joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dcc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebp, ecx
lea esi, [edi*8]
call fcn.100ca320
test eax, eax
jne 0x100dcde1
push eax
push esi
call fcn.1001e500
mov ebx, eax
add esp, 8
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x100dcde1
push esi
push 0
push ebx
call fcn.10129b70
mov esi, dword [ebp + 0x10]
add esp, 0xc
test esi, esi
je 0x100dcd08
cmp dword [0x10165b38], 0
je 0x100dccfe
mov eax, dword [0x10168b88]
test eax, eax
je 0x100dcccc
push eax
call dword [0x10165b88]
add esp, 4
push esi
call dword [0x10165b64]
sub dword [0x10168a10], eax
add esp, 4
dec dword [0x10168a34]
push esi
call dword [0x10165b5c]
mov eax, dword [0x10168b88]
add esp, 4
test eax, eax
je 0x100dcd08
push eax
call dword [0x10165b90]
jmp 0x100dcd05
push esi
call dword [0x10165b5c]
add esp, 4
cmp byte [ebp], 1
mov eax, 0x100dcb40
mov ecx, 0x100dcbc0
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 8]
cmovne eax, ecx
mov dword [ebp + 0xc], edi
mov dword [esp + 0x1c], eax
mov dword [ebp + 8], 0
test ebx, ebx
je 0x100dcdd7
lea ecx, [edi - 1]
mov dword [esp + 0x14], ecx
nop dword [eax]
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0xc]
cmp eax, 0x100dcbc0
jne 0x100dcd70
xor eax, eax
test esi, esi
jle 0x100dcd69
movsx ecx, byte [edi]
lea edx, [eax*8]
xor edx, ecx
lea edi, [edi + 1]
dec esi
xor eax, edx
test esi, esi
jg 0x100dcd53
and eax, 0x7fffffff
jmp 0x100dcd77
push esi
push edi
call eax
add esp, 8
mov ecx, dword [esp + 0x14]
mov esi, dword [ebx]
and ecx, eax
mov eax, dword [esp + 0x18]
lea edx, [eax + ecx*8]
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x100dcdab
mov dword [ebx], ecx
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x100dcda3
mov dword [eax], ebx
mov dword [ecx + 4], ebx
jmp 0x100dcdc4
mov dword [ebp + 8], ebx
mov dword [ecx + 4], ebx
jmp 0x100dcdc4
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x100dcdba
mov dword [eax + 4], ebx
mov dword [ebx + 4], 0
mov dword [ebp + 8], ebx
inc dword [edx]
mov eax, dword [esp + 0x1c]
mov dword [edx + 4], ebx
mov ebx, esi
test esi, esi
jne 0x100dcd40
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10102a90
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [esp + 0x14], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x10102acc
push dword [esi + 8]
push dword [esi + 4]
push dword [esp + ebx*4 + 0x1c]
push esi
call fcn.10102720
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x10102b8c
mov ebp, dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push 1
push edi
call fcn.1004b390
push edi
call fcn.10049de0
add esp, 0x14
cmp eax, 0x65
jne 0x10102b23
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push ecx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.101027f0
add esp, 0x1c
jmp 0x10102b7a
cmp eax, 0x64
jne 0x10102b7a
push 0
push edi
call fcn.1004a9a0
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x28]
jne 0x10102b45
cmp edx, ecx
je 0x10102b7a
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ebx, ebx
push ebp
push ecx
mov eax, str.__rowid
mov dword [esp + 0x20], str.__parent
cmove eax, dword [esp + 0x20]
push eax
push edx
push dword [esp + 0x2c]
push ebp
push ecx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.101027f0
add esp, 0x2c
push edi
call fcn.10048db0
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x10102b8c
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x101075b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [ecx], eax
test edi, edi
je 0x10107713
mov ebx, dword [ebp + 0xc]
lea esi, [eax + 0xd]
lea edx, [ebx - 1]
test edx, edx
js 0x10107607
mov ebx, dword [ebp + 8]
nop word [eax + eax]
movsx ecx, byte [edx + ebx]
lea eax, [esi*8]
xor ecx, eax
xor esi, ecx
sub edx, 1
jns 0x101075f0
mov ebx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
lea eax, [esi*8]
xor eax, esi
xor eax, ecx
and eax, 0x1ff
lea eax, [edi + eax*4]
mov edi, dword [eax]
mov dword [esp + 0x18], eax
test edi, edi
je 0x1010768e
cmp dword [edi + 8], ecx
jne 0x10107687
cmp dword [edi + 4], ebx
jne 0x10107687
mov edx, dword [edi]
mov ecx, ebx
mov esi, dword [ebp + 8]
sub ecx, 4
jb 0x10107651
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10107656
add edx, 4
add esi, 4
sub ecx, 4
jae 0x10107640
cmp ecx, 0xfffffffc
je 0x1010769e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10107683
cmp ecx, 0xfffffffd
je 0x1010769e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10107683
cmp ecx, 0xfffffffe
je 0x1010769e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x10107683
cmp ecx, 0xffffffff
je 0x1010769e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1010769e
mov ecx, dword [esp + 0x10]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x10107628
lea edi, [ebx + 0x10]
xor esi, esi
call fcn.100ca320
test eax, eax
je 0x101076b0
