joyce8/EMBER2024-capa huggingface dataset:
Function at 0x564a80
Capabilities:
Encode data using xor

Disassembly:
ror dword [0xc73181d7], 0x90
js 0x5649ec
invalid
xor dword [esp + esi*2 - 0x61d6953], ebp
je 0x5649e3
xchg esi, eax
loop 0x564a32
jno 0x564a8d
aam 0x17
add byte [edi], 0x2b
sub al, 0xc0
cmp ebx, edx
add dl, byte [eax]
loopne 0x564a58
push ebp
lodsb al, byte [esi]
sub dword [esi], edx
sti
pop edi
ljmp 0xed2b
test dword [ecx + ebp + 2], eax
cmpsd dword [esi], dword es:[edi]
mov ecx, 0xcfbc460e
jmp 0x3385d3e9
jb 0x564a34
or al, 0xf2
lcall 0x8501, 0x38dfabd6
test eax, 0x89f9b228
stc
mov dword [esi + 0x2b42b3c9], edi
stc
mov dword [esi + 0x2b42b3c9], edi
sub esi, dword [edx + 0x16197f77]
mov dl, 0x77
jg 0x564aa4
push ss
jmp 0xf965cae0
dec edi
or byte [edi], 0xf9
push edx
cdq
loop 0x564a9c
adc bh, byte [eax + 0x76e488f6]
xchg esi, eax
jnp 0x564a86
enter 0xffffffffffffbbbd, 0x3c
into
lodsd eax, dword [esi]
mov al, byte [0x48edf601]
cmp esi, esi
adc dword [edi - 0x3e1ce8ed], esp
cmpsd dword [esi], dword es:[edi]
adc edx, dword [edi]
jecxz 0x564a72
cmp byte [ebx], 0xfa
mov word [edx + 0x78], es
cmc
pushfd
add cl, byte [ecx - 0x6a]
pop eax
cli
and byte [edx + 0x468972be], al
mov al, byte [esi - 0x77]
mov al, 0x47
test byte [ecx - 0x2732629e], bh
and eax, edx
inc esp
sti
or dword [ebx], eax
fild qword [edx - 0x3d6d1139]
or dword [ebp + 0x62778875], esi
push ecx
add al, 0x88
xchg ebp, eax
xor edi, dword [ebx - 0x707562a9]
and dh, byte [ecx]
and eax, eax
jnp 0x564aac
not byte [edx - 0x640036a3]
jns 0x564b5d
adc byte [ebx - 0x69574db7], ah
mov dword [esi + 0x61], edx
jl 0x564b6b
out 0xf1, al
add al, 0xfb
inc ecx
xor bl, al
pop ebp
sub ebp, edi
mov ah, 0xc5
sti
mov bl, 0xa2
rcr byte [eax], cl
mov dl, 0x78
xor dl, byte [ebx]
mov bl, 0x22
xchg esp, eax
mul esp
adc dword [edx - 0x1e8962b3], edi
sub al, byte [esi + 0x59]
cmc
and al, 0x5c
fstp qword [edx + ecx*8]
clc
add al, byte [ecx + edx*8]
dec eax
test byte [ebp + 0x5bcf6802], 0x83
movsd dword es:[edi], dword [esi]
in eax, dx
or byte [edx - 0x4a], 0x8f
pop ds
jo 0x564b7b
iretd
rep insd dword es:[edi], dx
insd dword es:[edi], dx
aad 0xac
adc eax, 0x92adc4ce
fisub word [ebx]
cmp eax, ebp
inc edi
mov esp, 0xd0c01a73
sbb dword [esp + ebx - 0x522d9ce4], 0x10
inc ecx
adc esp, dword [0xea9ed476]
mov al, byte [edx + esi*4 - 0x4535ddf4]
sbb cl, bh
xor eax, 0x95f0ad49
mov eax, dword [0xb264d5a7]
scasd eax, dword es:[edi]
sbb al, 0x63
shr byte [ebp + 0x25134110], cl
jbe 0x564b3b
sahf
ljmp 0xca22
mov dl, 0xc
and cl, dl
mov edx, 0x4935f918
lodsd eax, dword [esi]
invalid
mov dl, 0xaf
fdivr qword [0x73ba745d]
mov al, 0x88
push ecx
mov byte [eax + 0x47], ah
add edi, dword [ecx + 0x3a]
and byte [ebx], dh
loope 0x564c09
adc edx, edi
cmp esp, dword [edx - 0x1d]
dec ebx
xlatb
loopne 0x564b48
jnp 0x564c05
or ah, byte [edi - 0x2d5ee31a]
xor bl, byte [edx + 0x6b23b8e8]
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
ret
stc
jo 0x564ba7
stosb byte es:[edi], al
and bh, cl
inc ebp
iretd
Function at 0x59f0db
Capabilities:
Encode data using xor

