joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043ca3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7711
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100cfa9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov ebx, dword [ebp + 8]
mov edx, ebx
or dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [eax], edi
mov dword [eax + 4], edi
cmp dword [ebx + 0x14], 8
jb 0x10043cec
mov edx, dword [ebx]
sub esp, 0x18
lea ecx, [ebp - 0x40]
call fcn.10088e7a
mov esi, eax
test esi, esi
jns 0x10043d4c
call fcn.1007b17a
mov ecx, dword [eax]
cmp dword [ecx], 2
jbe 0x10043d36
cmp dword [ebx + 0x14], 8
jb 0x10043d11
mov ebx, dword [ebx]
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x10013670
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
push eax
push ecx
push ecx
mov edx, 0x1002b271
call fcn.1002fbbf
cmp dword [ebp - 0x40], 0xffffffff
je 0x10043d45
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x10043de8
mov esi, dword [ebp - 0x40]
xor eax, eax
push 9
pop ecx
mov dword [ebp - 0x38], edi
lea edi, [ebp - 0x34]
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
jne 0x10043dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
call fcn.1007b17a
mov ecx, dword [eax]
cmp dword [ecx], 2
jbe 0x10043dbc
cmp dword [ebx + 0x14], 8
jb 0x10043d97
mov ebx, dword [ebx]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x10013670
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], edi
push eax
push ecx
push ecx
mov edx, 0x1002b271
call fcn.1002fbbf
cmp esi, 0xffffffff
je 0x10043dc8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x10043de8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [edx], eax
mov dword [edx + 4], ecx
cmp esi, 0xffffffff
je 0x10043de6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6b85
leave
ret 8

Function at 0x1004a5a5
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x1004a5c8
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x1004a5b6
mov eax, ecx
pop esi
leave
ret 4
Function at 0x1004a95c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100cfa9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 4]
push 0x100d08fc
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [0x100d0954]
xor edi, edi
test esi, esi
je 0x1004a9a5
cmp dword [esi], ebx
jne 0x1004a995
cmp dword [esi + 4], edi
je 0x1004a9a1
cmp dword [esi + 8], edi
jne 0x1004a9a1
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x1004a98c
test esi, esi
jne 0x1004a9ed
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1004ab69
mov eax, ebx
mov dword [esi + 8], edi
mov dword [esi], eax
mov eax, edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xea61
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], eax
mov eax, dword [0x100d0954]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], eax
mov dword [0x100d0954], esi
inc dword [esi + 0x10]
inc dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0xc]
cmp eax, 0xea60
jbe 0x1004ab69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], edi
push eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x114], edi
push eax
push ecx
call fcn.1004a8ce
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x1004aa61
mov edx, 0x10000000
cmp ebx, edx
jb 0x1004aa61
mov eax, dword [ebp - 0x114]
lea ecx, [eax + 0x10000000]
cmp ecx, edx
jbe 0x1004aa61
cmp ebx, ecx
ja 0x1004aa61
sub ebx, edx
jmp 0x1004aa63
mov ebx, edi
mov ecx, 0x100cd160
call fcn.10030bcb
cmp dword [0x100cd160], 5
jbe 0x1004ab2f
push 0x4000
push edi
mov ecx, 0x100cd160
call fcn.1002e73d
test al, al
je 0x1004ab2f
mov ecx, dword [ebp - 0x11c]
mov edx, 0x100157e0
mov eax, dword [esi + 0x14]
test ecx, ecx
mov dword [ebp - 0x120], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x110]
cmove eax, edx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x11c], eax
mov edx, 0x1002c65e
xor eax, eax
mov dword [ebp - 0x12c], 6
test ecx, ecx
cmovne eax, dword [ebp - 0x114]
mov dword [ebp - 0x114], eax
xor eax, eax
test ecx, ecx
cmovne eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push ecx
push ecx
call fcn.10030aa1
mov ecx, 0x100cd160
call fcn.10030c53
cmp dword [esi + 0x14], 1
mov dword [esi + 0x10], edi
jne 0x1004ab69
mov esi, 0x100cd138
mov ecx, esi
call fcn.10030bcb
cmp dword [0x100cd138], 0
jbe 0x1004ab62
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.10030c53
push 0x100d08fc
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a6b85
leave
ret
