joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408620
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x40867d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x408640
mov eax, dword [esi]
jmp 0x40875b
cmp eax, 0x4e0
jb 0x40875b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x408696
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x4086e1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4087ca
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4087f1
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4087f4
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004087a6
pop esi
leave
ret 8

Function at 0x40962e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40966d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40966d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40966d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40966d
cmp dword [ecx + 0x74], 0xe
jbe 0x40966d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x418d07
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004129c6
and dword [ebp - 4], 0
cmp dword [0x44fcb4], 0
mov ebx, eax
jne 0x418db8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418e69
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418e69
push eax
call fcn.00412954
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fcb4], eax
call esi
push eax
call fcn.00412954
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fcb8], eax
call esi
push eax
call fcn.00412954
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fcbc], eax
call esi
push eax
call fcn.00412954
pop ecx
mov dword [0x44fcc4], eax
test eax, eax
je 0x418db8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412954
pop ecx
mov dword [0x44fcc0], eax
mov eax, dword [0x44fcc0]
cmp eax, ebx
je 0x418e10
cmp dword [0x44fcc4], ebx
je 0x418e10
push eax
call fcn.004129cf
push dword [0x44fcc4]
mov esi, eax
call fcn.004129cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x418e10
test edi, edi
je 0x418e10
call esi
test eax, eax
je 0x418e07
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418e07
test byte [ebp - 0xc], 1
jne 0x418e10
or dword [ebp + 0x10], 0x200000
jmp 0x418e49
mov eax, dword [0x44fcb8]
cmp eax, ebx
je 0x418e49
push eax
call fcn.004129cf
pop ecx
test eax, eax
je 0x418e49
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418e49
mov eax, dword [0x44fcbc]
cmp eax, ebx
je 0x418e49
push eax
call fcn.004129cf
pop ecx
test eax, eax
je 0x418e49
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fcb4]
call fcn.004129cf
pop ecx
test eax, eax
je 0x418e69
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418e6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0xcdb2f4c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x53b6ba9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x24d926fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x28]
mov edi, eax
push 5
movzx eax, word [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [esp + 0x14]
mov edi, eax
push ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
movsx eax, word [edi + 0x16]
mov dword [ebx + 8], eax
push 0
movsx eax, word [edi + 0x18]
push 0x24d924c6
mov dword [ebx + 0xc], eax
push dword [esi + 0xd0]
push edi
push dword [0x24d9fc6c]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x24d93d12
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x180]
mov ebp, 0x158
xor ebx, ebx
push 0xffffffffffffffff
push ebp
push dword [esi + 0xf4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call edi
cmp eax, 0xffffffff
je 0x24d93e94
push ebx
push eax
push 0x14e
push dword [esi + 0xf4]
call edi
mov ebx, eax
test ebx, ebx
jl 0x24d93d88
push 1
push dword [esi + 0x180]
call fcn.24d994d9
pop ecx
mov dword [esp + 0x1c], eax
pop ecx
push eax
mov ecx, esi
call fcn.24d936a4
push dword [esp + 0x18]
mov dword [esp + 0x14], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [esp + 0x10], 0
je 0x24d93da4
push dword [esp + 0x10]
mov ecx, esi
call fcn.24d93e9e
mov ebx, eax
test ebx, ebx
jl 0x24d93e94
mov eax, dword [esi + 0x184]
test eax, eax
je 0x24d93e94
push eax
push 0xffffffffffffffff
push ebp
push dword [esi + 0xfc]
call edi
push 0
push eax
push 0x14e
mov dword [esp + 0x24], eax
push dword [esi + 0xfc]
call edi
push 0
mov ebx, eax
push dword [esp + 0x1c]
push 0x150
push dword [esi + 0xfc]
call edi
cmp ebx, 0xffffffff
je 0x24d93e56
cmp eax, 0xffffffff
je 0x24d93e56
test eax, eax
je 0x24d93e56
mov ecx, dword [eax + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x1a0], ecx
cmp dword [eax + 0xc], 0
je 0x24d93e3a
lea ebx, [esi + 0x108]
push 1
push dword [ebx]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x19c]
push 0xf1
push dword [ebx]
call edi
mov ebx, eax
jmp 0x24d93e56
push 0
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0x14], 0
je 0x24d93e6e
push dword [esp + 0x14]
mov ecx, esi
call fcn.24d9400f
mov ebx, eax
test ebx, ebx
jl 0x24d93e94
mov eax, dword [esi + 0x188]
test eax, eax
je 0x24d93e94
push eax
add esi, 0x104
push 0xffffffffffffffff
push ebp
push dword [esi]
call edi
push 0
push eax
push 0x14e
push dword [esi]
call edi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x24d96ff9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20019
push ebx
push 0x24d9fa2c
push ebx
mov esi, SysReAllocStringLen
push str.CLSIDAC0714F6_3D04_11d1_AE7D_00A0C90F26F4Implemented_Categories4EB304D0_7555_11cf_A0C2_00AA0062BE57
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x24d970b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 0x25
push str.Microsoft_Add_In_Authouring_Designer
push 1
push str.CLSIDAC0714F7_3D04_11d1_AE7D_00A0C90F26F4
push esi
call edi
cmp eax, ebx
jne 0x24d970b9
push 0x27
push str.AC0714F7_3D04_11d1_AE7D_00A0C90F26F4
push 1
push str.CLSIDAC0714F6_3D04_11d1_AE7D_00A0C90F26F4Instance_CLSID
push esi
call edi
cmp eax, ebx
jne 0x24d970b9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push 0x24d9fa2c
push ebx
push 0x24d91768
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x24d970b9
push 4
push 0x24d9f534
push 4
push ebx
push str.Required
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x24d970bd
xor eax, eax
jmp 0x24d970da
mov ebx, 0x24d917a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push 1
push 0x24d91728
push esi
call edi
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x24d97b76
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp dword [esi + 0x30], ebx
jne 0x24d97b93
xor eax, eax
jmp 0x24d97c45
push ebx
push ebx
lea eax, [ebp - 0x88]
push pe_nt_image_headers32
push eax
push 0xffffffffffffffff
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
cmp eax, ebx
jle 0x24d97bf6
add eax, 7
push eax
push ebx
push dword [0x24d9fcc0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add dword [esi + 0x30], 4
push dword [esi + 0x30]
mov dword [ebp + 8], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push str.Addins
repne scasb al, byte es:[edi]
push dword [ebp + 8]
not ecx
add dword [esi + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 8]
push eax
call fcn.24d97579
pop ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push 0x24d9fa2c
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x24d97c45
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x24d97c43
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x24d995d3
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.24d9a545
test eax, eax
pop ecx
jne 0x24d995ff
push esi
push dword [ebp + 0x10]
call fcn.24d99fa6
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.24d99588
pop ecx
test eax, eax
pop ecx
je 0x24d99727
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push 0x24d9f744
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2001f
push esi
push 0x24d9fcf0
lea eax, [ebp - 0x138]
push esi
push eax
push SysReAllocStringLen
call ebx
cmp eax, esi
jne 0x24d99727
cmp dword [ebp + 0xc], esi
jne 0x24d9967c
push dword [ebp + 8]
lea eax, [ebp - 0x138]
push 0x24d9f750
push eax
call edi
add esp, 0xc
jmp 0x24d9968c
push dword [ebp + 0xc]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 8]
call edi
cmp eax, esi
jne 0x24d99727
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push 0x24d9fcf4
push esi
push 0x24d9f75c
push dword [ebp - 8]
call ebx
cmp eax, esi
jne 0x24d99727
lea eax, [ebp - 0x138]
push 0x104
push eax
push dword [0x24d9fc6c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, esi
je 0x24d99727
inc eax
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x24d99727
cmp dword [ebp + 0x14], esi
je 0x24d99745
push 0xa
push str.Apartment
push 1
push esi
push 0x24d9f778
push dword [ebp - 4]
call edi
cmp eax, esi
je 0x24d99753
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x24d99737
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x24d99741
push dword [ebp - 4]
call edi
xor eax, eax
jmp 0x24d99766
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x24d9a044
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x14]
call fcn.24d99fa6
pop ecx
test eax, eax
pop ecx
je 0x24d9a0f9
cmp dword [ebp - 0xc], 0
je 0x24d9a1b0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x24d9f88c
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
mov edi, SysReAllocStringLen
push eax
push edi
call fcn.24d9a1b8
pop ecx
test eax, eax
pop ecx
je 0x24d9a0f9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.24d9a23c
add esp, 0x14
test eax, eax
jne 0x24d9a100
cmp dword [ebp - 8], eax
jne 0x24d9a1b0
push ebx
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push 0x24d9f898
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.24d9a1b8
pop ecx
test eax, eax
pop ecx
jne 0x24d9a1b0
xor eax, eax
jmp 0x24d9a1b3
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.24d9a2fe
add esp, 0xc
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push str._s._sCurVer
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x114]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
je 0x24d9a1a7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push ecx
push 0x2001f
push ecx
push 0x24d9fd30
lea eax, [ebp - 0x114]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x24d9a1b0
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x24d9f8b0
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x24d9a1b8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x24d9a1e2
xor eax, eax
jmp 0x24d9a239
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x24d9a21b
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.24d9a1b8
pop ecx
cmp eax, esi
pop ecx
jne 0x24d9a1e2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
cmp eax, esi
sete cl
mov eax, ecx
pop esi
leave
ret
Function at 0x24d9a3d2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x24d9a424
push dword [ebp - 4]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x24d9a42b
xor eax, eax
jmp 0x24d9a4f2
lea eax, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 8], esi
push eax
push esi
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x24d9a4ea
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x24d9a4ea
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x2001f
push esi
push 0x24d9fd3c
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x24d9a4e5
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.24d9a3d2
pop ecx
pop ecx
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x24]
inc dword [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x24d9a45a
jmp 0x24d9a4ea
push dword [ebp - 0xc]
call edi
xor eax, eax
cmp dword [ebp - 0x10], esi
sete al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x24d9a4f7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
cmp dword [ebp + 0xc], 0
push edi
mov esi, str.HELP
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x24d9a513
xor eax, eax
jmp 0x24d9a541
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
cmp esi, dword [ebp + 0xc]
jae 0x24d9a53f
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x1000ed10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x75627569
push 0x750a
push 0x100e8b50
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xb
push eax
mov dword [ebp - 0xfc], 0x75657578
mov dword [ebp - 0xf8], 0x756f7567
mov dword [ebp - 0xf4], 0x756f7524
mov dword [ebp - 0xf0], 0x756f7572
mov dword [ebp - 0xec], 0x750a
call fcn.100526f0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000ee80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x627e6271
push 0x6217
push 0x100e8b78
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xc
push eax
mov dword [ebp - 0xfc], 0x62726265
mov dword [ebp - 0xf8], 0x62786271
mov dword [ebp - 0xf4], 0x6239626f
mov dword [ebp - 0xf0], 0x626f6272
mov dword [ebp - 0xec], 0x62176272
call fcn.100526f0
add esp, 0x10
mov esp, ebp
pop ebp
ret