joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x410538
cmp edx, dword [eax]
je 0x405e66
add eax, 8
inc ecx
cmp eax, 0x4105c8
jl 0x405e57
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x410538]
jne 0x405f94
mov eax, dword [0x4118a8]
cmp eax, 1
je 0x405f6e
test eax, eax
jne 0x405e97
cmp dword [0x4102e4], 1
je 0x405f6e
cmp edx, 0xfc
je 0x405f94
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405ece
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408220
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404560
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405f11
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404560
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40e544
push edi
call fcn.004086d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408220
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408230
lea eax, [ebp - 0xa0]
push 0x40e524
push eax
call fcn.00408230
push dword [esi + 0x41053c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408230
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408645
add esp, 0x2c
pop edi
jmp 0x405f94
lea eax, [ebp + 8]
lea esi, [esi + 0x41053c]
push 0
push eax
push dword [esi]
call fcn.00404560
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7aea07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea eax, [edx + edx]
pop eax
jmp 0x7cd352
bswap eax
mov eax, 0x83bbe500
bswap eax
mov eax, 0x4151002e
not eax
mov ax, word [esp]
jmp 0x7ae973
lea esp, [esp + 0x20]
push ebp
mov ah, 0xe1
jmp 0x7ae9ea
call fcn.007eb142
loopne 0x7ae9fe
pop edx
mov ch, 0xc5
mov edi, 0xd54a34c1
xchg ecx, eax
lds ebp, [ecx - 0x75]
and bl, byte [ebp - 0x54]
mov ebp, esp
push edx
mov edx, ebp
jmp 0x7aea2e
xor al, 0x15
cwde
or eax, 0xd7a41a68
lea esp, ds:[esp + 3]
push bp
lea esp, [esp + 3]
push eax
jmp 0x7ae989
movzx ecx, word [ebp + 0xc]
not dx
jmp 0x7aea61
add edx, 8
movzx eax, word [edx]
pop edx
jmp 0x7aea17
push edx
jmp 0x7eafb2
push ebx
mov dl, byte [esp]
rol bh, cl
and bl, ch
jmp 0x7aea4b
ret
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x7eb24c
pushal
push si
lea esp, [esp + 2]
jmp 0x7ae99f
pushal
xchg dh, bl
pushfd
neg ah
mov dword [esp + 0x18], ebp
jmp 0x7eafca
cmc
lea esp, [esp + 4]
popal
jmp 0x7eb00c
mov dh, byte [esp]
mov dl, 0x36
jmp 0x7eb01b
add edx, 0xc
mov ebx, dword [edx]
pop edx
mov edx, ecx
mov edx, 0xf1ca7900
jmp 0x7eaff2
push esi
adc dx, 0xdc06
mov esi, dword [ebp + 8]
jmp 0x7eb056
shr esi, 0x10
call fcn.007eb026
mov dx, word [esp]
lea esp, [esp + 4]
movzx esi, si
or dx, 0x4230
setg dh
jmp 0x7eb131
imul eax, ebx
jmp 0x7eb0c4
mov dword [ebp + 0xc], esi
lea esi, [esi + 0x78]
btr esi, edi
bsr esi, ecx
jmp 0x7eb082
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 4]
imul ecx, esi
clc
jmp 0x7eb098
mov esi, ebx
pushfd
lea esp, [esp + 4]
imul esi, dword [ebp + 0xc]
jmp 0x7eb104
lea esp, [esp + 4]
movzx ebx, bx
imul edx, ecx
sub esp, 8
jmp 0x7eb0b2
add esp, 1
