joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100281c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push esi
xor esi, esi
neg eax
sbb eax, eax
mov ecx, 0x208
and eax, 6
push ecx
inc eax
push 0x40
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1002857
xor eax, eax
jmp 0x100295e
cmp dword [ebp + 0xc], esi
je 0x1002866
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push edi
lea eax, [ebp + 0x18]
push eax
xor eax, eax
cmp dword [ebp + 0x10], esi
mov ebx, 0x20019
setne al
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x80000001
push 0x1001390
add eax, edi
push eax
call esi
test eax, eax
jne 0x10028b6
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
jne 0x10028f6
lea eax, [ebp + 0x18]
push eax
push ebx
push ecx
push 0x1001318
push edi
call esi
test eax, eax
mov edi, dword [ebp - 4]
jne 0x10028f2
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
jmp 0x10028f9
mov edi, dword [ebp - 4]
cmp word [edi], cx
jne 0x1002902
xor esi, esi
jmp 0x1002953
cmp word [edi], cx
mov esi, edi
mov eax, edi
je 0x1002950
jmp 0x1002919
xor ecx, ecx
jmp 0x1002919
cmp word [esi], 0x2c
je 0x1002924
inc esi
inc esi
cmp word [esi], cx
jne 0x1002911
cmp word [esi], 0x2c
jne 0x100292d
mov word [esi], cx
inc esi
inc esi
jmp 0x100292d
inc eax
inc eax
cmp word [eax], 0x20
je 0x100292b
push dword [ebp - 0x14]
push ecx
push dword [ebp + 0x14]
push ecx
push eax
call fcn.01002534
test eax, eax
je 0x1002948
inc dword [ebp - 8]
cmp word [esi], 0
mov eax, esi
jne 0x100290d
mov esi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret 0x14
Function at 0x10029fe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
mov edi, 0x20019
push edi
push 0
push 0x1001390
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x1002a5b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 0x10]
call ebx
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0x1001318
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1002a96
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 0x10]
call ebx
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002da9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
push 0
push 0x1001390
push 0x80000001
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x1002e08
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100163c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0x1001390
push 0x80000002
call esi
test eax, eax
jne 0x1002e47
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100163c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0x1001318
push 0x80000001
call esi
test eax, eax
jne 0x1002e86
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100163c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0x1001318
push 0x80000002
call esi
test eax, eax
jne 0x1002ec5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100163c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002ed2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1001390
mov edi, 0x80000002
push edi
mov dword [ebp - 0xc], 1
call esi
test eax, eax
jne 0x1002f33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1001664
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x1001318
push edi
call esi
test eax, eax
pop edi
pop esi
pop ebx
jne 0x1002f75
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1001664
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x1002f7f
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10070f0]
push ebx
push esi
push edi
push 0x10016d4
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x1002fcc
push 0x10016c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x1002fc5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x7020420
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov byte [ebp - 0xc], bl
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
pop eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push ebx
push ebx
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x1d4], ebx
jne 0x100302d
push 0x1001690
push ebx
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x100302d
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005225
leave
ret
Function at 0x100303f
Capabilities:
Get keyboard layout
Identify system language via api
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10070f0]
push 0x1000
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100317a
push ebx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, si
je 0x1003178
push edi
push 5
pop ecx
push 7
mov esi, 0x10017b0
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x2001f
push ebx
movsw word es:[edi], word [esi]
push ebx
push ebx
mov esi, 0x1001794
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x1001730
mov edi, 0x80000001
push edi
call esi
test eax, eax
jne 0x1003177
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 1
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48]
mov dword [ebp - 0x58], 0x31
mov dword [ebp - 0x4c], 0x33
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1001700
push edi
call esi
test eax, eax
jne 0x1003177
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
mov esi, 0x10016f0
push esi
push dword [ebp - 0x44]
mov dword [ebp - 0x50], 6
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100314c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x100316e
push 4
lea eax, [ebp - 0x58]
push eax
push 1
push ebx
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100316e
push ebx
push ebx
push ebx
push 0x5b
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
call fcn.01005225
leave
ret

Function at 0x100318c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x10070e4], esi
je 0x10031fd
lea eax, [ebp - 8]
push eax
push 1
push esi
push 0x10017e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10031f7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x10017c8
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031ee
cmp dword [ebp - 4], esi
setne al
mov dword [0x100710c], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x10070e4], esi
mov eax, dword [0x100710c]
pop esi
leave
ret
Function at 0x100320a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10032f1
push dword [ebp - 0x10]
call fcn.01004be7
test eax, eax
mov dword [ebp - 8], eax
je 0x10032e8
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_wcslen]
push edi
mov ebx, 0x1001848
push ebx
call esi
mov edi, 0x1001224
push edi
mov dword [ebp - 4], eax
call esi
push dword [ebp - 8]
add dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
add ecx, eax
add esp, 0xc
lea eax, [ecx + ecx + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10032dd
push ebx
push esi
call dword [sym.imp.ntdll.dll_wcscpy]
push edi
mov edi, dword [sym.imp.ntdll.dll_wcscat]
push esi
call edi
push dword [ebp - 8]
push esi
call edi
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
push 2
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10032d6
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x100163c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call fcn.01004564
pop edi
pop esi
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4

Function at 0x100349e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10070f0]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor edi, edi
push edi
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003534
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push str.TempPageFile