Disassembly:
inc eax
jg 0x59f09a
imul edi, dword [ebx - 0x7d], 0xffffff92
sahf
pop esp
enter 0xffffffffffff8cd3, 0xffffffffffffff80
jbe 0x59f076
sub esp, edx
int 0x28
xadd byte [esi], dh
leave
add al, 0xa
xchg ecx, eax
sub al, 0x33
mov dl, 0xcf
ret 0xeeff
add esi, ebx
push ebp
add edx, ebp
js 0x59f05f
add ecx, esi
insb byte es:[edi], dx
jo 0x59f077
wait
jg 0x59f145
or eax, 0x95c21814
rcr byte [ebx], 1
invalid
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
pushal
push ecx
in al, 0xd6
fadd st(1)
jae 0x59f067
cdq
inc edi
push ecx
xchg ecx, eax
jg 0x59f0ba
push edi
in al, 0xff
inc ebx
sbb byte [0x75e24018], ch
push cs
in eax, dx
and byte [esi - 0x53], bl
ljmp 0x4009
mov esi, 0x285c50b1
xor edx, edi
mov ebx, dword [esi + 0x22]
push edi
xor eax, 0xeaf7c193
mov dh, 0x23
mov edi, 0xfb32be12
invalid
cmpsb byte [esi], byte es:[edi]
adc al, 0xb2
popfd

Function at 0x5f2bce
Capabilities:
Encode data using xor

Disassembly:
cdq
or ax, 0x6a5
test eax, 0x6b0d3da0
and eax, 0x89e615c8
mov eax, dword [0xbec3a89d]
xor ch, byte [ecx]
or edi, esp
ja 0x5f2bc5
idiv byte [esi + 0x68]
dec ebp
pop eax
mov dh, 0xe0
inc ebp
or cl, byte [ebx]
fstp qword [ebx + 0x1b]
dec ecx
xchg byte [ebp - 0x18ff26f5], ah
add bh, ah
xor ecx, edi
xchg cl, ah
cmp eax, 0x396ad21c
mul byte [edx + 0x60]
dec ebx
adc byte [ecx + 0x42953f8d], cl
dec ecx
pop ecx
add al, 0x32
ja 0x5f2b9b
push 0xffffffffffffff81
pop es
sub dword [esi], esp
leave
sub bh, byte [ebx]
add ah, 0x18
clc
sub dword ss:[eax], edi
add dword [esi], esp
push ebx
cmp byte [ecx], al
push ebx
jbe 0x5f2c05
jae 0x5f2bf7
stosd dword es:[edi], eax
aam 0xba
test eax, 0x7c962786
jge 0x5f2b6f
pop ecx
add al, 0x49
and eax, 0xa8a9f0b8
jne 0x5f2bdd
invalid
or dword [ecx - 0x5d], edx
pop es
call 0xb9466a8c
leave
push esi
jmp edi
insb byte es:[edi], dx
xor dword [ecx + 0x4b], esi
cmp eax, 0x2c6719dd
xchg ebp, eax
retf 0xd1c
and dword [eax], ebp
out 0x69, eax
inc edi
retf