pop dword [esp + 3]
lea esp, [esp + 2]
jmp 0x7eb10f
add eax, ecx
mov dword [edi], edx
sub esp, 0xd
push dx
jmp 0x7eb0ee
mov dword [edi + 4], esi
sub esp, 7
pushfd
mov byte [esp + 7], bh
lea esp, [esp + 3]
jmp 0x7eb2bf
mov dl, byte [esp]
ror dh, 6
mov edx, eax
sub esp, 5
lea esp, [esp + 1]
jmp 0x7eb0df
add esi, 0x10000
call fcn.007eb158
lea esp, [esp + 4]
cmp dword [esp + 4], 0
je 0x7aea95
push edi
jmp 0x7eb297
lea esp, [esp + 8]
inc eax
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x7eb2a8
lea esp, [esp + 4]
shr dword [esp + 4], 1
sub esp, 9
lea esp, [esp + 1]
jmp 0x7eb281
lea esp, [esp + 8]
cmp eax, 0x20
call fcn.007eb424
mov eax, dword [eax]
xchg esi, eax
int1
add ch, al
cmp eax, 0x11e69f0c
cmp eax, ecx
lea esp, [esp + 0x10]
jae 0x7ae9d4
cmc
jmp 0x7eb194
Function at 0x7bf3db
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x7eaffaab
jmp 0x7bf5ae
call 0x7beed6
xchg dh, dl
sub bl, al
sete al
mov edx, ebx
jmp 0x7bf3ef
dec edi
mov eax, 0x4e2fc360
mov edx, edi
lea edx, reloc.kernel32.dll_DeleteCriticalSection
cmc
jmp 0x7bf422
stc
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov dl, 0xaf
pushal
bswap eax
mov edx, ecx
jmp 0x7bf449
jle 0x7bf40c
stc
lea edx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x7bf45f
setl dl
neg ax
ja 0x7bf466
jbe 0x7bf466
nop
sbb dword [ecx - 0x723e418], ecx
invalid
mov dl, 0xaf
pushal
bswap eax
jmp 0x7bf419
lea esp, [esp + 0x20]
sub cl, 0x70
jmp 0x7bf686
shr ax, 3
stc
add cl, 0xaa
jmp 0x7bf495
mov ax, 0xbca6
mov eax, ebx
mov dx, 0x578b
sub esp, 4
jno 0x7bf619
add dword [eax], eax
add byte [eax + 0x27], dh
jo 0x7bf4d1
imul ecx, dword [eax - reloc.kernel32.dll_DeleteCriticalSection], 0xbd148d
add byte [eax], al
add bl, dl
loopne 0x7bf4a5
lea edx, [edi*4]
shl eax, cl
jmp 0x7bf487
int3
mov dx, bp
lea esp, [esp + 2]
jmp 0x7bf62b
bsf dx, bx
xchg dword [esp], eax
pop word [esp]
jmp 0x7bf4bb
xor cl, 0xa9
bsr dx, si
jmp 0x7bf564
mov eax, esp
btc ax, bx
btc edx, edi
mov dl, 0xfa
bsr ax, si
jmp 0x7bf508
clc
jmp 0x7bf4de
dec cl
xchg edx, eax
mov dl, 0x3e
bsr dx, dx
jbe 0x7bf53f
bswap edx
jmp 0x7bf541
btc edx, edi
mov dl, 0xfa
bsr ax, si
jmp 0x7bf508
bswap edx
jmp 0x7bf541
jmp 0x7bf529
mov edx, ecx
inc ah
jmp 0x7bf584
shl edx, 2
jle 0x7bf56e
setb al
mov al, 0xb7
mov al, 0x3b
bsr eax, edx
jmp 0x7bcece
jge 0x7bf4eb
mov eax, esp
btc ax, bx
jmp 0x7bf51e
setb al
jmp 0x7bf5c4
jp 0x7bf54b
jnp 0x7bf54b
daa
mov dh, 0x24
inc ebx
mov esi, 0x3bab3309
pop esi
lodsd eax, dword [esi]
sbb bl, byte [ebx - 0x34]
inc edx
and eax, 0xb6d96ad4
rdtsc
mov dh, 0x2e
rdtsc
rcl ax, cl
je 0x7bf505
clc
jmp 0x7bf4de
call fcn.007bf5d0
mov edx, 0x79ba4f28
or al, 0x9f
punpckhdq mm3, qword [ecx + 0x7c6d7214]
dec edi
salc
mov al, 0xb7
mov al, 0x3b
bsr eax, edx
jmp 0x7bcece
bsf dx, bx
xchg dword [esp], eax
pop word [esp]
mov dx, bp
lea esp, [esp + 2]
sub cl, 0x7b
xchg dx, ax
jmp 0x7bf59b
inc eax
jne 0x7bf4b0
lea edx, [edi*4]
shl eax, cl
shr ax, 3
stc
jmp 0x7bf48c