Function at 0x100585e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0x14
mov eax, 0x100b9c7e
call fcn.100a7c57
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x50], ebx
je 0x1005866c
mov edx, 0x811c9dc5
mov ecx, ebx
movzx eax, byte [ebp + ecx + 0x14]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1005860f
push edx
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0x48]
call fcn.10059fcb
mov ecx, dword [ebp + 0x4c]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [ebp + 0x4c]
je 0x1005866c
mov esi, dword [ecx + 0xc]
mov edi, dword [ecx + 0x10]
jmp 0x10058664
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call fcn.10057f0c
test al, al
jne 0x1005866a
add esi, 0x58
cmp esi, edi
jne 0x1005864b
jmp 0x1005866c
mov bl, 1
lea ecx, [ebp + 0x18]
call fcn.10056427
mov al, bl
call fcn.100a7c25
ret 0x60

Function at 0x1005bcff
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x1005be5b
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x1005be5b
cmp ecx, 0x29
jne 0x1005bd3f
cmp dword [esi + 0x10], 0
jne 0x1005be5b
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x1005be5f
jmp 0x1005be19
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x1005bd5d
push 5
lea ecx, [esi + 0x24]
call fcn.1005bf29
mov ecx, esi
call fcn.1005bcd6
jmp 0x1005be49
cmp ecx, 0x5c
jne 0x1005bdb3
mov ecx, esi
call fcn.1005bcd6
test byte [edi], 0x80
je 0x1005bda7
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x1005bd8f
push 4
lea ecx, [esi + 0x24]
call fcn.1005bf29
mov ecx, esi
call fcn.1005bcd6
jmp 0x1005be50
cmp ecx, 0x42
jne 0x1005bda7
push 4
lea ecx, [esi + 0x24]
call fcn.1005bf29
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x1005bd83
mov ecx, esi
call fcn.1005cacb
jmp 0x1005be49
cmp ecx, 0x5b
jne 0x1005bdd3
mov ecx, esi
call fcn.1005bcd6
mov ecx, esi
call fcn.1005ca7f
cmp dword [esi + 0x4c], 0x5d
je 0x1005bd51
push 4
jmp 0x1005be61
cmp ecx, 0x28
jne 0x1005bdf0
mov ecx, esi
call fcn.1005bcd6
mov ecx, esi
call fcn.1005cba3
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1005be5f
jmp 0x1005be3e
cmp ecx, 0x5e
jne 0x1005bdf9
push 2
jmp 0x1005bd7b
cmp ecx, 0x24
jne 0x1005be05
push 3
jmp 0x1005bd7b
cmp ecx, 0x2a
je 0x1005be57
cmp ecx, 0x2b
je 0x1005be57
cmp ecx, 0x3f
je 0x1005be57
cmp ecx, 0x7b
je 0x1005be57
cmp ecx, 0x7d
jne 0x1005be26
test dword [edi], edx
jne 0x1005be2f
push 6
jmp 0x1005be61
cmp ecx, 0x5d
jne 0x1005be2f
test dword [edi], edx
je 0x1005bdcc
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1005cd0e
mov bl, 1
mov ecx, esi
call fcn.1005bcd6
test bl, bl
je 0x1005be50
mov ecx, esi
call fcn.1005cc28
mov al, 1
jmp 0x1005bd06
push 0xa
jmp 0x1005be61
pop edi
pop esi
pop ebx
ret
push 5
call fcn.1005b275
int3
Function at 0x1006914c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0x1e0
mov eax, 0x100bc520
call fcn.100a7c8a
mov edi, ecx
mov ecx, dword [ebp + 0x14]
lea esi, [edi + 0x160]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x1dc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x1e0], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x1e4], ecx
mov ecx, esi
push eax
call fcn.1006a797
cmp eax, dword [esi]
je 0x1006925e
add eax, 0x28
lea ecx, [ebp - 0x1d4]
push eax
call fcn.1006337e
xor ecx, ecx
mov edx, 0x811c9dc5
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + ecx + 0xc]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x100691b6
push edx
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x140]
call fcn.10059fcb
mov edx, dword [ebp - 0x13c]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [ebp - 0x13c]
je 0x10069253
lea eax, [ebp - 0x18c]
mov ecx, ebx
push eax
call fcn.10047939
mov ecx, dword [ebp - 0x1d8]
mov eax, dword [edi + 0x80]
mov dword [ecx], eax
lea eax, [ebp - 0x15c]
mov ecx, dword [ebp - 0x1dc]
push eax
call fcn.10047939
mov ecx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x174]
push eax
call fcn.10047939
mov ecx, dword [ebp - 0x1e4]
mov al, byte [ebp - 0x144]
mov byte [ecx], al
lea ecx, [ebp - 0x1d4]
call fcn.1004a2be
mov al, 1
jmp 0x10069260
lea ecx, [ebp - 0x1d4]
call fcn.1004a2be
xor al, al
call fcn.100a7c39
ret 0x1c
Function at 0x10079be3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x100cfa9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 0x47c], edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10079c0c
sub esi, ecx
sar esi, 1
jne 0x10079c27
mov eax, 0x800700a1
jmp 0x10079da8
push 0x5c
pop edx
mov eax, edi
mov ecx, 0x104
