 6
je 0x401ab8
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x401abf
cmp eax, 2
je 0x401abf
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
jmp 0x401af9
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x401ac9
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401ad6
mov eax, 0x4563a0
push eax
push dword [ebp - 8]
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x401ae8
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401b00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 4]
lea eax, [ebp - 8]
mov esi, eax
push 0
push edx
push 0
call fcn.004018d0
or eax, 0x2001b
push eax
push 0
push 0
push 0
mov eax, ebx
test ebx, ebx
jne 0x401b3a
mov eax, 0x4563a0
push eax
mov eax, edi
push eax
call sub.advapi32.dll_RegCreateKeyExA
push 0
push 0
mov eax, esi
push eax
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401b58
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 2
je 0x401b82
cmp eax, 6
je 0x401b82
mov eax, dword [ebp - 8]
cmp eax, 4
je 0x401b89
cmp eax, 0xb
je 0x401b89
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
jmp 0x401bb1
mov dword [ebp - 8], 4
push 4
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401ba0
mov eax, 0x4563a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401bc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x15c]
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.0040a720
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov eax, 1
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x138]
call fcn.0040e9f0
call fcn.00410590
push eax
test eax, eax
jne 0x401cbc
push 0
push 2
call fcn.00414ac0
mov ebx, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.00414ad0
test eax, eax
je 0x401cbc
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
call fcn.0040bc60
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 4]
call fcn.0040a750
nop
cmp dword [ebp - 4], 0
je 0x401c9e
push 1
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x108]
mov cx, 0
mov edx, 0x103
call fcn.0040b110
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x15c]
call fcn.0040bc60
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 4]
call fcn.0040b5a0
test eax, eax
jle 0x401cab
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00414b80
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.00414ae0
test eax, eax
jne 0x401c58
call fcn.0040ec70
lea eax, [ebp - 0x15c]
call fcn.00405a50
lea eax, [ebp - 0x158]
call fcn.00405a50
lea eax, [ebp - 4]
call fcn.00405a50
pop eax
test eax, eax
je 0x401ce9
call fcn.0040eda0
pop esi
pop ebx
leave
ret
Function at 0x401ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0040a720
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040e9f0
call fcn.00410590
push eax
test eax, eax
jne 0x401fe1
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00415f30
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 8]
call fcn.00401bc0
mov eax, dword [ebp - 8]
test eax, eax
je 0x401f28
mov eax, dword [eax - 4]
add eax, 1
cmp eax, 1
jl 0x401fe1
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040bc60
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.0040a750
mov eax, dword [ebp - 8]
call fcn.0040da00
mov edi, eax
mov ebx, 0
cmp edi, ebx
jb 0x401fe1
sub ebx, 1
lea esi, [esi]
add ebx, 1
mov eax, dword [ebp - 8]
push dword [eax + ebx*4]
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x401fdd
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0x400
call fcn.0040b370
push 0x400
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401fa1
mov eax, 0x4563a0
push eax
push 0
push esi
call fcn.00414af0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040bc60
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0xc]
call fcn.0040a750
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b5a0
test eax, eax
jle 0x401fd7
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
cmp edi, ebx
ja 0x401f64
call fcn.0040ec70
lea eax, [ebp - 0x38]
call fcn.00405a50
mov edx, 0x44af00
lea eax, [ebp - 8]
call fcn.0040f670
lea eax, [ebp - 0xc]
call fcn.00405a50
lea eax, [ebp - 4]
call fcn.00405a50
pop eax
test eax, eax
je 0x402015
call fcn.0040eda0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4022e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x58]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov al, byte [ebp + 8]
mov byte [ebp - 0x58], al
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.00414aa0
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.00414aa0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, ebx
push eax
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, esi
push eax
mov eax, edi
push eax
call sub.kernel32.dll_CreateProcessA
or eax, eax
setne al
mov bl, al
mov al, byte [ebp - 0x58]
test al, al
je 0x402347
push 0xffffffffffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4