joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027cb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100943a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.10027bc0
mov dword [ebp - 4], 0
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x10027d4f
push str.generatecrlogornot.txt
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.1001fff0
add esp, 4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 0x1c], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10027d47
mov ebx, dword [edx]
push edx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x100993c0]
mov ecx, ebx
call edi
mov eax, dword [ebp - 0x1c]
or edi, 0xffffffff
test eax, eax
je 0x10027d4f
mov bl, 1
jmp 0x10027d51
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x10027d79
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
Function at 0x100285e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094530
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov byte [ebp - 0x6c], dl
mov dword [ebp - 4], 1
push dword [ebp - 0x6c]
mov dword [ebp - 0x14], 0
push ecx
mov ecx, dword [ebp + 0xc]
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x6c], esp
mov dword [ebp - 0x70], esi
call fcn.1000bff0
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x70], esi
lea ecx, [ecx - 0x10]
call fcn.1000bff0
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [esi], eax
mov edx, edi
mov byte [ebp - 4], 1
call fcn.100283f0
add esp, 0xc
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x58], 0x44
movups xmmword [ebp - 0x68], xmm0
cmp dword [eax - 4], 1
jle 0x100286b5
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.10005280
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100286f7
push dword [ebp + 0x10]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
or ecx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ecx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10028727
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
or ecx, 0xffffffff
mov byte [ebp - 4], 0
mov eax, ecx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10028754
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002877f
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
Function at 0x10028990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094603
mov eax, dword fs:[0]
push eax
mov eax, 0x10008
call fcn.10056830
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x7fff
lea eax, [ebp - 0x10010]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or ebx, 0xffffffff
test eax, eax
jne 0x100289ed
mov dword [ebp - 0x10014], eax
jmp 0x10028a77
call fcn.10002ff0
mov edi, eax
test edi, edi
je 0x10028ac4
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x10014], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10010]
push dword [ebp + 8]
push 0x100ab298
push eax
lea eax, [ebp - 0x10014]
push str._s_s_s
push eax
call fcn.10022af0
mov esi, dword [ebp - 0x10014]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10014], eax
add esi, 0xfffffff0
mov byte [ebp - 4], 0
mov ecx, ebx
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10028a77
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10028aa2
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x10014]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002d90
int3