Function at 0x5f3706
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
test dword [esi - 0x63], ebp
sub byte [eax + 0x44269928], ch
invalid
xor bh, byte [0x944197e]
out 0xaf, al
loopne 0x5f3642
add esp, ebx
lahf
xor dword [esi + 0x7c95e50], 0x15ab3712
sub al, 0xc6
invalid
cmc
sub edi, edi
and bl, byte [ecx - 0x9c93dc7]
cwde
jbe 0x5f365f
pop edi
mov dword [0xa8ad8926], eax
sub eax, 0xef582f1e
in al, dx
loop 0x5f3759
cmpsb byte [esi], byte es:[edi]
cmp al, 0x9b
invalid
ja 0x5f36c7
int3
sub dword [ebx - 0x39], 0xffffff82
call 0x897ebc9f
les ecx, [edx + 0x90390f1]
inc ecx
pop ecx
pop ss
arpl si, sp
leave
sbb al, 0x91
adc edi, edi
mov esi, 0x3e47b039
jle 0x5f36ed
std
sub byte [eax + 0x34], ch
mov dh, 0xb6
movsb byte es:[di], byte [si]
xchg edi, eax
invalid
xchg esp, eax
xchg ebx, eax
out 0x9f, al
aad 0x36
and ebx, edx
sub al, 0x5c
xor dword [ecx + 0x28], ecx
enter 0xffffffffffffc3ff, 0x6e
rcl dword [edi]
jmp 0xa65b077
Function at 0x61777b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pop ds
mov dl, ch
sub ch, ah
and eax, 0xc5197c21
add dh, ah
sar byte [edx + ecx + 0x29], cl
bound eax, qword [edi]
xor bh, al
or ah, byte [eax + 0x552c0f2]
cmpsb byte [esi], byte es:[edi]
push edi
loope fcn.0061777b
cmp eax, 0xd4ddc4fd
std
or al, 0x57
push ebp
adc eax, dword [edx]
invalid

Function at 0x62c36b
Capabilities:
Encode data using xor

Disassembly:
push ss
scasd eax, dword es:[edi]
mov edi, 0x991102e9
cld
push esi
ficomp word [eax + 0x34f116cd]
xor bh, ah
xor ah, byte [esi]
int3
jo 0x62c30b
mov cl, 0x42
inc eax
inc edi
inc edx
enter 0xffffffffffffe1dc, 0x50
fmul dword [esp + eax*8 + 0x79]
xchg dword [0x65f087d6], edi
pushfd
xchg esi, eax
sbb al, 0x66
and al, 0xbc
mov dl, 0x3f
jns 0x62c3f4
fsubr qword [esi - 0x5f634324]
mov al, 0x94
push ebx
fdivr qword [esp + ebx*4 + 0x5394b0a0]
dec eax
dec edx
jmp 0x62c3ff
push esp
xchg byte [ebx], dl
pop edi
rcl ch, 0xe9
dec ecx
aas
insb byte es:[edi], dx
mov ah, 0x3e
loopne 0x62c38f
loopne 0x62c38f
and edx, ebx
mov ebx, 0x7249ce4c
inc ebx
aam 0x7c
in eax, dx
idiv bl
dec edi
mov ebp, 0xaf2c902b
out 0xc2, al
mov al, 0xec
sbb al, 0xa2
push es
or esi, dword [0xfc3049c3]
and bh, byte [ebp + 0x12]
pop es
sbb al, 0x5f
xor cl, byte [eax + 0x2d785cb0]
js 0x62c45c
sub dword [ebx], esp
mov ecx, 0x6eda0f73
mov ds, eax
and bl, byte [esi]
jecxz 0x62c3f5
aas
adc ecx, ecx
test dword [edi], 0xc12a4f2
push ds
mov bh, 0xa6
cwde
lodsd eax, dword [esi]
dec esp
xchg ebx, eax
push ebp
lodsd eax, dword [esi]
sbb al, 0xd6
pop fs
inc eax
arpl word [esi + 0x1d], di
mov eax, 0xf14d1ede
ficomp word [esi]
dec ebp
int1
fild qword [edx + 0x6d]
loopne 0x62c42d
inc edi
outsb dx, byte [esi]
pop ebp
int1
jns 0x62c458
push 0x63
cmp dword [esp + 0x30], ecx
mov edx, 0x909d4268
mov esi, 0xd04b9a01
in eax, dx
imul ch
cmc
ljmp 0x7c63
Function at 0x480a8e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004681a7
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x480ac6
xor eax, eax
jmp 0x480af2
cmp esi, dword [ebp - 4]
je 0x480aef
cmp dword [ebp + 0xc], 0
je 0x480aef
push dword [edi + 0x9c]
call fcn.0048069c
push dword [edi + 0x9c]
mov esi, eax
call fcn.00465be2
pop ecx
pop ecx
cmp esi, eax
je 0x480ac2
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x37884ee2
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433015
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x42b377d1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100012c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10079268
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x10099060]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor eax, eax
mov edi, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x18]
mov ecx, dword [ecx]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea ebx, [esp + 0x30]
call fcn.1000b780
add esp, 0x10
cmp dword [esp + 0x38], 8
jb 0x1000131a
mov eax, dword [esp + 0x24]
push eax
call fcn.1005f31a
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret

Function at 0x10001ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007cb58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10099060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
and dword [esp + 0x14], 0xfffffe00
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], 1
call fcn.10023060
add esp, 8
test al, al
je 0x10001b79
cmp byte [esp + 0x14], 7
jne 0x10001b79
push str.value_bool
lea edx, [esp + 0x10]
push edx
mov ecx, 0x10083c7e
call fcn.1004535c
mov ecx, eax
call fcn.100457e7
test al, al
je 0x10001b79
push str.value_bool
lea eax, [esp + 0x10]
push eax
mov ecx, 0x10083c7e
call fcn.1004535c
mov esi, eax
call fcn.1004497b
mov edx, dword [esp + 0x3c]
cmp eax, 1
sete cl
lea esi, [esp + 0xc]
mov byte [edx], cl
mov dword [esp + 0x30], 0xffffffff
call fcn.10044696
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.10044696
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x100029a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100029e1
cmp dword [esp + 4], 4
jne 0x100029e1
mov eax, dword [esp + 8]
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x100029f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10002a3a
cmp dword [esp + 4], 4
jne 0x10002a3a
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret

Function at 0x10002a50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
push ebx
lea eax, [esp + 0xb]
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
push esi
mov byte [esp + 0x13], bl
call fcn.10001ab0
add esp, 8
test edi, edi
je 0x10002a74
mov eax, edi
jmp 0x10002a95
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.10001360
add esp, 8
cmp dword [eax + 0x18], 8
mov ebx, 1
jb 0x10002a92
mov eax, dword [eax + 4]
jmp 0x10002a95
add eax, 4
xor edx, edx
cmp byte [esp + 0xb], dl
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
setne dl
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x24], edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test bl, 1
je 0x10002ad5
cmp dword [esp + 0x28], 8
jb 0x10002ad5
mov edx, dword [esp + 0x14]
push edx
call fcn.1005f31a
add esp, 4
pop ebx
add esp, 0x28
ret
Function at 0x10010670
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebp
cmp eax, 0xffffffff
je 0x100106b1
and eax, 1
je 0x100106b1
push esi
call ebp
cmp eax, 0xffffffff
je 0x100106a6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100106ac
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ebx, 1
push edi
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x100106d3
cmp edi, 0xffffffff
jne 0x10010701
test ebx, ebx
je 0x100106ea
push esi
call ebp
cmp eax, 0xffffffff
je 0x100106ea
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
je 0x100106fa
test edi, edi
je 0x100106fa
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x10010e90
Capabilities:
Create thread