jmp 0x101076c0
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.1001e500
mov esi, eax
add esp, 8
test esi, esi
jne 0x101076dc
test edi, edi
je 0x101076cb
mov eax, 7
jmp 0x101076cd
xor eax, eax
mov dword [esp + 0x14], eax
test esi, esi
jne 0x101076e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push esi
call fcn.10129b70
add esp, 0xc
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x10]
push ebx
push dword [ebp + 8]
mov dword [esi], eax
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
call fcn.1012b000
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [ecx], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10126440
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov dword [esp + 4], edx
cmp ecx, 0x80
jge 0x1012645f
lea edx, [ecx - 0x41]
cmp edx, 0x19
lea eax, [ecx + 0x20]
cmova eax, ecx
add esp, 8
ret
cmp ecx, 0x10000
jge 0x1012650a
push ebx
push ebp
xor edx, edx
mov ebx, 0xa2
push esi
push edi
mov dword [esp + 0x10], edx
or ebp, 0xffffffff
nop dword [eax]
lea eax, [edx + ebx]
mov esi, ecx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
movzx edx, word [edi*4 + 0x1014e260]
lea eax, [edi - 1]
sub esi, edx
mov edx, edi
cmovs edx, ebp
test esi, esi
mov ebp, edx
lea edx, [edi + 1]
cmovs edx, dword [esp + 0x10]
cmovs ebx, eax
mov dword [esp + 0x10], edx
cmp ebx, edx
jge 0x10126480
movzx edx, word [ebp*4 + 0x1014e260]
movzx eax, byte [ebp*4 + 0x1014e263]
add eax, edx
cmp ecx, eax
jge 0x101264ee
movzx eax, byte [ebp*4 + 0x1014e262]
xor edx, ecx
and edx, eax
test edx, 1
jne 0x101264ee
shr eax, 1
movzx eax, word [eax*2 + 0x1014f700]
add eax, ecx
movzx ecx, ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x10126518
xor edx, edx
cmp eax, 2
sete dl
add esp, 8
jmp fcn.100f4ce0
lea eax, [ecx - 0x10400]
cmp eax, 0x27
lea eax, [ecx + 0x28]
jbe 0x1012651a
mov eax, ecx
add esp, 8
ret

Function at 0x1012d00b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1012d04a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1012d04a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1012d04a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1012d04a
cmp dword [ecx + 0x74], 0xe
jbe 0x1012d04a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1012f8bd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013fe3c
push 0x1013fe34
push str.FlsAlloc
push 0x1f
call fcn.1012f73c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012f8f1
push dword [ebp + 8]
mov ecx, esi
call dword [0x1013e1e8]
call esi
jmp 0x1012f8f7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1012f93b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013fe4c
push 0x1013fe44
push str.FlsGetValue
push 0x21
call fcn.1012f73c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012f972
push dword [ebp + 8]
mov ecx, esi
call dword [0x1013e1e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1012f97a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013fe54
push 0x1013fe4c
push str.FlsSetValue
push 0x22
call fcn.1012f73c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012f9b4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1013e1e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10134af5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10134b92
push ebx
push esi
call fcn.10134abe
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10134a52
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10134b3f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10134b91
push edi
push eax
call fcn.1012ec29
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10134b5f
call fcn.1012ebef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10134b90
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10134a52
add esp, 0x20
test eax, eax
jne 0x10134b7e
push edi
call fcn.1012ebef
jmp 0x10134b86
push ebx
call fcn.1012ebef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10134b95
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10134ba6
pop esi
ret
push ebx
push edi
push esi
call fcn.10134abe
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1012ec29
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10134bce
push ebx
push esi
push edi
call fcn.1012b000
add esp, 0xc
push 0
call fcn.1012ebef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10134f9e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10134be3
Function at 0x1013af90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1013afbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1013afbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x415994]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404340
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x40433e
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
jmp 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004063e6
mov esp, ebp
pop ebp
ret