Function at 0x7c1b4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], ah
mov byte [esp + 1], ah
mov dword [esp], esi
push ebx
push cx
jmp 0x7c1b39

Function at 0x7c1c9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x9777
lea esp, [esp + 4]
jmp 0x7c1cdf
inc ax
jmp 0x7c1d72
not esi
mov ecx, esp
bsr ax, bx
jg 0x7c1cc9
inc ax
stc
mov ax, 0x30e7
rdtsc
jmp 0x7c1d1e
rcl cx, cl
jmp 0x7c1d37
rcl cx, cl
dec esi
clc
jno 0x7c1d55
jo 0x7c1dd4
mov ch, 0x2b
mov ebx, 0xddee2dde
dec esp
ret 0x54a5
mov ch, al
sbb ax, 0xe021
bswap edx
rdtsc
mov ecx, 0x3bd2931b
jmp 0x7c1d7b
stc
mov ax, 0x30e7
rdtsc
jmp 0x7c1d34
rol esi, 0
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
xchg edx, ecx
jmp 0x7c1db0
rdtsc
mov ecx, 0x3bd2931b
jmp 0x7c1d7b
add esi, dword [edi]
call fcn.007c1d9a
mov ch, al
sbb ax, 0xe021
bswap edx
jmp 0x7c1d91
Function at 0x7c3f03
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea eax, [ebx + edi]
jmp 0x7c3f33
jmp 0x7c3f6c
sub esp, 0xb8
mov esi, esp
bt ax, di
jl 0x7c3f1d
cpuid
bt cx, ax
jmp 0x7c3f72
cpuid
bt cx, ax

Function at 0x7c402b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], ah
mov ebx, 0xd067334b
jmp 0x7c400c

Function at 0x7cf2d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
add esp, 1
jmp 0x7ceee9
jg 0x7cef2e
mov byte [esp], cl
mov bh, al
jmp 0x7cef33
mov byte [esp], cl
mov bh, al
call 0x7ceec1
xchg ebx, ecx
cmc
mov ebx, dword [esp]
jmp 0x7cef7f
mov bx, word [esp]
not ecx
ror al, 0
mov cx, 0x6046
call fcn.007cef69
push word [esp + 3]
mov cx, word [esp + 1]
mov cx, 0xec14
jmp 0x7cefb1
xchg bx, cx
xchg word [esp + 1], cx
jmp 0x7cef91
lea esp, [esp + 2]
lea esp, [esp + 4]
neg al
cmp ecx, 0x5a1b1e2f
je 0x7cf01f
jne 0x7cf01f
inc esp
neg esi
sub esp, esp
fsub st(7), st(0)
int1
mov eax, dword [reloc.kernel32.dll_DeleteCriticalSection]
dec eax
jmp 0x7cefd7
leave
jo 0x7cefa7
xchg bx, cx
xchg word [esp + 1], cx
push word [esp + 3]
mov cx, word [esp + 1]
mov cx, 0xec14
jmp 0x7cefb1
call 0x7cf008
mov ebx, 0x6a56ab49
lea esp, [esp + 3]
jmp 0x7cf2bb
lea ebx, [edx*4]
jmp 0x7cf16c
lea ebx, [edx*4]
pushal
mov bh, 0x5c
lea ecx, [esi + ebp]
mov dword [esp + 0x18], eax
call fcn.007cf09a
dec al
mov ebx, esp
dec bx
jb 0x7cf165
jae 0x7cf0c7
mov ecx, dword [esp]
call 0x7cf2d6
and ecx, dword [ebp - reloc.kernel32.dll_DeleteCriticalSection]
xchg ebx, eax
dec esp
invalid

