joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x147]
push 0
push eax
mov byte [ebp - 0x148], 0
call fcn.1005ec70
add esp, 0xc
lea eax, [ebp - 8]
push eax
xor esi, esi
push 1
push esi
lea eax, [ebp - 0x40]
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x14c], 0x104
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], esi
mov word [ebp - 0x38], 0x4d5c
mov dword [ebp - 0x25], 0x70784520
mov dword [ebp - 0x35], 0x736f7263
mov dword [ebp - 0x40], 0x54464f53
mov dword [ebp - 0x20], 0x7265726f
mov dword [ebp - 0x2f], 0x6e495c74
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x29], 0x74656e72
mov word [ebp - 0x3b], 0x5241
mov word [ebp - 0x2b], 0x6574
mov byte [ebp - 0x3c], 0x57
mov word [ebp - 0x31], 0x666f
mov byte [ebp - 0x36], 0x69
mov byte [ebp - 0x39], 0x45
mov byte [ebp - 0x21], 0x6c
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000aaf6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x11], 0x6e6f69
mov dword [ebp - 0x18], 0x56637673
mov word [ebp - 0x14], 0x7265
mov byte [ebp - 0x12], 0x73
call fcn.1000cc60
test eax, eax
je 0x1000aae7
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x158]
mov word [ebp - 0xc], 0x6556
mov word [ebp - 9], 0x6973
mov word [ebp - 6], 0x6e
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 7], 0x6f
call fcn.1000cc60
mov esi, dword [ebp - 0x158]
test esi, esi
je 0x1000aaf6
push esi
call ebx
xor esi, esi
push 0x1009268c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov edi, eax
test edi, edi
je 0x1000aba1
xor eax, eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0x148]
mov ecx, edi
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], 0
call fcn.1005e620
lea eax, [ebp - 8]
push eax
call fcn.10061a36
add esp, 0x10
inc edi
push 0x1009268c
push edi
mov dword [ebp - 0x14c], eax
mov dword [ebp - 8], 0
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x1000ab77
sub eax, edi
push eax
lea eax, [ebp - 8]
push edi
push eax
call fcn.1005e620
lea eax, [ebp - 8]
push eax
call fcn.10061a36
add esp, 0x10
xor ebx, ebx
cmp dword [ebp - 0x14c], 0xb
setl bl
test esi, esi
je 0x1000ab8e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1000aba8
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x1000abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b928
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x168], 0
mov dword [edi], 0
mov eax, dword [0x100985e8]
mov ecx, 0x100985e8
mov dword [ebp - 0x16c], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x1009255c
mov dword [ebp - 4], 1
test eax, 0xffff0000
jne 0x1000ac4e
movzx esi, ax
push 0
push esi
call fcn.10004950
add esp, 8
test eax, eax
je 0x1000ac5c
push esi
push eax
mov ecx, edi
call fcn.10004a60
jmp 0x1000ac5c
push 1
push 0x1009255c
mov ecx, edi
call fcn.10004bd0
push 0x104
lea eax, [ebp - 0x153]
push 0
push eax
mov dword [ebp - 0x168], 1
mov byte [ebp - 0x154], 0
call fcn.1005ec70
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x164], 0x104
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x158], esi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
push 1
push esi
lea eax, [ebp - 0x4c]
push eax
push reloc.WS2_32.dll_bind
mov word [ebp - 0x35], 0x6e72
mov word [ebp - 0x41], 0x7263
mov word [ebp - 0x4c], 0x4f53
mov dword [ebp - 0x49], 0x52415754
mov dword [ebp - 0x3a], 0x746e495c
mov dword [ebp - 0x32], 0x78452074
mov word [ebp - 0x44], 0x4d5c
mov dword [ebp - 0x2b], 0x726572
mov word [ebp - 0x3c], 0x7466
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x42], 0x69
mov word [ebp - 0x3f], 0x736f
mov word [ebp - 0x2e], 0x6c70
mov byte [ebp - 0x45], 0x45
mov byte [ebp - 0x4a], 0x46
mov byte [ebp - 0x3d], 0x6f
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x33], 0x65
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000adcf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x15c], esi
mov word [ebp - 0x23], 0x6376
mov dword [ebp - 0x20], 0x69737265
mov byte [ebp - 0x21], 0x56
mov byte [ebp - 0x24], 0x73
mov word [ebp - 0x1c], 0x6e6f
mov byte [ebp - 0x1a], 0
call fcn.1000cc60
test eax, eax
je 0x1000adac
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x17], 0x69737265
mov word [ebp - 0x12], 0x6e
mov byte [ebp - 0x18], 0x56
mov byte [ebp - 0x13], 0x6f
call fcn.1000cc60
mov esi, dword [ebp - 0x160]