Disassembly:
mov eax, 0x1010
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x1009c3f8], 0
push esi
je 0x10010f29
push str._DelayFileProcess
push 0x95
push str..delayfp.cpp
push str._s._d:_s
lea eax, [esp + 0x18]
push 0x800
push eax
mov dword [0x1009c3f8], 0
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10010720
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10010f22
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push str.thread__d_created:__s
xor ecx, ecx
call fcn.10054a48
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x100c]
pop esi
xor ecx, esp
call fcn.1005ebcb
add esp, 0x1010
ret

Function at 0x100123f0
Capabilities:
Create thread

Disassembly:
push ecx
cmp byte [eax + 4], 0
je 0x100123fb
xor al, al
pop ecx
ret
push str.StartCollectLogs
mov byte [eax + 4], 1
call fcn.1003f70f
add esp, 4
push 0
push 0
push 0
push 0x10013a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
Function at 0x10013c90
Capabilities:
Create thread

Disassembly:
mov eax, 0x1010
call fcn.1006a730
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x1009c45c], 0
push esi
je 0x10013d24
push str._GlobalHookThread
push 0x66
push str..dllmain.cpp
push str._s._d:_s
lea eax, [esp + 0x18]
push 0x800
push eax
mov dword [0x1009c45c], 0
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10013b70
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10013d1d
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push str.thread__d_created:__s
call fcn.1003e42d
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x100c]
pop esi
xor ecx, esp
call fcn.1005ebcb
add esp, 0x1010
ret

