joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007c2e
pop dword [ebp - 0x3c]
mov eax, 0x10007c2e
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x21c64ab6
sub dword [ebp - 0x4c], 0xd374056b
mov dword [ebp - 0x48], 0xe97ea90d
add dword [ebp - 0x48], 0x48b4a338
mov dword [ebp - 0x44], 0xe0f11641
sub dword [ebp - 0x44], 0x94a4d213
mov dword [ebp - 0x40], 0x25472428
add dword [ebp - 0x40], 0xdab8dbd8
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8698b1d5
add dword [ebp - 0x4c], 0xedd9b781
mov dword [ebp - 0x48], 0x260f92bf
add dword [ebp - 0x48], 0x1b5cceb6
mov dword [ebp - 0x44], 0x674d3ab5
sub dword [ebp - 0x44], 0x3ddce49
mov dword [ebp - 0x40], 0x2e3a5560
sub dword [ebp - 0x40], 0x2e3a5560
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xf25c31b3
sub eax, 0xe25bb163
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x386ba
push 0
call eax
mov ecx, 0xaad9f74b
add ecx, 0x552657b8
mov edx, eax
mov edi, 0x1000fa00
add edi, dword [ebp - 0x3c]
mov esi, 0x3ce0151f
add esi, 0x5b1a6a4f
add dword [ebp - 0x14], eax
mov ebx, dword [edi]
mov dword [ebp - 4], 0x749c75f1
xor ebx, esi
xor dword [ebp - 0x1c], 0x78808547
mov dword [edx], ebx
sub dword [ebp - 0x28], 0x44d638c8
add edx, 0x882e6760
sub edx, 0x882e675c
add edi, 0xaff29bc4
sub edi, 0xaff29bc0
loop 0x10007d40
add eax, 0x762398cb
sub eax, 0x762269ec
mov ebx, eax
add eax, 5
mov ecx, 0x961a0c2a
sub ecx, 0x861a0c2a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1001739
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x100a094]
push 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [0x100a500], eax
je 0x10017ad
push esi
push 0
mov esi, 0x1001318
push esi
call dword [sym.imp.CRYPT32.dll_CryptInitOIDFunctionSet]
test eax, eax
mov dword [0x100a0d4], eax
jne 0x1001782
push 0x1c28
push dword [0x100a500]
call fcn.010083a5
pop ecx
pop ecx
xor eax, eax
jmp 0x10017ac
push 0
push 0x1001304
push dword [0x100a018]
push esi
push dword [0x100a080]
push 0
call dword [sym.imp.CRYPT32.dll_CryptInstallOIDFunctionAddress]
test eax, eax
jne 0x10017a9
push 0x1c29
jmp 0x1001771
xor eax, eax
inc eax
pop esi
mov ecx, dword [esp]
add esp, 4
jmp fcn.01007f00

Function at 0x1002193
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor esi, esi
push esi
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
push esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push esi
push 7
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x10021e1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10021d3
call esi
jmp 0x100224b
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x100224b
cmp dword [ebp - 4], esi
jne 0x10021ea
xor eax, eax
jmp 0x100224b
push ebx
push esi
push esi
push dword [ebp - 4]
call fcn.01008680
mov ebx, eax
cmp ebx, esi
jne 0x1002202
mov eax, 0x8007000e
jmp 0x100224a
push esi
push esi
lea eax, [ebp - 4]
push eax
push ebx
push 7
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x100223b
push ebx
call fcn.0100835e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100222d
call esi
jmp 0x100224a
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x100224a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [ecx], eax
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x1002251
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
xor esi, esi
push esi
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
push esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push esi
push 7
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x100229f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1002291
call esi
jmp 0x1002309
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002309
cmp dword [ebp - 4], esi
jne 0x10022a8
xor eax, eax
jmp 0x1002309
push ebx
push esi
push esi
push dword [ebp - 4]
call fcn.01008680
mov ebx, eax
cmp ebx, esi
jne 0x10022c0
mov eax, 0x8007000e
jmp 0x1002308
push esi
push esi
lea eax, [ebp - 4]
push eax
push ebx
push 7
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x10022f9
push ebx
call fcn.0100835e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10022eb
call esi
jmp 0x1002308
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002308
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [ecx], eax
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x1007f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a094]
jne 0x1007f09
ret
jmp 0x1007f0e
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a094]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x100b2a8]
test eax, eax
je 0x1007f32
call eax
cmp dword [0x100b2ac], 0
je 0x1007f79
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x100b2ac]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01007f00
add ebp, 0x2a8
leave
ret
Function at 0x10084a2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
je 0x10085b0
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x10085b0
cmp dword [ebp + 8], esi
je 0x10085b0
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [edi], esi
mov dword [ebx], esi
call fcn.010087c1
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x100851c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100850a
call esi
mov esi, eax
jmp 0x1008594
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1008594
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x1008575
cmp dword [ebp - 8], esi
je 0x100854d
mov esi, 0x80004005
jmp 0x100858e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100858e
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1008575
push dword [ebp + 0xc]
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
jne 0x1008587
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100853b
call esi
mov esi, eax
jmp 0x100858e
mov ecx, dword [ebp + 0xc]
mov dword [ebx], ecx
mov dword [edi], eax
cmp dword [ebp + 8], 0
je 0x100859d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10085ac
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x10085b5
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x1004af1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1004af2b
pop dword [ebp - 0x44]
mov eax, 0xe99a59f6
sub eax, 0xd995aacb
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x724c30aa
add dword [ebp - 0x54], 0xdc0614a1
mov dword [ebp - 0x50], 0x1d53491d
add dword [ebp - 0x50], 0x14e00328
mov dword [ebp - 0x4c], 0xc183c81
sub dword [ebp - 0x4c], 0xbfcbf853
mov dword [ebp - 0x48], 0x6c349a66
sub dword [ebp - 0x48], 0x6c349a66
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x48112931
add dword [ebp - 0x54], 0x2c614025
mov dword [ebp - 0x50], 0xeec9ae06
add dword [ebp - 0x50], 0x52a2b36f
mov dword [ebp - 0x4c], 0xe3a794d7
sub dword [ebp - 0x4c], 0x8038286b
mov dword [ebp - 0x48], 0xf1bce8d1
add dword [ebp - 0x48], 0xe43172f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x215d4829
sub eax, 0x1157b7e9
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x5980f
push 0
call eax
mov ecx, 0x239a306d
add ecx, 0xdc660773
mov ebx, eax
mov edi, 0x10069400
add edi, dword [ebp - 0x44]
mov edx, 0xb80a23c5
sub edx, 0x444f60b2
sub dword [ebp - 0xc], edx
mov esi, dword [edi]
sub dword [ebp - 0x34], edi
xor esi, edx
xor dword [ebp - 0x40], eax
mov dword [ebx], esi
add dword [ebp - 0x38], edx
add ebx, 0xcbd06975
add ebx, 0x342f968f
add edi, 0x9b0ed249
sub edi, 0x9b0ed245
loop 0x1004b042
add eax, 0xa4c654d
sub eax, 0xa4b92fa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x56aa98e1
add ecx, 0xb955671f
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x44f740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x49000]
push edi
jmp 0x44f75a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44f761
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44f750
mov eax, 1
add ebx, ebx
jne 0x44f773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44f768
jne 0x44f784
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44f768
xor ecx, ecx
sub eax, 3
jb 0x44f798
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44f80a
mov ebp, eax
add ebx, ebx
jne 0x44f7a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44f7b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44f7d4
inc ecx
add ebx, ebx
jne 0x44f7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44f7b5
jne 0x44f7d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44f7b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44f7f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44f7e5
jmp 0x44f756
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44f7f4
add edi, ecx
jmp 0x44f756
pop esi
mov edi, esi
mov ecx, 0x21b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44f812
cmp byte [edi], 2
jne 0x44f812
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44f817
lea edi, [esi + 0x4d000]
mov eax, dword [edi]
or eax, eax
je 0x44f88f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52b8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52c58]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44f844
mov ecx, edi
jns 0x44f873
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52c60]
or eax, eax
je 0x44f889
mov dword [ebx], eax
add ebx, 4
jmp 0x44f861
call dword [esi + 0x52c5c]
mov ebp, dword [esi + 0x52c64]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44f8c3
sub esp, 0xffffff80
jmp 0x403e14
Function at 0x40a640
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x40a662
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a669
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a658
mov eax, 1
add ebx, ebx
jne 0x40a67b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a670
jne 0x40a68c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a670
xor ecx, ecx
sub eax, 3
jb 0x40a6a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a712
mov ebp, eax
add ebx, ebx
jne 0x40a6ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a6dc
inc ecx
add ebx, ebx
jne 0x40a6c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a6bd
jne 0x40a6d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a6bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a6fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a6ed
jmp 0x40a65e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a6fc
add edi, ecx
jmp 0x40a65e
pop esi
mov edi, esi
mov ecx, 0x91
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40a71a
cmp byte [edi], 2
jne 0x40a71a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40a71f