cmp word [edi + esi*2 - 2], dx
je 0x10079c70
lea eax, [esi + 1]
cmp eax, ecx
jae 0x10079d8e
push edi
push ecx
lea eax, [ebp - 0x270]
push eax
call fcn.1009b9fe
push 0x10011c0c
lea eax, [ebp - 0x270]
push 0x104
push eax
call fcn.1009b98f
add esp, 0x18
lea eax, [ebp - 0x270]
push 0x32
lea ecx, [ebp - 0x68]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x10079d2a
lea eax, [esi + 0xf]
mov ecx, 0x104
cmp eax, ecx
jae 0x10079d8e
push str._GlobalRoot
push ecx
lea eax, [ebp - 0x270]
push eax
call fcn.1009b9fe
push edi
lea eax, [ebp - 0x270]
push 0x104
push eax
call fcn.1009b98f
add esp, 0x18
push 0x5c
pop eax
cmp word [edi + esi*2 - 2], ax
je 0x10079cdf
push 0x10011c0c
lea eax, [ebp - 0x270]
push 0x104
push eax
call fcn.1009b98f
add esp, 0xc
push 0x32
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x10079d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1126
je 0x10079d23
cmp eax, 1
je 0x10079d23
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x10079da8
mov eax, 0x8007007b
jmp 0x10079da8
lea eax, [ebp - 0x47c]
mov esi, 0x104
push eax
push esi
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x10079d08
lea ecx, [ebp - 0x478]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10079d57
sub ecx, edx
sar ecx, 1
je 0x10079d8a
push 0x5c
pop eax
cmp word [ebp + ecx*2 - 0x47a], ax
jne 0x10079d8a
dec ecx
lea eax, [ecx + ecx]
cmp eax, 0x208
jae 0x10079db9
xor edx, edx
mov word [ebp + eax - 0x478], dx
cmp ecx, esi
jb 0x10079d95
mov eax, 0x8007007a
jmp 0x10079da8
lea eax, [ebp - 0x478]
push eax
push esi
push ebx
call fcn.1009b9fe
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a6b85
leave
ret 0xc
call fcn.100a6cb9
int3
Function at 0x1007b52a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cfa9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], esi
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x1007b553
mov eax, dword [edi]
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x1007b579
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x1007b5d0
push ecx
lea eax, [ebx - 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007b632
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 8
jb 0x1007b599
mov edi, dword [edi]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1007b5bd
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x1007b5c8
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.1004b887
lea ecx, [ebp - 0x1c]
call fcn.10037030
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a6b85
leave
ret

Function at 0x1007b7a4
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x100be803
call fcn.100a7c57
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
cmp dword [esi + 0x10], ebx
push 0x10020dd8
sete al
push eax
push 0x80070057
push 0x10020e18
push 0x1d
push dword [ebp + 4]
call fcn.1004a8a5
add esp, 0x18
mov dword [ebp - 0x10], ebx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1007b7ef
mov eax, dword [esi]
push ebx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 1
push dword [esi + 0x10]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push 0x10020e60
push eax
push 0x10020e18
push 0x28
push dword [ebp + 4]
call fcn.10074329
add esp, 0x10
mov ecx, edi
push dword [ebp - 0x10]
call fcn.10073053
xor edx, edx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
inc edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x1007b838
mov esi, dword [esi]
push ebx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push dword [edi]
push edx
push eax
push esi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push 0x10020ec8
push eax
push 0x10020e18
push 0x33
push dword [ebp + 4]
call fcn.10074329
add esp, 0x14
mov eax, edi
call fcn.100a7c25
ret
Function at 0x1007d4b8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x100beb7e
call fcn.100a7c57
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.100731bf
cmp dword [esi + 0x14], 8
jb 0x1007d4e0
mov esi, dword [esi]
push eax
push 0x20119
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10021ea0
push eax
mov esi, 0x10021ee0
push esi
push 0x1c
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
mov dword [ebp - 0x14], ebx
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [ebp - 0x18], ebx
jb 0x1007d51c
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x10021ec0
push eax
push esi
push 0x21
push dword [ebp + 4]
call fcn.1007bf50
mov esi, dword [ebp + 8]
add esp, 0x14
mov ecx, esi
push dword [ebp - 0x14]