Function at 0x10028cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10028ce1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10028cd0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10028e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10028e31
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10028e20
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1002b8e0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1002bafd
cmp eax, 0x7c
je 0x1002bafd
cmp eax, 0x29
jne 0x1002b921
cmp dword [esi + 0x10], 0
jne 0x1002bafd
cmp eax, eax
jne 0x1002b921
test dword [esi + 0x50], 0x10000000
je 0x1002bb0a
jmp 0x1002bab6
cmp eax, 0x2e
jne 0x1002b932
push 5
lea ecx, [esi + 0x24]
call fcn.1002bb60
jmp 0x1002b9ae
cmp eax, 0x5c
jne 0x1002b991
mov ecx, esi
call fcn.1002b890
test byte [esi + 0x50], 0x80
je 0x1002b985
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1002b963
push 4
lea ecx, [esi + 0x24]
call fcn.1002bb60
mov ecx, esi
call fcn.1002b890
jmp 0x1002baef
cmp eax, 0x42
jne 0x1002b985
push 4
lea ecx, [esi + 0x24]
call fcn.1002bb60
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1002b890
jmp 0x1002baef
mov ecx, esi
call fcn.1002d1c0
jmp 0x1002bae8
cmp eax, 0x5b
jne 0x1002b9fe
mov ecx, esi
call fcn.1002b890
mov ecx, esi
call fcn.1002d0c0
cmp dword [esi + 0x4c], 0x5d
jne 0x1002bb18
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x1002b9f2
cmp word [eax], 0x5c
jne 0x1002b9ed
lea ecx, [eax + 2]
cmp ecx, edx
je 0x1002b9ed
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1002b9d9
movzx edi, word [ecx]
cmp edi, 0x28
je 0x1002b9eb
cmp edi, 0x29
je 0x1002b9eb
test dl, 0x10
jne 0x1002b9ed
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x1002b9eb
cmp edx, 0x7d
jne 0x1002b9ed
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.1002a610
jmp 0x1002bae8
cmp eax, 0x28
jne 0x1002ba72
mov ecx, esi
call fcn.1002b890
mov ecx, esi
call fcn.1002d370
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1002bb0a
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1002ba61
cmp word [eax], 0x5c
jne 0x1002ba5c
lea ecx, [eax + 2]
cmp ecx, edx
je 0x1002ba5c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1002ba48
movzx edi, word [ecx]
cmp edi, 0x28
je 0x1002ba5a
cmp edi, 0x29
je 0x1002ba5a
test dl, 0x10
jne 0x1002ba5c
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x1002ba5a
cmp edx, 0x7d
jne 0x1002ba5c
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.1002a610
test bl, bl
je 0x1002baef
jmp 0x1002bae8
cmp eax, 0x5e
jne 0x1002ba8a
push 2
lea ecx, [esi + 0x24]
call fcn.1002bb60
mov ecx, esi
call fcn.1002b890
jmp 0x1002baef
cmp eax, 0x24
jne 0x1002baa2
push 3
lea ecx, [esi + 0x24]
call fcn.1002bb60
mov ecx, esi
call fcn.1002b890
jmp 0x1002baef
cmp eax, 0x2a
je 0x1002bb03
cmp eax, 0x2b
je 0x1002bb03
cmp eax, 0x3f
je 0x1002bb03
cmp eax, 0x7b
je 0x1002bb03
cmp eax, 0x7d
jne 0x1002bac6
test dword [esi + 0x50], 0x10000000
je 0x1002bb11
jmp 0x1002bad4
cmp eax, 0x5d
jne 0x1002bad4
test dword [esi + 0x50], 0x10000000
je 0x1002bb18
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1002d630
mov ecx, esi
call fcn.1002b890
mov ecx, esi
call fcn.1002d480
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x1002b8f3
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.1002a600
push 5
call fcn.1002a600
push 6
call fcn.1002a600
push 4
call fcn.1002a600
int3
Function at 0x10036220
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094fee
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x114], ecx
push ecx
mov dword [ebp - 4], 0
mov edi, esp
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xff
mov dword [ebp - 0x120], edi
call fcn.10002ff0
mov ebx, eax
test ebx, ebx
je 0x10036450
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100993c0]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.CRLogProductPreferences
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10004620
test al, al
jne 0x100362bf
push 0x18
push str.CRLogProductPreferences
mov ecx, edi
call fcn.10005050
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0
call fcn.10038250
add esp, 4
test al, al
jne 0x100362f2
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jmp 0x1003641e
mov esi, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003636d
mov eax, dword [ebp - 0x118]
mov ecx, 0xff
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
mov dword [ebp - 0x118], eax
cmovl ecx, eax
cmp ecx, 0x100
jae 0x1003645a
lea eax, [ebp - 0x110]
mov byte [ebp + ecx - 0x110], 0
push eax
push 0x100ac224
push dword [ebp - 0x114]
call fcn.10022af0
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100362d5
or ebx, 0xffffffff
cmp eax, 2
jne 0x10036402
push str.0_1_100
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0
call fcn.10003460
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x114]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x100363b8
push edi
lea ecx, [ebp - 0x114]
call fcn.10005280
mov eax, dword [ebp - 0x114]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0x114]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x10036402
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x11c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10036434
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002d90
call fcn.10055b99
int3
Function at 0x100383c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009539e
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov dword [ebp - 4], 0
mov edi, esp
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0xff
mov dword [ebp - 0x11c], edi
call fcn.10002ff0
mov ebx, eax
test ebx, ebx
je 0x10038584
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100993c0]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.CRLogProductPreferences
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10004620
test al, al
jne 0x10038459
push 0x18
push str.CRLogProductPreferences
mov ecx, edi
call fcn.10005050
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0
call fcn.10038250
add esp, 4
or esi, 0xffffffff
test al, al
jne 0x10038479
xor bl, bl
jmp 0x1003853b
mov ebx, dword [ebp - 0x114]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10038532
cmp eax, 2
jne 0x10038532
push str.0_1_100
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0
call fcn.10003460
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x114]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x100384eb
push edi
lea ecx, [ebp - 0x114]
call fcn.10005280
mov eax, dword [ebp - 0x114]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x114]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x10038532
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
or esi, 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10038566
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002d90
int3
Function at 0x10038590
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092c20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100bc06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x10038607
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x100385e0
push edi
lea ecx, [ebp + 0xc]
call fcn.10005280
mov eax, dword [ebp + 0xc]
lea ecx, [edi*2 + 1]
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov ecx, dword [ebp + 8]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x10038634
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1003865f
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100953db
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x100bc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x418], ebx
call fcn.10002ff0
mov edi, eax
test edi, edi
je 0x10038806
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x414], esi
push ecx
mov dword [ebp - 4], 0
mov ecx, esp
push str.CRLog
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0x400
call fcn.100097c0
lea ecx, [ebp - 0x41c]
call fcn.10038250
add esp, 4
test al, al
jne 0x10038761
lea ecx, [ebp - 0x414]
call fcn.10005140
mov esi, dword [ebp - 0x414]
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000bff0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100387e8
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
jmp 0x100387dc
mov edi, dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push str.User_level_client_setting
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100387aa
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
push 0x100ac224
push eax
call fcn.10022af0
mov esi, dword [ebp - 0x414]
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov ecx, esi
call fcn.1000bff0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100387e8
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100993c0]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005540b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002d90
int3
Function at 0x1005831f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1007f4fa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007f1a1

Function at 0x1007f505
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007f32b
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001398
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.010016dd
add esi, 4
mov eax, dword [esi]
xor edi, edi
inc edi
test eax, eax
je 0x10013db
cmp byte [eax], 0x2d
jne 0x10013d6
jmp 0x10013c6
cmp cl, 0x6c
jne 0x10013db
mov dword [0x1002060], edi
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x10013bb
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x10013b4
cmp dword [esi], 0
jne 0x10013e4
call fcn.01001118
mov eax, edi
jmp 0x100143a
push 0x1002080
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x1001433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x271a
call fcn.010016a1
jmp 0x1001433
push 0xa
call dword [sym.imp.msvcrt.dll_putchar]
pop ecx
push dword [esi]
call fcn.01001127
test eax, eax
jne 0x1001430
push dword [esi]
push 0x2710
push edi
call fcn.01001632
add esp, 0xc
add esi, 4
cmp dword [esi], 0
jne 0x100140c
xor eax, eax
pop edi
pop esi
ret

Function at 0x10016e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x100170a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x100171f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10016f1
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10