joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466ad1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404bd8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x466ae8
call fcn.00404834
mov eax, ebx
call fcn.00425154
mov edi, eax
dec edi
test edi, edi
jl 0x4669d8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00425128
mov edx, dword [0x439874]
call fcn.00403828
test al, al
je 0x4669d4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00425128
lea edx, [ebp - 0x14]
call fcn.0044559c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404bd8
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048a8
inc esi
dec edi
jne 0x466986
mov al, byte [0x466aec]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x466af8
mov eax, dword [ebp - 0xc]
call fcn.0040ed1c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004045b0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044559c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x466ae8
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044559c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x466ae8
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x466ae8
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x466b04
call fcn.0040a760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466ad8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040453c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040453c
lea eax, [ebp - 0x14]
call fcn.00404518
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040453c
ret
Function at 0x4678f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41b06c]
call fcn.004051b0
xor eax, eax
push ebp
push 0x467a34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fa0f8], 0
jne 0x467943
mov ecx, dword [0x4fc6c4]
mov dl, 1
mov eax, dword [0x407f6c]
call fcn.0040d804
call fcn.00403e28
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f10
mov eax, ebx
call fcn.00404dd8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x467a44
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406468
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404de8
test eax, eax
jle 0x4679db
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4679d4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004047b0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404798
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408dd8
test eax, eax
jne 0x4679d4
mov ebx, 0x15
jmp 0x4679e0
mov ebx, 0x10
jmp 0x4679e0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4fa0f8]
call fcn.00467848
mov eax, dword [ebp - 8]
call fcn.00467848
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467a3b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040453c
lea eax, [ebp - 0x10]
mov edx, dword [0x41b06c]
call fcn.00405280
ret

Function at 0x480734
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x48074d
add esp, 0xfffffff0
call fcn.004039c0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4807c2
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0041e88c
xor edx, edx
mov eax, esi
call fcn.00480858
xor edx, edx
mov eax, esi
call fcn.0048087c
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.0041955c
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.00411728
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.00404518
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4807c9
lea eax, [ebp - 0x10]
call fcn.00411414
ret
Function at 0x48d0e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4faffa
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48d13b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4fb01b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x48d131
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x48d13f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x49e2c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49e496
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x49e47d
mov eax, dword [edi + 0x30]
call fcn.004047e8
test eax, eax
jne 0x49e316
mov eax, dword [edi + 0x34]
call fcn.004047e8
test eax, eax
jne 0x49e316
mov eax, edi
call fcn.0049e534
jmp 0x49e47d
cmp dword [edi + 0xa0], 0
jne 0x49e34d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040a100
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4fef8c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x49e384
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040a100
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4fef8c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049e574
mov ebx, eax
test bl, bl
jne 0x49e432
mov eax, dword [edi + 0x30]
call fcn.004047e8
test eax, eax
jne 0x49e3bc
mov eax, dword [edi + 0xc0]
call fcn.004047e8
test eax, eax
je 0x49e432
mov eax, dword [edi + 0xc0]
call fcn.004047e8
test eax, eax
je 0x49e3de
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040a100
jmp 0x49e40a
push dword [edi + 0x30]
push 0x49e4b0
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004048a8
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040a100
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x49e432
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049e574
mov ebx, eax
test bl, bl
jne 0x49e43f
mov eax, edi
call fcn.0049e534
jmp 0x49e47d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x49e44e
mov dword [edi + 0xa8], eax
jmp 0x49e458
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0049e5ec
test al, al
je 0x49e47d
mov eax, edi
mov si, 0xffee
call fcn.00403898
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0049e698
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e49d
lea eax, [ebp - 0x108]
call fcn.00404518
ret
Function at 0x4a2814
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a2842
mov eax, ebx
call fcn.004a32c8
cmp dword [ebx + 0x40], 0
je 0x4a283b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a28b3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a28a5
cmp dword [ebx + 8], 0
je 0x4a2864
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a2876
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a28a5
cmp dword [ebx + 8], 0
je 0x4a2857
cmp eax, 3
je 0x4a2889
dec eax
jne 0x4a2857
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a2857
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a2857
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a28d1
cmp dword [ebx + 0x14], 0xcc
je 0x4a28d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a28dc
pop ebx
ret

Function at 0x4b30ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404518
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.004049e8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b3189
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x400
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00404b74
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00404a40
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004049e8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b3168
xor eax, eax
mov dword [ebp - 0xc], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jge 0x4b3176
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00404b74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b3194
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3257
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41befc]
call fcn.0040366c
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.004049e8
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b3241
xor esi, esi
mov dword [ebp - 8], 0x400
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b74
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.00404a40
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4b3233
cmp dword [ebp - 8], 0
jbe 0x4b3233
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b74
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
test ebx, ebx
je 0x4b31e1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b325e
lea eax, [ebp - 0xc]
call fcn.00404518
ret
Function at 0x4b3694
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
mov esi, 0x4fc14c
xor eax, eax
push ebp
push 0x4b375a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
jne 0x4b3736
mov eax, esi
mov edx, 0x3e8
call fcn.00404b74
mov eax, dword [esi]
call fcn.004047e8
push eax
mov eax, dword [esi]
call fcn.004049e8
push eax
push 0x4b3768
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, esi
xchg edx, eax
call fcn.00404b74
cmp dword [esi], 0
jne 0x4b370d
lea eax, [ebp - 4]
push eax
mov ecx, 0x4b377c
mov edx, dword [0x4fc128]
mov eax, 0x80000002
call fcn.004b30ec
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040456c
lea edx, [ebp - 8]
mov eax, dword [esi]
call fcn.00408d38
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0040456c
mov edx, dword [esi]
mov eax, 0x4b3790
call fcn.00404b2c
test eax, eax
setg byte [0x4ff24c]
mov eax, ebx
mov edx, dword [esi]
call fcn.0040456c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3761
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040453c
ret

Function at 0x4f2eec
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004f1f04
test al, al
je 0x4f2f10
mov eax, edi
call fcn.00404518
jmp 0x4f3033
mov eax, dword [ebp - 4]
call fcn.004f2e6c
mov esi, eax
xor eax, eax
push ebp
push 0x4f302c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004f2c54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov ecx, 0x6c
mov edx, 0x4f3044
call fcn.004ec0e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov ecx, dword [ebp - 4]
mov edx, 0x4f3044
call fcn.004ed18c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov ecx, 0x70
mov edx, 0x4f3058
call fcn.004ec0e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov ecx, esi
mov edx, 0x4f3058
call fcn.004ed18c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov ebx, dword [eax + 0x9c]
mov edx, 0x4f3068
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f3078
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f309c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f30b4
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f30c4
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f30ec
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f311c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f3148
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4f317c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.004eba24
mov edx, edi
mov eax, esi
call fcn.004ef888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3033
mov eax, dword [ebp - 4]
call fcn.004f2ee0
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100118e0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push edi
mov edi, ecx
push 0x10e
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001198b
cmp eax, 0x10e
jae 0x1001198b
push esi
mov esi, 0x10e
lea edx, [eax + edi]
mov ecx, 0
sub esi, eax
je 0x1001191e
cmp esi, 0x7fffffff
jbe 0x10011923
mov ecx, 0x80070057
test ecx, ecx
js 0x1001197a
mov ecx, esi
test esi, esi
je 0x1001195c
mov edi, SysReAllocString
sub edi, esi
mov esi, 0x100058e8
sub esi, edx
jmp 0x10011940
lea eax, [edi + ecx]
test eax, eax
je 0x10011958
mov al, byte [esi + edx]
test al, al
je 0x10011958
mov byte [edx], al
inc edx
sub ecx, 1
jne 0x10011940
jmp 0x1001195c
test ecx, ecx
jne 0x1001195d
dec edx
neg ecx
mov byte [edx], 0
pop esi
sbb ecx, ecx
xor eax, eax
and ecx, 0x7ff8ff86
add ecx, 0x8007007a
test ecx, ecx
pop edi
setns al
ret
test esi, esi
je 0x10011981
mov byte [edx], 0
xor eax, eax
test ecx, ecx
pop esi
setns al
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x10011990
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push 2
mov dword [esi + 0x14], 0
mov byte [edi], 0
push dword [esi + 8]
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edx, eax
test edx, edx
jne 0x100119da
cmp dword [ebp - 4], 1
jbe 0x100119da
xor ecx, ecx
cmp byte [edi], 0x3a
setne cl
mov dword [esi + 0x14], ecx
xor eax, eax
test edx, edx
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011d90
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10042544]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 0x114], 0
push eax
push 0
push 2
push edx
push 0
push ecx
mov dword [esi], 0
mov dword [ebp - 0x228], 0x10e
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x10011df1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f4c0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x224]
call fcn.100118e0
test eax, eax
je 0x10011e1e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1003f4c0
mov esp, ebp
pop ebp
ret

Function at 0x10012160
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10042544]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100428f4], 0
mov dword [ebp - 0x118], 0
jne 0x10012281
lea eax, [ebp - 0x118]
push eax
push ecx
lea ecx, [ebp - 0x114]
call fcn.100119f0
add esp, 8
test eax, eax
jne 0x100121fb
push 1
call fcn.10011580
push 0x100428d8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10042900
push 0
push 0
push 0
push 0
push 0x10003f28
push 0
mov dword [0x10042910], 1
push 0x10011e90
mov dword [0x100428f0], 1
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f4c0
mov esp, ebp
pop ebp
ret
cmp dword [0x100428f8], 0
lea eax, [ebp - 0x114]
mov dword [0x10042118], eax
mov byte [ebp - 7], 0
jne 0x1001221d
mov dword [0x100428f8], 0xfff
cmp dword [0x100428f4], 0
jne 0x10012240
mov ecx, 0x23fa
call fcn.10011690
cmp dword [0x10042550], 0xffffffff
jne 0x10012240
push 1
call fcn.10011580
cmp dword [0x10042008], 0x10011380
jne 0x10012277
cmp dword [ebp - 0x118], 0
je 0x10012277
push 0x10005950
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x10042118]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10005958
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x10042118], 0x10005400
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1003f4c0
mov esp, ebp
pop ebp
ret
Function at 0x100175c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], ebx
lea eax, [edi + edi*2]
shl eax, 3
push eax
push ebx
push esi
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
cmp dword [edx + 8], edi
jbe 0x10017628
test byte [0x100428f8], 2
je 0x1001761a
mov eax, dword [0x100440e0]
push 0x123
push 0x8002000e
push 0x10005ab8
push 0x48c09
push eax
call fcn.10011220
add esp, 0x14
pop edi
pop esi
mov eax, 0x8002000e
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor edi, edi
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0x14], ebx
jbe 0x100177a1
movzx ecx, word [edi + edi]
mov eax, dword [edx + 8]
mov ebx, ecx
shr ecx, 0xb
and ebx, 0xf7ff
and ecx, 0xffffff01
mov dword [ebp - 8], ecx
cmp edi, eax
jae 0x1001773f
cmp dword [ebp - 4], 0
jl 0x1001773f
sub eax, edi
dec eax
shl eax, 4
add eax, dword [edx]
movzx ecx, word [eax]
test ebx, 0x4000
je 0x100176b9
test ecx, 0x4000
je 0x100176a3
mov edx, 0x400c
cmp cx, dx
jne 0x10017696
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10017696
mov eax, ecx
cmp word [eax], dx
je 0x10017688
mov ecx, edx
mov word [esi], cx
mov dword [esi + 8], eax
jmp 0x1001772d
mov byte [esi + 0x11], 1
mov ecx, 0xa
mov eax, 0x80020004
mov word [esi], cx
mov dword [esi + 8], eax
jmp 0x1001772d
mov edx, 0x400c
cmp cx, dx
jne 0x100176d1
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100176d1
mov eax, ecx
cmp word [eax], dx
je 0x100176c3
movzx edi, word [eax]
mov edx, edi
movzx ecx, bx
xor edx, ecx
test edx, 0xffffbfff
je 0x10017714
mov ecx, 0xc
cmp cx, bx
je 0x10017714
cmp edi, 0xa
jne 0x100176fb
cmp dword [eax + 8], 0x80020004
je 0x10017714
push ebx
push 0
push eax
push esi
mov byte [esi + 0x10], 1
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov edi, dword [ebp - 0xc]
mov ebx, eax
mov dword [ebp - 4], ebx
jmp 0x10017730
mov ecx, dword [eax]
mov edi, dword [ebp - 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
test ebx, ebx
js 0x10017755
cmp word [esi], 0xa
jne 0x10017755
jmp 0x10017751
mov ebx, dword [ebp - 4]
mov eax, 0xa
mov word [esi], ax
mov dword [esi + 8], 0x80020004
mov byte [esi + 0x11], 1
cmp byte [esi + 0x11], 0
je 0x1001778e
test cl, cl
jne 0x1001778e
test byte [0x100428f8], 2
mov ebx, 0x8002000e
mov dword [ebp - 4], ebx
je 0x1001778e
mov eax, dword [0x100440e0]
push 0x174
push ebx
push 0x10005ab8
push 0x5d009
push eax
call fcn.10011220
add esp, 0x14
mov edx, dword [ebp + 8]
inc edi
add esi, 0x18
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp + 0x14]
jb 0x10017636
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10019de0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003fed0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10042544]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
add dword [eax + 4], 0xffffffff
jne 0x10019e65
mov eax, dword [edi]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10019e3d
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_CreateErrorInfo]
mov eax, dword [edi]
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100431c0]
call esi
mov eax, dword [edi]
cmp byte [eax + 0x12], 0
jne 0x10019e55
mov eax, dword [0x100428d4]
push 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10019e65
mov dword [eax + 8], 0
mov eax, dword [edi]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003f4c0
mov esp, ebp
pop ebp
ret

Function at 0x10019e80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov eax, dword [0x100428d4]
mov dword [esi + 0x1c], 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
mov dword [esi + 0x18], 0
test eax, eax
je 0x10019eba
inc dword [eax + 4]
mov eax, esi
pop esi
pop ebp
ret 8
mov eax, dword [0x100428d4]
push esi
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov word [esi + 0x10], 0
mov byte [esi + 0x12], 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], esi
mov eax, esi
pop esi
pop ebp
ret 8