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003520
cmp dword [ebp - 0x21c], 4
jne 0x1003520
cmp dword [ebp - 0x218], 4
je 0x1003526
mov dword [ebp - 0x210], edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100353a
mov dword [ebp - 0x210], edi
cmp dword [ebp - 0x210], 1
jne 0x1003571
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x641
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
push edi
push 1
lea eax, [ebp - 0x20c]
push eax
push 0x10019a8
call fcn.0100281c
push ebx
call fcn.01002afb
call fcn.01002f7f
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01005225
leave
ret 4
Function at 0x100458b
Capabilities:
Access the windows event log
Get common file path
Query environment variable
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa80
mov eax, dword [0x10070f0]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp + 0x24]
push esi
push edi
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xa40], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
xor esi, esi
push eax
mov dword [ebp - 0xa30], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10045f4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
call edi
push 0x30c
lea eax, [ebp - 0xa2c]
push eax
push dword [ebp - 0xa44]
call edi
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.01002346
lea eax, [ebp - 0x20c]
push eax
call fcn.01002250
xor eax, eax
push 0xf
pop ecx
lea edi, [ebp - 0xa80]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xa70], eax
mov ax, word [ebp - 0xa2c]
neg ax
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 0xa80], 0x3c
mov dword [ebp - 0xa7c], 0x800640
mov dword [ebp - 0xa68], ebx
sbb eax, eax
and eax, ecx
cmp dword [ebp + 0x18], esi
mov dword [ebp - 0xa6c], eax
je 0x1004691
mov dword [ebp - 0xa64], esi
jmp 0x10046a2
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 6
inc eax
mov dword [ebp - 0xa64], eax
lea eax, [ebp - 0xa80]
push eax
call dword [ebp - 0xa38]
mov dword [ebp - 0xa38], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xa30], esi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0xa34], eax
je 0x10046f0
push dword [ebp - 0xa30]
push 0x100122c
call edi
push dword [ebp - 0xa30]
call ebx
mov dword [ebp - 0xa30], esi
cmp dword [ebp - 0xa38], esi
je 0x1004730
cmp dword [ebp + 0x14], esi
mov dword [ebp - 0xa34], esi
je 0x1004722
push 0xffffffffffffffff
push dword [ebp - 0xa48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.010023c5
push 0x1001428
push 0x10013fc
call edi
push dword [ebp - 0xa48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004797
cmp dword [ebp - 0xa40], esi
je 0x1004797
mov eax, dword [ebp - 0xa70]
push esi
push 1
mov dword [ebp - 0xa3c], eax
lea eax, [ebp - 0xa38]
push eax
push esi
push dword [ebp - 0xa34]
mov dword [ebp - 0xa38], esi
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push esi
lea eax, [ebp - 0xa3c]
push eax
push esi
push 2
push esi
push 0x3e8
push esi
push 1
push dword [ebp - 0xa40]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [ebp - 0xa38], esi
je 0x1004797
push dword [ebp - 0xa38]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa34]
pop edi
pop esi
pop ebx
call fcn.01005225
leave
ret 0x24
Function at 0x1005387
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10020fc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10053df
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1002138
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10053d2
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10053e1
xor eax, eax
pop esi
leave
ret 4
Function at 0x10054ad
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1002140
call fcn.010056b0
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10054ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10054ea
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005502
cmp eax, 0x20b
je 0x10054ef
mov dword [ebp - 0x1c], ebx
jmp 0x1005516
cmp dword [ecx + 0x84], 0xe
jbe 0x10054ea
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1005510
cmp dword [ecx + 0x74], 0xe
jbe 0x10054ea
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1007140], 0xffffffff
or dword [0x1007144], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1007134]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007130]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1007148], eax
call fcn.010056a6
cmp dword [0x10070f4], ebx
jne 0x1005571
push fcn.010056a6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100568f
push 0x1007010
push 0x100700c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100712c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1007128]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1007008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1005607
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10055db
cmp al, 0x22
jne 0x10055cd
cmp byte [esi], 0x22
jne 0x10055e4
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10055ee
cmp al, 0x20
jbe 0x10055e0
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1005612
movzx eax, word [ebp - 0x50]
jmp 0x1005615
cmp byte [esi], 0x20
jbe 0x10055e4
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1005607
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1005632
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005667
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010056eb
ret
Function at 0x561c90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x118000]
push edi
or ebp, 0xffffffff
jmp 0x561cb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x561cb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x561ca8
mov eax, 1
add ebx, ebx
jne 0x561ccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x561cdc
jne 0x561cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x561cfb
dec eax
add ebx, ebx
jne 0x561ce8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x561cc0
add ebx, ebx
jne 0x561cf7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x561d4d
xor ecx, ecx
sub eax, 3
jb 0x561d13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x561d82
sar eax, 1
mov ebp, eax
jmp 0x561d1e
add ebx, ebx
jne 0x561d1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x561cec
inc ecx
add ebx, ebx
jne 0x561d2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x561cec
add ebx, ebx
jne 0x561d39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x561d2e
jne 0x561d4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x561d2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x561d6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x561d5e
jmp 0x561cae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x561d6c
add edi, ecx
jmp 0x561cae
pop esi
mov edi, esi
mov ecx, 0x2550
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x561d8a
cmp byte [edi], 0x13
jne 0x561d8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x561d8f
lea edi, [esi + 0x15d000]
mov eax, dword [edi]
or eax, eax
je 0x561e07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x166ff0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x167130]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x561dbc
mov ecx, edi
jns 0x561deb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x167134]
or eax, eax
je 0x561e01
mov dword [ebx], eax
add ebx, 4
jmp 0x561dd9
call dword [esi + 0x167138]
popal
jmp 0x415fd2