call fcn.10077b64
cmp dword [edi + 0x14], 8
jb 0x1007d559
mov edi, dword [edi]
lea eax, [ebp - 0x14]
push eax
push dword [esi]
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x10021ec0
push eax
push 0x10021ee0
push 0x25
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
cmp dword [ebp - 0x10], 0
je 0x1007d595
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100a7c25
ret 4

Function at 0x1007d59d
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x100beba8
call fcn.100a7c57
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.100731bf
cmp dword [edi + 0x14], 8
jb 0x1007d5c5
mov edi, dword [edi]
push eax
push 0x20106
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10021ea0
push eax
mov edi, 0x10021ee0
push edi
push 0x33
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
cmp dword [esi + 0x14], 8
jb 0x1007d5f9
mov esi, dword [esi]
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10021f58
push eax
push edi
push 0x36
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
cmp dword [ebp - 0x10], 0
je 0x1007d62f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100a7c25
ret 4
Function at 0x1007d637
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x100bebd2
call fcn.100a7c57
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.100731bf
cmp dword [0x100d12b4], 8
mov ecx, 0x100d12a0
push eax
cmovae ecx, dword [0x100d12a0]
push 0x20119
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10021ea0
push eax
mov edi, 0x10021ee0
push edi
push 0x44
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
mov dword [ebp - 0x14], ebx
cmp dword [0x100d1344], 8
lea ecx, [ebp - 0x1c]
mov eax, 0x100d1330
mov dword [ebp - 0x18], ebx
cmovae eax, dword [0x100d1330]
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x10021ec0
push eax
push edi
push 0x4a
push dword [ebp + 4]
call fcn.1007bf50
add esp, 0x14
cmp dword [ebp - 0x14], 4
jne 0x1007d6ed
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x1007d71b
call fcn.1007b17a
mov ecx, dword [eax]
cmp dword [ecx], 2
jbe 0x1007d71b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x10021f20
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x80004005
push eax
push ecx
push ecx
mov edx, 0x1002c504
call fcn.1002fc78
cmp dword [ebp - 0x10], 0
je 0x1007d72a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100a7c25
ret 4
Function at 0x100801bb
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push 0x10
mov eax, 0x100befe6
call fcn.100a7c57
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
push 0xf0000000
push 0x18
push esi
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
push 0x100221c8
setne al
movzx eax, al
push eax
push 0x100220b0
push 0xd5
push dword [ebp + 4]
call fcn.10077c34
mov edi, dword [ebp - 0x10]
add esp, 0x14
test edi, edi
je 0x10080230
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
mov edi, 0x100220b0
push 0x100221ac
setne al
movzx eax, al
push eax
push edi
push 0xdf
push dword [ebp + 4]
call fcn.10077c34
mov eax, dword [ebp + 8]
add esp, 0x14
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
sub eax, ecx
push eax
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
push 0x1002220c
setne al
movzx eax, al
push eax
push edi
push 0xe7
push dword [ebp + 4]
call fcn.10077c34
mov edi, dword [ebp - 0x14]
add esp, 0x14
test edi, edi
je 0x100802bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push ecx
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 0x18]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
push 0x100221f0
setne al
movzx eax, al
push eax
push 0x100220b0
push 0xef
push dword [ebp + 4]
call fcn.10077c34
mov eax, dword [ebp + 0xc]
add esp, 0x14
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
push esi
push dword [ebp - 0x14]
sub eax, ecx
push eax
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0x14], 0
je 0x10080332
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x10], 0
je 0x10080341
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x18], 0
je 0x10080351
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
call fcn.100a7c25
ret 0xc

Function at 0x1008269f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10082605
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x100827c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10081f5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10081f11
add esp, 0xc
mov dword [ebp - 0x68c], eax
invalid
xchg ebp, eax
je 0x10082803