test esi, esi
je 0x1000adc5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x15c], 0
push 0x1009268c
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x1000adfa
lea eax, [ebp - 0x154]
push eax
push 0x10092524
push edi
call fcn.100045a0
add esp, 0xc
test esi, esi
je 0x1000ae05
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x1000b860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b9d9
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x40], 0x7265746e
mov dword [ebp - 0x53], 0x5754464f
mov dword [ebp - 0x4e], 0x4d5c4552
mov word [ebp - 0x28], 0x6f63
mov byte [ebp - 0x54], 0x53
mov dword [ebp - 0x3b], 0x45207465
mov word [ebp - 0x49], 0x7263
mov word [ebp - 0x32], 0x7265
mov dword [ebp - 0x2d], 0x68637261
mov dword [ebp - 0x37], 0x6f6c7078
mov word [ebp - 0x43], 0x5c74
mov word [ebp - 0x46], 0x6f73
mov byte [ebp - 0x47], 0x6f
mov word [ebp - 0x2f], 0x6553
mov dword [ebp - 0x26], 0x736570
mov byte [ebp - 0x44], 0x66
mov byte [ebp - 0x41], 0x49
mov byte [ebp - 0x4a], 0x69
mov byte [ebp - 0x4f], 0x41
mov byte [ebp - 0x29], 0x53
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x30], 0x5c
mov byte [ebp - 0x3c], 0x6e
mov word [ebp - 0x1f], 0x6665
mov word [ebp - 0x19], 0x6353
mov word [ebp - 0x1c], 0x6c75
mov dword [ebp - 0x17], 0x65706f
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1a], 0x74
mov dword [ebp - 0x5c], 0
call fcn.10004cb0
mov dword [ebp - 4], 1
mov eax, dword [0x100985e8]
mov ecx, 0x100985e8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x20]
mov ecx, esp
mov dword [ebp - 0x64], esp
push eax
call fcn.10004cb0
push ecx
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.100048b0
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100091e0
push 1
push 0x10092530
lea ecx, [ebp - 0x5c]
call fcn.1000cd10
mov esi, dword [ebp - 0x58]
lea ecx, [ebp - 0x5c]
push dword [esi - 0xc]
push esi
call fcn.1000cd10
mov dword [ebx], 0
mov eax, dword [0x100985e8]
mov ecx, 0x100985e8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x10092610
mov dword [ebp - 0x68], 1
call fcn.10004cb0
push ecx
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov byte [ebp - 4], 4
call fcn.100048b0
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100091e0
add esi, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1000ba2b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x5c]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1000ba49
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b8c1
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [esi], 0
mov eax, dword [0x100985e8]
mov ecx, 0x100985e8
mov dword [ebp - 0x54], esi
mov word [ebp - 0x3f], 0x694d
mov dword [ebp - 0x2d], 0x70784520
mov word [ebp - 0x24], 0x4d5c
mov word [ebp - 0x36], 0x495c
mov word [ebp - 0x39], 0x666f
mov dword [ebp - 0x29], 0x65726f6c
mov dword [ebp - 0x32], 0x656e7265
mov dword [ebp - 0x44], 0x65726177
mov word [ebp - 0x3c], 0x6f72
mov word [ebp - 0x34], 0x746e
mov word [ebp - 0x21], 0x6e69
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x2e], 0x74
mov word [ebp - 0x47], 0x666f
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x3d], 0x63
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x48], 0x53
mov byte [ebp - 0x45], 0x74
mov byte [ebp - 0x40], 0x5c
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x25], 0x72
mov dword [ebp - 0x15], 0x656761
mov dword [ebp - 0x19], 0x50207472
mov word [ebp - 0x1b], 0x6174
mov byte [ebp - 0x1c], 0x53
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push esi
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], 1
call fcn.10004cb0
push ecx
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
mov dword [ebp - 4], 1
call fcn.10004cb0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.100091e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cc60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000ccdb
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x1000ccab
cmp eax, 2
jne 0x1000ccbd
mov eax, dword [ebp - 0xc]
test esi, esi
je 0x1000ccd7
test eax, eax
je 0x1000ccd4
cmp byte [esi + eax - 1], 0
je 0x1000ccd7
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000ce20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0xd], 0x642e6c6c
mov word [ebp - 0xf], 0x6474
mov word [ebp - 8], 0x6c
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 9], 0x6c
mov dword [ebp - 0x24], 0x6554744e
mov dword [ebp - 0x1b], 0x72506574
mov dword [ebp - 0x15], 0x737365
mov dword [ebp - 0x20], 0x6e696d72
mov byte [ebp - 0x1c], 0x61
mov word [ebp - 0x17], 0x636f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000cea7
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1009b634], eax
test eax, eax
je 0x1000cea7
push esi
push edi
call eax
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x1000d310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c668
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x1b], 0x6c6c64
mov dword [ebp - 0x1f], 0x2e32336c
mov dword [ebp - 0x23], 0x656e7265
mov byte [ebp - 0x24], 0x4b
mov dword [ebp - 0x2a], 0x747865
mov word [ebp - 0x2d], 0x3233
mov dword [ebp - 0x32], 0x7365636f
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2b], 0x4e
mov word [ebp - 0x34], 0x7250
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x164], ebx
test ebx, ebx
je 0x1000d3ae
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1000d3d9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000d3d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x1000d48d
push 0
push 2
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
cmp esi, 0xffffffff
je 0x1000d457
lea eax, [ebp - 0x15c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x1000d450
cmp dword [ebp - 0x154], ebx
je 0x1000d435
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 8]
call fcn.1005b84d
add esp, 8
test eax, eax
je 0x1000d446
lea eax, [ebp - 0x15c]
push eax
push esi
call edi
cmp eax, 1
je 0x1000d417
jmp 0x1000d450
mov dword [ebp - 0x160], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x164]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000d487
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x100133b0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul eax, eax, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xd
jae 0x100133d3
jmp 0x100133d8
call fcn.1005a87f
mov ecx, dword [ebp - 0x28]
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x4f
mov eax, 1
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x52
mov ecx, 1
imul ecx, ecx, 7
mov byte [ebp + ecx - 0x14], 0x45
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x14], 0x41
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x5c
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x46
mov edx, 1
imul edx, edx, 0xa
mov byte [ebp + edx - 0x14], 0x53
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x53
mov ecx, 1
imul ecx, ecx, 9
mov byte [ebp + ecx - 0x14], 0x53
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx - 0x14], 0x54
mov eax, 1
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x4f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x57
lea edx, [ebp - 0x1c]
push edx
push 0xf013f
push 0
lea eax, [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100134b2
push 0x1007d7e8
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20]
push eax
push 0xf013f
push 0
push str.SOFTWARE
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001352f
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x53
mov edx, 1
imul edx, edx, 3
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 4
jae 0x100134f1
jmp 0x100134f6
call fcn.1005a87f
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul ecx, ecx, 0
mov byte [ebp + ecx - 0x18], 0x53
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x4f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1007d7e8
lea eax, [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [ebp - 0x14]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x10014b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
imul eax, eax, 0x25
mov byte [ebp + eax - 0x30], 0x3d
mov ecx, 1
imul ecx, ecx, 0x1e
mov byte [ebp + ecx - 0x30], 0x70
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x30], 0x73
mov eax, 1
imul eax, eax, 0x11
mov byte [ebp + eax - 0x30], 0x69
mov ecx, 1
imul ecx, ecx, 0x23
mov byte [ebp + ecx - 0x30], 0x69
mov edx, 1
imul edx, edx, 0x17
mov byte [ebp + edx - 0x30], 0x6d
mov eax, 1
imul eax, eax, 0x18
mov byte [ebp + eax - 0x30], 0x2f
mov ecx, 1
imul ecx, ecx, 0x1b
mov byte [ebp + ecx - 0x30], 0x73
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx - 0x30], 0x70