Function at 0x7eb026
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bswap edx
shr ebx, 0x10
bsr edx, ebx
neg dl
jmp 0x7eb05e

Function at 0x7eb158
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [edi + 4], esi
lea esp, [esp + 4]
jmp 0x7ae9d4

Function at 0x7ed1db
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
add esp, 3
jmp 0x7ed19f
mov ecx, dword [ebp - 0x10]
clc
dec dword [ebp - 4]
sub esp, 7
jmp 0x7ed161
clc
clc
sub esi, 4
cmc
sub esp, 0x19
jmp 0x7ed1c2
mov dword [ecx + edi], eax
cmc
lea esp, [esp + 4]
sub edi, 4
jmp 0x7ed186
lea esp, [esp + 0x18]
cmp dword [ebp - 4], 0
pushfd
lea esp, [esp + 1]
pushal
jmp 0x7ed20c
lea esp, [esp + 1]
jmp 0x7ed1ac
pop ecx
jmp 0x7ed17a
lea esp, [esp + 3]
lea esp, [esp + 0x20]
jge 0x7ecb13
jl 0x7ecc0a

Function at 0x7ed23f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x7ed293
mov eax, 0x98b13313
xchg edi, eax
mov edi, dword [ebp + 0xc]
bts eax, ecx
sub esp, 0xc
jmp 0x7ed24b
lea esp, [esp + 4]
jbe 0x7ecadd
ja 0x7ed220
mov eax, dword [esp]
xor eax, eax
push esi
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x7ed2c5
lea esp, [esp + 4]
push dword [ebp - 0xc]
rdtsc
rdtsc
jmp 0x7ed277
lea esp, [esp + 0xc]
rep stosd dword es:[edi], eax
jmp 0x7ecadd
Function at 0x8f5869
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
pop word [esp + 3]
xchg ah, dl
mov bl, 0xf9
setg ah
jmp 0x8f586f
mov dl, ch
not ecx
jmp 0x8f5853
mov dh, 0x8c
pop ax
lea ebp, reloc.kernel32.dll_DeleteCriticalSection
mov ecx, ebp
bsr edx, eax
mov dword [esp + 0x1e], ebx
jmp 0x8f58af
mov edx, edi
push dword [esp + 4]
xchg word [esp + 0xc], si
lea ebx, [edx + 0xb]
clc
xchg cx, ax
jmp 0x8f5899

Function at 0x8f5d00
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ax
xchg bp, cx
mov byte [esp + 8], cl
setns dl
rdtsc
popal
jmp 0x8f5d08
mov edx, edi
pop dword [esp + 0xc]
jmp 0x8f5cea
rdtsc
btr dx, bp
sub esp, 0x1e
push dword [esp + 0xb]
rdtsc
push word [esp + 1]
jmp 0x8f5d35

Function at 0x8f6231
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8f628b
lea esp, [esp + 9]
not ebp
pop ecx
push word [esp + 0x12]
std
mov cl, al
jmp 0x8f625d
push dword [esp + 7]
xchg ebx, esi
xchg ebp, edx
sub esp, 0x1b
pop esi
rdtsc
jmp 0x8f6273