Function at 0x10013d40
Capabilities:
Move file

Disassembly:
sub esp, 0x454
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [esp + 0x38], str.athens32.dll
mov dword [esp + 0x3c], str.athens64.dll
mov dword [esp + 0x40], str.athenx32.dll
mov dword [esp + 0x44], str.athenx64.dll
xor esi, esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x52]
push ecx
mov word [esp + 0x54], ax
call fcn.10062cf0
mov ebx, dword [esp + esi*4 + 0x44]
mov ecx, dword [0x1009eb38]
add esp, 0xc
lea edx, [esp + 0x48]
push edx
call fcn.1003a7d3
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10013ea1
mov edx, dword [esp + 0x30]
push 1
push 0
push 0
push edx
call fcn.1006a800
mov ecx, dword [esp + 0x34]
xor ebx, ebx
add eax, ecx
adc edx, ebx
jne 0x10013e1f
cmp eax, 0x400
jbe 0x10013ea1
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x25a]
push eax
mov word [esp + 0x25c], dx
call fcn.10062cf0
add esp, 0xc
call fcn.1003ab67
push eax
lea ecx, [esp + 0x4c]
push ecx
push str._s._08x.dirty
lea edx, [esp + 0x25c]
push 0x104
push edx
call edi
add esp, 0x14
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x4c]
push ecx
call ebp
test eax, eax
jne 0x10013e8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x4c]
push edx
push str.remove_old_module__s_failed:__d
call fcn.1003e6e9
add esp, 0xc
jmp 0x10013ea1
lea eax, [esp + 0x48]
push eax
push str.remove_old_module__s_succeeded
call fcn.1003e6e9
add esp, 8
inc esi
cmp esi, 4
jb 0x10013d86
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005ebcb
add esp, 0x454
ret
Function at 0x10014ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push 0
call fcn.10014a00
cmp eax, 0xffffffff
je 0x10014acf
cmp dword [eax*8 + 0x1009f29c], 0
je 0x10014acf
mov al, 1
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x10085294
lea esi, [esp + 0x18]
call fcn.1003c4c4
add esp, 8
cmp dword [eax + 0x18], 8
jb 0x10014af3
mov eax, dword [eax + 4]
jmp 0x10014af6
add eax, 4
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push eax
push str.Softwareprojonepodlp_volatilehookBypass_
mov esi, 4
push 0x80000002
mov dword [esp + 0x1c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10014b2f
cmp dword [esp + 8], esi
jne 0x10014b2f
mov esi, dword [esp + 0xc]
jmp 0x10014b31
xor esi, esi
cmp dword [esp + 0x28], 8
jb 0x10014b45
mov edx, dword [esp + 0x14]
push edx
call fcn.1005f31a
add esp, 4
test esi, esi
setne al
pop esi
add esp, 0x28
ret
Function at 0x10016080
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10085294
lea esi, [esp + 0xc]
call fcn.1003c4c4
mov esi, 8
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x100160ab
mov eax, dword [eax + 4]
jmp 0x100160ae
add eax, 4
push eax
push str.Softwareprojonepodlp_volatilecryptoMode_
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [esp + 0x1c], esi
pop esi
jb 0x100160d3
mov eax, dword [esp + 4]
push eax
call fcn.1005f31a
add esp, 4
add esp, 0x1c
ret
Function at 0x100188b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
push esi
call fcn.10035410
cmp dword [eax + 8], 0
je 0x10018981
push str.PersonMode
call fcn.100029f0
add esp, 4
test al, al
jne 0x10018981
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10085294
lea esi, [esp + 0x10]
call fcn.1003c4c4
mov esi, 8
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x100188ff
mov eax, dword [eax + 4]
jmp 0x10018902
add eax, 4
mov ecx, dword [0x1009ee68]
push 4
lea edx, [esp + 8]
push edx
push 4
push eax
push str.Softwareprojonepodlp_smpcacheencDragProcs_
push 0x80000002
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [esp + 0x20], esi
jb 0x10018939
mov eax, dword [esp + 0xc]
push eax
call fcn.1005f31a
add esp, 4
cmp dword [0x100a02ec], 0
jne 0x10018981
push str.DoDragDrop
push 0x10084878
mov dword [0x100a02ec], 0
call fcn.1006c930
mov dword [0x100a02e8], eax
test eax, eax
je 0x10018981
push 0x10018530
push 0x100a02e8
call fcn.1006b720
test eax, eax
jne 0x10018981
mov dword [0x100a02ec], 1
cmp dword [0x1009ee6c], 0
je 0x100189db
cmp dword [0x1009ee78], 0
jne 0x100189db
cmp dword [0x100a02f8], 0
jne 0x100189db
push str.DragQueryFileW
push 0x10085cb8
mov dword [0x100a02f8], 0
call fcn.1006c930
mov dword [0x100a02f4], eax
test eax, eax
je 0x100189db
push 0x10018580
push 0x100a02f4
call fcn.1006b720
test eax, eax
jne 0x100189db
mov dword [0x100a02f8], 1
pop esi
add esp, 0x20
ret

Function at 0x100189e0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10085294
lea esi, [esp + 0xc]
call fcn.1003c4c4
mov esi, 8
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x10018a0b
mov eax, dword [eax + 4]
jmp 0x10018a0e
add eax, 4
push eax
push str.Softwareprojonepodlp_smpcacheencDragProcs_
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [esp + 0x1c], esi
jb 0x10018a32
mov eax, dword [esp + 8]
push eax
call fcn.1005f31a
add esp, 4
xor esi, esi
cmp dword [0x100a02ec], esi
je 0x10018a4b
push 0x10018530
push 0x100a02e8
call fcn.1006c510
mov dword [0x100a02ec], esi
cmp dword [0x100a02f8], esi
je 0x10018a68
push 0x10018580
push 0x100a02f4
call fcn.1006c510
mov dword [0x100a02f8], esi
pop esi
add esp, 0x1c
ret