Function at 0x4070ea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407129
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407129
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407129
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407129
cmp dword [ecx + 0x74], 0xe
jbe 0x407129
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x415e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41dc80], ecx
add edx, 1
cmp edx, 0x100
jb 0x415e72
cmp edx, 0x800
jae 0x415f5b
mov edi, edi
mov eax, dword [edx*4 + 0x41d880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41dc80]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41dc7c], eax
jb 0x415f30
mov dword [0x41dc54], 0x416610
call fcn.004160a0
test eax, eax
jne 0x415f78
mov dword [0x41dc54], 0x416530
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x44ff2c0c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3c7a5513
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x68e05dea
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7b233788
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x53
loope 0x414b09
mov ch, 0xa
push ebp
ret 0xdbb0
fiadd dword [ebx + eax*4]
mov al, 0xda
add al, 0x83
dec edi
and eax, 0xdab07cfb
add al, 0x83
dec edi
and eax, 0xdab07cfb
add al, 0x83
mov al, 0xda
add al, 0x83
mov al, 0xda
add al, 0x83
mov al, 0xda
xchg dword [edi - 0x4c], ebp
sbb eax, 0x725ca700
inc esi
cmp dword [ecx - 0x4f14b4df], 0xffffffaa
inc ebp
cmp esi, 0xffffff9d
mov esp, 0x82e0325b
cmp byte [edi - 0x75], bh
invalid
Function at 0x10004cb2
Capabilities:
Create thread

Disassembly:
push 0x34
mov eax, 0x1001e015
call fcn.1001bb08
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xd0], 1
jne 0x10004d76
mov eax, dword [ebp + 8]
cmp dword [eax], 7
jne 0x10004d76
cmp dword [esi + 0x248], ebx
sete al
cmp al, bl
sete al
cmp al, bl
je 0x10004d76
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push 0x10020b70
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov word [ebp - 0x40], ax
call fcn.100074a3
xor eax, eax
push str._self
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov word [ebp - 0x30], ax
call fcn.100074a3
mov eax, dword [esi + 0x248]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x10004d40
push 0x80004003
call fcn.1000df81
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push edx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x40]
push edx
push eax
call dword [ecx + 0xd0]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x30]
push eax
call edi
lea eax, [ebp - 0x40]
push eax
call edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call edi
mov eax, dword [esi + 0xd0]
cmp eax, 2
je 0x10004e53
cmp eax, 1
je 0x10004e53
mov eax, dword [esi + 0x244]
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
call fcn.100063a6
push dword [ebp + 8]
lea ecx, [esi + 0xe4]
mov eax, dword [ecx]
push eax
mov dword [ebp - 4], 3
call fcn.100084b0
push dword [esi + 0xc0]
lea edi, [esi + 0x240]
cmp dword [edi], ebx
setne byte [ebp - 0xd]
call dword [sym.imp.kernel32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], ebx
je 0x10004de8
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 1
jne 0x10004e15
cmp dword [esi + 0x23c], ebx
jne 0x10004e15
push edi
push ebx
push esi
push 0x10004c38
push ebx
push ebx
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x23c], eax
jmp 0x10004e53
cmp eax, 0xa
jne 0x10004e47
lea edi, [esi + 0x23c]
cmp dword [edi], ebx
je 0x10004e47
lea eax, [ebp + 8]
push eax
push edi
push 1
push 0xffffffffffffffff
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
test eax, eax
jne 0x10004e53
push dword [edi]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi], ebx
jmp 0x10004e53
cmp byte [ebp - 0xd], bl
jne 0x10004e53
mov ecx, esi
call fcn.1000df81
call fcn.1001bbe0
ret 4
Function at 0x10006690
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
jmp 0x100066a9
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
add ecx, 2
cmp ecx, dword [esp + 8]
jne 0x1000669b
ret

Function at 0x1000b06c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000b0ba
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x1000b0cb
push 0xd
pop eax
jmp 0x1000b0f5
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1000b0ce
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000b5af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1000df81
mov ebx, eax
cmp ebx, esi
je 0x1000b622
lea ecx, [ebp - 0x74]
call fcn.10009ecc
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000b63a
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000b5af
cmp eax, esi
jne 0x1000b66c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000b62a
lea ecx, [ebp - 0x74]
call fcn.10009ecc
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000af95
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10009ecc
mov eax, esi
jmp 0x1000b608