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a78e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa2a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a74c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa2ac]
or eax, eax
je 0x40a788
mov dword [ebx], eax
add ebx, 4
jmp 0x40a769
call dword [esi + 0xa2a8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40a7bf
cmp al, 0xef
ja 0x40a7b2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40a794
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40a7a1
mov ebp, dword [esi + 0xa2b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a7f3
sub esp, 0xffffff80
jmp 0x402eb3
Function at 0x1002872
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x2001f
push ebx
push str.Control_PanelCursorsSchemes
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002a37
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, ebx
je 0x10028f2
cmp eax, 0xea
jne 0x1002a37
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push ebx
call esi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1002a37
cmp dword [ebp - 8], ebx
je 0x1002a37
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1002a37
push edi
cmp dword [ebp - 0x24], 2
je 0x100296e
cmp dword [ebp - 0x24], 1
jne 0x10029ff
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov word [eax + edi], bx
mov dword [ebp - 0x28], ebx
mov esi, 0x1005f20
add edi, 0xfffffffe
inc edi
push 0x2c
inc edi
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01003882
lea edi, [edi + eax*2]
lea eax, [ebp - 0x254]
push eax
jmp section..htext
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0xc]
lea ecx, [ebp - 0x24]
push ecx
push ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x100295e
pop edi
cmp dword [ebp - 4], ebx
je 0x1002a45
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1002a55
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], ebx
je 0x1002a5f
push dword [ebp - 8]
call esi
pop esi
pop ebx
leave
ret
Function at 0x1003e1a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
mov esi, 0x2c8
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1003f25
push 3
pop ecx
cmp dword [ebp - 0xc], ecx
jne 0x1003f25
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
push ebx
mov eax, dword [ebp - 4]
mov edi, dword [ebp + eax*8 - 0x38]
push 0x1001e5c
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003ee9
push edi
jmp loc.0101072c
inc dword [ebp - 4]
cmp dword [ebp - 4], 6
jb 0x1003ebb
cmp dword [ebp - 8], esi
pop ebx
jae 0x1003f0d
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x48], eax
push esi
lea eax, [ebp - 0x304]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
leave
ret 8

Function at 0x1003f2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp + 8]
push eax
push 0xf003f
push 0
push 0x1001d88
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1003f9f
push ebx
xor ebx, ebx
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
inc ebx
test esi, esi
jne 0x1003f95
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.01003e1a
jmp 0x1003f57
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp esi, 2
jne 0x1003fa6
xor esi, esi
mov eax, esi
pop esi
leave
ret 4
Function at 0x4163de
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f35
mov dword [ebp - 0x14], eax
cmp dword [0x4d455c], esi
jne 0x4164d1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41645e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4165b1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4165b1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4165b1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4d455c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4d4560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4d4564], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d456c], eax
test eax, eax
je 0x4164ce
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d4568], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4164f6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4164e9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41650b
push 4
pop eax
jmp 0x4165b3
cmp dword [ebp - 0x14], esi
je 0x41650b
push dword [0x4d455c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4164f0
mov eax, dword [0x4d4568]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416569
cmp dword [0x4d456c], edi
je 0x416569
push eax
call ebx
push dword [0x4d456c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416569
test eax, eax
je 0x416569
call ecx
test eax, eax
je 0x41655e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41655e
test byte [ebp - 8], 1
jne 0x416569
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x416599
mov eax, dword [0x4d4560]
cmp eax, edi
je 0x416596
push eax
call ebx
test eax, eax
je 0x416596
call eax
mov esi, eax
test esi, esi
je 0x416596
mov eax, dword [0x4d4564]
cmp eax, edi
je 0x416596
push eax
call ebx
test eax, eax
je 0x416596
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4d455c]
call ebx
test eax, eax
je 0x4165b1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4165b3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ede
mov esp, ebp
pop ebp
ret