Function at 0x8f6517
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call 0x8f5367
jmp 0x8f64f3
mov eax, dword [eax + 0xc]
jmp 0x8f64e9
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
mov eax, dword fs:[0x30]
jmp 0x8f64a7
push eax
jmp 0x8f5362
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x8f64d1
pop eax
mov dword [esp], ebp
push dword [esp + 3]
pop word [esp + 1]
mov word [esp + 1], dx
jmp 0x8f64bd
Function at 0x100235d
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x100f044], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x10023a3
call ebx
test eax, eax
jns 0x1002399
push 0x1001400
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x10013f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x100f040], eax
mov dword [0x100f044], 1
mov eax, dword [0x100f040]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10023bf
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x10023ef
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x10023e5
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x10023da
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x10023df
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x10023ee
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x10052fb
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
je 0x1005475
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jbe 0x1005475
xor ecx, ecx
push 0xc
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x100536c
mov dword [ebp - 4], 0xe
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100547c
test byte [eax + 0x1c], 1
je 0x100547c
push 0x1001774
push 0x20
jmp 0x100543a
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x1c], ecx
shl ecx, 2
push ecx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor edi, edi
cmp dword [ebp - 4], ebx
je 0x1005394
cmp dword [ebp - 4], 0xea
jne 0x100547c
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
jae 0x100547c
mov eax, dword [esi + 0x20]
mov byte [eax + edi + 8], 1
mov eax, dword [esi + 0x20]
mov byte [eax + edi + 9], bl
mov eax, dword [esi + 0x20]
push 0x100
push 8
mov dword [eax + edi + 4], 0x80
push dword [0x100f098]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esi + 0x20]
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x20]
add eax, edi
mov ecx, dword [eax]
cmp ecx, ebx
je 0x100541a
push ebx
push ebx
push ebx
push ebx
add eax, 4
push eax
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 4], eax
cmp eax, 0xea
je 0x1005408
cmp eax, ebx
je 0x1005408
cmp eax, 0x103
jne 0x1005447
cmp eax, 0x103
je 0x1005470
inc dword [ebp - 8]
add edi, 0xc
jmp 0x1005382
mov dword [ebp - 4], 0xe
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100547c
test byte [eax + 0x1c], 1
je 0x100547c
push 0x1001774
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002205
jmp 0x100547c
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100547c
test byte [eax + 0x1c], 1
je 0x100547c
push dword [ebp - 4]
push 0x1001774
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003f79
jmp 0x100547c
mov dword [ebp - 4], ebx
jmp 0x100547c
mov dword [ebp - 4], 0x57
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100548b
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0xc], edi
cmp dword [ebp + 8], edi
je 0x10055b9
cmp dword [esi + 0x20], edi
je 0x10055b9
cmp eax, edi
jbe 0x100558c
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
push ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + eax]
cmp ebx, edi
je 0x100557e
mov eax, dword [esi + 0x18]
mov dword [ebp - 8], edi
cmp eax, edi
je 0x100552d
mov edi, eax
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x14]
jae 0x100552b
mov eax, dword [edi]
mov ecx, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005511
test dx, dx
je 0x100550d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005511
add eax, 4
add ecx, 4
test dx, dx
jne 0x10054eb
xor eax, eax
jmp 0x1005516
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1005523
cmp dword [edi + 0x18], 1
je 0x100557c
inc dword [ebp - 0xc]
inc dword [ebp - 8]
add edi, 0x24
jmp 0x10054df
xor edi, edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esi + 0x20]
mov edx, dword [ebp - 4]
mov byte [ecx + edx + 9], 1
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
cmp ecx, edi
jbe 0x100554e
dec ecx
mov dword [edx], ecx
cmp eax, edi
je 0x100557e
mov ecx, dword [0x100f004]
cmp ecx, 0x100f004
je 0x100557e
test byte [ecx + 0x1c], 1
je 0x100557e
push eax
push ebx
push 0x1001774
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010090ed
jmp 0x100557e
xor edi, edi
add dword [ebp - 4], 0xc
dec dword [ebp - 0x10]
jne 0x10054c2
pop ebx
mov eax, dword [0x100f0c8]
mov ecx, dword [0x100f0cc]
mov edx, eax
or edx, ecx
je 0x10055ac
push edi
push edi