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x30], 0x73
mov ecx, 1
imul ecx, ecx, 0x13
mov byte [ebp + ecx - 0x30], 0x6e
mov edx, 1
imul edx, edx, 0xc
mov byte [ebp + edx - 0x30], 0x78
mov eax, 1
imul eax, eax, 0x1c
mov byte [ebp + eax - 0x30], 0x74
mov ecx, 1
imul ecx, ecx, 0x26
mov byte [ebp + ecx - 0x30], 0x25
mov edx, 1
imul edx, edx, 0x28
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0x29
jae 0x10014c00
jmp 0x10014c05
call fcn.1005a87f
mov eax, dword [ebp - 0x38]
mov byte [ebp + eax - 0x30], 0
mov ecx, 1
imul ecx, ecx, 9
mov byte [ebp + ecx - 0x30], 0x73
mov edx, 1
imul edx, edx, 0x1a
mov byte [ebp + edx - 0x30], 0x6f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x30], 0x74
mov ecx, 1
imul ecx, ecx, 0x1d
mov byte [ebp + ecx - 0x30], 0x2e
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x30], 0x74
mov eax, 1
imul eax, eax, 0x12
mov byte [ebp + eax - 0x30], 0x6f
mov ecx, 1
imul ecx, ecx, 0x14
mov byte [ebp + ecx - 0x30], 0x2e
mov edx, 1
imul edx, edx, 0x27
mov byte [ebp + edx - 0x30], 0x73
mov eax, 1
imul eax, eax, 0x1f
mov byte [ebp + eax - 0x30], 0x68
mov ecx, 1
imul ecx, ecx, 0x16
mov byte [ebp + ecx - 0x30], 0x6f
mov edx, 1
shl edx, 5
mov byte [ebp + edx - 0x30], 0x70
mov eax, 1
imul eax, eax, 0xe
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul ecx, ecx, 0x24
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x30], 0x2f
mov eax, 1
imul eax, eax, 0x22
mov byte [ebp + eax - 0x30], 0x75
mov ecx, 1
imul ecx, ecx, 6
mov byte [ebp + ecx - 0x30], 0x2f
mov edx, 1
imul edx, edx, 0xb
mov byte [ebp + edx - 0x30], 0x65
mov eax, 1
imul eax, eax, 0x19
mov byte [ebp + eax - 0x30], 0x70
mov ecx, 1
imul ecx, ecx, 0x21
mov byte [ebp + ecx - 0x30], 0x3f
mov edx, 1
imul edx, edx, 5
mov byte [ebp + edx - 0x30], 0x3a
mov eax, 1
imul eax, eax, 0xf
mov byte [ebp + eax - 0x30], 0x6e
mov ecx, 1
imul ecx, ecx, 0xd
mov byte [ebp + ecx - 0x30], 0x74
mov edx, 1
imul edx, edx, 0xa
mov byte [ebp + edx - 0x30], 0x6f
mov eax, 1
imul eax, eax, 0x15
mov byte [ebp + eax - 0x30], 0x63
mov ecx, 1
imul ecx, ecx, 0
mov byte [ebp + ecx - 0x30], 0x68
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x30], 0x73
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.10004cb0
mov ecx, dword [ebp - 0x34]
or ecx, 1
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9a6
mov esp, ebp
pop ebp
ret
Function at 0x10014d90
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0xbc]
sub esp, 0x13c
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp + 0xb8], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x60], 0
push 0
mov eax, dword [ebp + 0xc8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x10014e04
mov ecx, dword [ebp + 0xc4]
call fcn.100051e0
mov ecx, dword [ebp - 0x50]
or ecx, 1
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0xc4]
jmp 0x10014f53
mov edx, dword [ebp - 0x5c]
push edx
call fcn.100598f8
add esp, 4
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
push 0
mov eax, dword [ebp + 0xc8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10014e64
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
push edx
call fcn.1005c5b2
add esp, 4
mov ecx, dword [ebp + 0xc4]
call fcn.100051e0
mov eax, dword [ebp - 0x50]
or eax, 1
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc4]
jmp 0x10014f53
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0x10092530
mov eax, dword [ebp - 0x54]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x10014eaf
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x6c]
push edx
call fcn.1005c5b2
add esp, 4
mov ecx, dword [ebp + 0xc4]
call fcn.100051e0
mov eax, dword [ebp - 0x50]
or eax, 1
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc4]
jmp 0x10014f53
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
push edx
call fcn.1005c5b2
add esp, 4
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x78]
push eax
push str._d._d._d._d
push 0x104
lea ecx, [ebp - 0x4c]
push ecx
call fcn.1005bf44
add esp, 0x1c
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [ebp + 0xc4]
call fcn.10005810
mov eax, dword [ebp - 0x50]
or eax, 1
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc4]
mov ecx, dword [ebp + 0xb8]
xor ecx, ebp
call fcn.1005c9a6
add ebp, 0xbc
mov esp, ebp
pop ebp
ret