push 0x10013b0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EventWrite]
push dword [ebp - 0xc]
mov ecx, dword [esi + 0x24]
call fcn.010086da
jmp 0x10055dd
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x10055dd
test byte [eax + 0x1c], 1
je 0x10055dd
push 0x1001774
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002205
pop edi
pop esi
leave
ret 8
Function at 0x1006199
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
push edi
mov esi, 0x1001808
push esi
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x1006236
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0x100622f
push 0
lea eax, [ebp - 8]
push eax
push 1
push 0x10017cc
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x100622f
push 0xc
pop ecx
mov edx, ecx
lea eax, [ebp - 0x14]
mov byte [eax], 0
inc eax
dec edx
jne 0x10061ed
mov eax, dword [ebp - 8]
push esi
mov dword [ebp - 0x10], eax
push edx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x1006244
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x1006228
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1006244
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x1006244
call edi
mov dword [ebp - 4], eax
jmp 0x1006244
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xb7
cmp dword [ebp - 8], 0
pop edi
pop esi
je 0x1006255
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x1006261
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100f010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x120]
push eax
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10062c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100633d
test byte [eax + 0x1c], 1
je 0x100633d
push edi
push 0x10017ac
push 0xb
jmp 0x1006329
cmp dword [ebp - 0x11c], 6
jae 0x10062f0
push 0xd
pop edi
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100633d
test byte [eax + 0x1c], 1
je 0x100633d
push dword [ebp - 0x11c]
push 0x10017ac
push 0xc
jmp 0x1006329
mov cl, byte [ebp - 6]
cmp cl, 1
jne 0x1006300
mov byte [esi + 0x84], cl
jmp 0x100633d
cmp cl, 3
je 0x1006336
cmp cl, 2
je 0x1006336
push 0xd
pop edi
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x100633d
test byte [eax + 0x1c], 1
je 0x100633d
movzx ecx, cl
push ecx
push 0x10017ac
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003f79
jmp 0x100633d
mov byte [esi + 0x84], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01008c45
leave
ret
Function at 0x1006481
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10064f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x1006541
test byte [eax + 0x1c], 1
je 0x1006541
push edi
push 0x10017ac
push 0x11
jmp 0x100652f
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
xor edi, edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x100653c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x100f004]
cmp eax, 0x100f004
je 0x1006541
test byte [eax + 0x1c], 1
je 0x1006541
push edi
push 0x10017ac
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003f79
jmp 0x1006541
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
je 0x100654f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008c45
leave
ret 4
Function at 0x100670c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 4
pop edi
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
mov esi, 0x1001588
push esi
push 0x80000001
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x1006789
mov ecx, dword [0x100f004]
cmp ecx, 0x100f004
je 0x1006867
test byte [ecx + 0x1c], 1
je 0x1006867
push eax
push esi
push 0x10017ac
push 0x23
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010090ed
jmp 0x1006867
cmp dword [ebp - 0xc], 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, 0x1001880
jne 0x10067d8
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push dword [ebp - 8]
call ebx
test eax, eax
je 0x100681a
mov ecx, dword [0x100f004]
cmp ecx, 0x100f004
je 0x1006867
test byte [ecx + 0x1c], 1
je 0x1006867
push eax
push dword [ebp - 4]
push 0x10017ac
push 0x24
jmp 0x100685c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100681a
cmp eax, 2
je 0x100681a
mov ecx, dword [0x100f004]
cmp ecx, 0x100f004
je 0x1006867
test byte [ecx + 0x1c], 1
je 0x1006867
push eax
push dword [ebp - 4]
push 0x10017ac
push 0x25
jmp 0x100685c
mov eax, dword [ebp - 0x18]
push dword [ebp - 4]
mov ecx, dword [eax + 0x74]
call fcn.0100864a
inc dword [ebp - 4]
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push dword [ebp - 8]
call ebx
test eax, eax
je 0x1006867
mov ecx, dword [0x100f004]
cmp ecx, 0x100f004
je 0x1006867
test byte [ecx + 0x1c], 1
je 0x1006867
push eax
push dword [ebp - 4]
push 0x10017ac
push 0x26
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010060b6
cmp dword [ebp - 8], 0
pop edi
pop esi
pop ebx
je 0x1006879
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret