joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411238
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x4876c0], eax
push edi
mov edx, esi
mov eax, 0x4876c0
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x48807c
jl 0x411249
pop edi
mov dword [0x475c94], esi
mov dword [0x488090], esi
pop esi
ret

Function at 0x411277
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x488090], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4876c0
jne 0x411297
push 0
call fcn.00451931
pop ecx
call fcn.00411238
mov dword [0x475c94], 0x270
mov dword [0x4876bc], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4112b6
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4112ec
mov edx, dword [0x4876c0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x411346
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x475c94]
jne 0x411353
call fcn.00411277
mov eax, dword [0x4876bc]
mov ecx, dword [eax]
add dword [0x4876bc], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x41138a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x475c94]
jne 0x411398
call fcn.00411277
mov eax, dword [0x4876bc]
mov eax, dword [eax]
add dword [0x4876bc], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x4113de
fadd qword [0x470318]
fmul qword [0x470310]
pop ecx
ret
Function at 0x4437f6
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x57
adc eax, 0xf97c9326
xchg ebx, eax
jl 0x4437f2
xchg ebx, eax
jl 0x4437f2
movsb byte es:[edi], byte [esi]
imul edx, dword [esi + edx*8 - 0x4a], 0xffffffb0
salc
mov dh, 0xb0
mov ah, 0x6e
loopne fcn.004437c0
and eax, 0xae8c9170
nop
xchg ebx, eax
fbld tbyte [edi]
aas
out dx, al
mov edx, 0x61217418
inc edx
mov word [ecx], ss
sub al, 0x43
push esi
movsd dword es:[edi], dword [esi]
xor dword [ebp - 0x7e027dc4], ebp
cld
push ebp
adc al, 0x51
jno 0x443845
dec ecx
insb byte es:[edi], dx
mov dh, 0x1b
out 0xd, al
invalid
cmc
aad 0xe3
lodsb al, byte [esi]
inc esp
inc esp
mov dword [ecx], ecx
movsd dword es:[edi], dword [esi]
invalid

Function at 0x451280
Capabilities:
Encode data using xor

Disassembly:
popfd
adc dword [eax + eax*2 - 0x7d56d1], eax
int3
Function at 0x1000b11e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1000b13e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1000b12a
add dl, dl
jne 0x1000b149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1000b19a
xor eax, eax
add dl, dl
jne 0x1000b156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1000b23b
add dl, dl
jne 0x1000b165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1000b170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1000b17b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1000b186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1000b190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1000b135
mov eax, 1
add dl, dl
jne 0x1000b1a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1000b1b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1000b19f
sub eax, ebx
mov ebx, 1
jne 0x1000b1e6
mov ecx, 1
add dl, dl
jne 0x1000b1cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1000b1d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1000b1c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1000b135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1000b1fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1000b208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1000b1f4
cmp eax, 0x7d00
jae 0x1000b22b
cmp eax, 0x500
jb 0x1000b226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1000b135
cmp eax, 0x7f
ja 0x1000b22e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1000b135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1000b25c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1000b135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x403360
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul esi
and edx, 0xe5
dec eax
imul ebx
imul eax
rcl eax, 0xd8
rcr edi, 0x4b
sub eax, 0xb8
mov edx, 3
inc eax
rcr ebx, 0xad
imul eax
dec edx
rcl edx, 0xd8
dec edi
bswap eax
sbb edx, 0x63
ror ebx, 0x87
inc esi
sbb ebx, 0xd6
and ebx, 0xb3
dec edi
inc edx
rcr ebx, 0x80
and edi, 0x81
neg edi
rcl edx, 0x26
sub ebx, 0xe4
rcl edi, 0x84
not ebx
neg esi
neg eax
neg esi
add edi, 9
rcl ebx, 0x74
sbb eax, 0xd3
inc eax
inc eax
mov ebx, 0x8e
inc esi
dec ebx
imul eax
dec ebx
not esi
mov edi, 0xf7
neg eax
rcl eax, 0x7e
imul edx
ror edi, 0xf9
rcr eax, 0x13
xor ecx, ecx
xor edi, edi
and eax, 0x5a
and edi, 0x36
sbb esi, 0x7b
rcl edx, 0x10
mov edx, 0x8c
not edx
dec eax
dec edi
bswap ebx
mov edi, 0x8b
rcl edx, 0x14
imul edi
rcr eax, 0xa7
bswap ebx
dec edi
dec eax
dec eax
rcr edx, 0x4b
or esi, 0xb6
inc ebx
ror ebx, 0x8c
imul eax
rcr edi, 0x20
dec esi
rcr edx, 0x9c
imul edx
not esi
sbb esi, 0x4b
not edi
ror eax, 0xfb
rcr edi, 0x18
not edx
and esi, 0x6c
neg edx
sbb edx, 0x7d
imul eax
bswap edi
sbb edx, 0x29
inc eax
rcr edx, 0x1b
add edx, 0x2d
ror edx, 0xa5
inc eax
rcr esi, 0xeb
add esi, 0x34
not edi
rol edx, 0x32
mov ebx, 0x65
and eax, 0x4f
not edi
mov ecx, dword [ebp + 0xc]
inc edi
inc esi
neg edi
and ebx, 0x8a
and edx, 1
rcl edi, 0x7c
neg edi
neg eax
neg edi
dec esi
imul esi
mov esi, 0x90
bswap ebx
imul eax
mov eax, 7
rcl esi, 0x8c
add ebx, 0x1d
bswap eax
dec edx
inc edx
rol eax, 0x11
rol eax, 0x1f
dec edx
and eax, 0x20
neg edx
ror eax, 0x6e
inc edx
and edx, 0xa3
sbb eax, 0xf3
mov esi, 0x8c
neg eax
dec esi
not ebx
not ebx
sbb edi, 0x10
not edx
dec edi
rcl esi, 0xf1
neg edi
sbb ebx, 0x8b
sub edi, 0x3d
bswap edx
imul eax
neg eax
sbb eax, 0x64
sub esi, 0x66
bswap edx
sub edi, 0x2c
ror ebx, 0xdc
dec edi
mov edi, dword [ebp + 8]
mov esi, eax
mov ebx, esi
xor eax, eax
not byte [edi]
xor eax, ebx
mov esi, ebx
mov eax, ebx
xor eax, esi
mov ebx, esi
xor esi, ebx
xor ebx, ebx
mov ebx, eax
xor eax, esi
add byte [edi], 0x68
mov eax, esi
xor ebx, eax
mov eax, esi
mov eax, esi
mov eax, eax
xor esi, ebx
mov eax, esi
mov esi, eax
xor esi, ebx
sub byte [edi], 0x44
mov ebx, ebx
mov eax, eax
mov esi, eax
mov eax, eax
mov esi, eax
mov ebx, esi
xor ebx, ebx
mov ebx, ebx
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4034ff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x408f1a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418484]
jne 0x408f24
repz ret
jmp fcn.0040d8f5
Function at 0x40f0fd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bebf
and dword [ebp - 4], 0
cmp dword [0x4199f4], 0
mov ebx, eax
jne 0x40f1ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f25f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f25f
push eax
call fcn.0040be4d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4199f4], eax
call esi
push eax
call fcn.0040be4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4199f8], eax
call esi
push eax
call fcn.0040be4d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4199fc], eax
call esi
push eax
call fcn.0040be4d
pop ecx
mov dword [0x419a04], eax
test eax, eax
je 0x40f1ae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040be4d
pop ecx
mov dword [0x419a00], eax
mov eax, dword [0x419a00]
cmp eax, ebx
je 0x40f206
cmp dword [0x419a04], ebx
je 0x40f206
push eax
call fcn.0040bec8
push dword [0x419a04]
mov esi, eax
call fcn.0040bec8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f206
test edi, edi
je 0x40f206
call esi
test eax, eax
je 0x40f1fd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f1fd
test byte [ebp - 0xc], 1
jne 0x40f206
or dword [ebp + 0x10], 0x200000
jmp 0x40f23f
mov eax, dword [0x4199f8]
cmp eax, ebx
je 0x40f23f
push eax
call fcn.0040bec8
pop ecx
test eax, eax
je 0x40f23f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f23f
mov eax, dword [0x4199fc]
cmp eax, ebx
je 0x40f23f
push eax
call fcn.0040bec8
pop ecx
test eax, eax
je 0x40f23f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4199f4]
call fcn.0040bec8
pop ecx
test eax, eax
je 0x40f25f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f261
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4209ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4209ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4209ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4209ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4209ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4209ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43318d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43318d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ

Function at 0x43cf49
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43ccda
call fcn.0043cf63
xor dword [edi], ebx
inc edi
or esi, esi
sub eax, 0xd25ceaa5
cmp edi, edx
jne fcn.0043cf49
ret
Function at 0x401303
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
mov dword [0x4030c0], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [eax + 8], ebx
push ebp
mov dword [0x4030c8], ebx
mov dword [0x4030bc], ebx
mov dword [0x4056ec], ebx
mov byte [0x4030cc], bl
mov dword [0x4047cc], ebx
mov dword [0x4030d0], ebx
call fcn.004010bf
push 4
mov eax, dword [0x4051f8]
push 0x3000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4047d0], eax
cmp eax, ebx
jne 0x40136e
push 0x403064
push 0xa4
call dword [0x4047b4]
call fcn.004012c7
mov dword [esp + 0x10], eax
cmp eax, 0x100
je 0x4014ba
cmp dword [0x4047c0], 0
je 0x4013d5
mov eax, dword [0x4030c0]
mov edx, dword [eax + 0x10]
cmp edx, dword [0x4030d0]
jae 0x4013d5
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x28b]
add ecx, edx
push ecx
push 0x1402
push 0x111
push 0x404
push dword [eax + 0x173]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4030c0]
add dword [eax + 0x10], 0x3e00
cmp dword [esp + 0x10], 0x100
jge 0x40140f
push dword [esp + 0x10]
call dword [0x4047b8]
mov eax, dword [0x4047d0]
mov cl, byte [esp + 0x10]
inc dword [0x4030d0]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, dword [0x4051f8]
jne 0x40136e
xor ebx, ebx
jmp 0x40136e
mov ecx, 0x3e
mov eax, dword [esp + 0x10]
sub eax, 0x101
cdq
idiv ecx
mov esi, eax
mov ecx, dword [esp + 0x10]
imul eax, eax, 0xffffffc2
lea ebp, [eax + ecx - 0xfe]
movsx eax, word [esi*2 + 0x403020]
push eax
call fcn.00401097
add esp, 4
mov ecx, dword [esi*4 + 0x4051e0]
add ecx, eax
mov esi, ebx
add ecx, ebp
mov edi, ebx
sub edi, ecx
jns 0x40145a
add edi, dword [0x4051f8]
test ebp, ebp
jle 0x4014a1
mov dword [esp + 0x10], ebp
mov ecx, dword [0x4047d0]
movzx eax, byte [ecx + edi]
push eax
call dword [0x4047b8]
mov ecx, dword [0x4047d0]
inc dword [0x4030d0]
mov dl, byte [ecx + edi]
inc edi
mov byte [ecx + esi], dl
inc esi
cmp esi, dword [0x4051f8]
jne 0x401491
xor esi, esi
cmp edi, dword [0x4051f8]
jne 0x40149b
xor edi, edi
dec dword [esp + 0x10]
jne 0x401462
add ebx, ebp
cmp ebx, dword [0x4051f8]
jl 0x40136e
sub ebx, dword [0x4051f8]
jmp 0x40136e
xor esi, esi
cmp dword [0x4047c0], esi
je 0x401528
mov eax, dword [0x4030c0]
mov edx, dword [eax + 8]
test edx, edx
je 0x401528
cmp dword [eax + 0x18], esi
je 0x40151c
mov ecx, dword [eax + 0xc]
push esi
lea ebx, [esp + 0x18]
push ebx
push edx
push dword [ecx + 0x28f]
push dword [ecx + 0x187]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401503
mov eax, dword [0x4030c0]
mov ecx, dword [esp + 0x14]
cmp dword [eax + 8], ecx
je 0x40151c
mov eax, dword [0x4030c0]
mov eax, dword [eax + 0xc]
add eax, 0x18b
push eax
push 0x9c
call dword [0x4047b4]
mov ecx, dword [0x4030c0]
mov edx, dword [ecx + 8]
add dword [ecx + 0x14], edx
push 0x8000
mov eax, dword [0x4047d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x10001290
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x508
add eax, 0x80000000
push ebx
push edi
xor edi, edi
cmp eax, 3
mov ebx, ecx
ja case.default.0x100012aa
jmp dword [eax*4 + 0x1000137c]
mov edi, str.CLASSES_ROOT
jmp case.default.0x100012aa
mov edi, str.CURRENT_USER
jmp case.default.0x100012aa
mov edi, str.MACHINE
jmp case.default.0x100012aa
mov edi, str.USERS
test edi, edi
je 0x1000136e
mov edx, dword [esp + 0x51c]
test edx, edx
jne 0x100012f8
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x10], 0x101
call dword [section..rdata]
jmp 0x10001320
lea ecx, [esp + 0xc]
push esi
mov esi, 0x101
lea eax, [esp + 0x10]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x10001317
mov byte [eax], cl
inc eax
dec esi
jne 0x10001308
jmp 0x1000131b
test esi, esi
jne 0x1000131c
dec eax
mov byte [eax], 0
pop esi
mov edx, dword [esp + 0x518]
lea eax, [esp + 0x110]
push edx
push edi
push 0x1000f044
push 0x400
push eax
call fcn.10001590
mov ecx, dword [esp + 0x534]
add esp, 0x14
lea edx, [esp + 0xc]
lea eax, [esp + 0x110]
push ecx
push edx
push 2
push 4
push eax
mov ecx, ebx
call fcn.10001180
pop edi
pop ebx
add esp, 0x508
ret 0x10
pop edi
xor eax, eax
pop ebx
add esp, 0x508
ret 0x10

Function at 0x10001390
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x508
add eax, 0x80000000
push ebx
push edi
xor edi, edi
cmp eax, 3
mov ebx, ecx
ja case.default.0x100013aa
jmp dword [eax*4 + 0x1000147c]
mov edi, str.CLASSES_ROOT
jmp case.default.0x100013aa
mov edi, str.CURRENT_USER
jmp case.default.0x100013aa
mov edi, str.MACHINE
jmp case.default.0x100013aa
mov edi, str.USERS
test edi, edi
je 0x1000146e
mov edx, dword [esp + 0x51c]
test edx, edx
jne 0x100013f8
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x10], 0x101
call dword [section..rdata]
jmp 0x10001420
lea ecx, [esp + 0xc]
push esi
mov esi, 0x101
lea eax, [esp + 0x10]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x10001417
mov byte [eax], cl
inc eax
dec esi
jne 0x10001408
jmp 0x1000141b
test esi, esi
jne 0x1000141c
dec eax
mov byte [eax], 0
pop esi
mov edx, dword [esp + 0x518]
lea eax, [esp + 0x110]
push edx
push edi
push 0x1000f044
push 0x400
push eax
call fcn.10001590
mov ecx, dword [esp + 0x534]
add esp, 0x14
lea edx, [esp + 0xc]
lea eax, [esp + 0x110]
push ecx
push edx
push 3
push 4
push eax
mov ecx, ebx
call fcn.10001180
pop edi
pop ebx
add esp, 0x508
ret 0x10
pop edi
xor eax, eax
pop ebx
add esp, 0x508
ret 0x10
Function at 0x10001490
Capabilities:
Get session user name

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x108
test edx, edx
push edi
mov edi, ecx
jne 0x100014bb
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], 0x101
call dword [section..rdata]
jmp 0x100014e3
lea ecx, [esp + 8]
push esi
mov esi, 0x101
lea eax, [esp + 0xc]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x100014da
mov byte [eax], cl
inc eax
dec esi
jne 0x100014cb
jmp 0x100014de
test esi, esi
jne 0x100014df
dec eax
mov byte [eax], 0
pop esi
mov edx, dword [esp + 0x118]
mov ecx, dword [esp + 0x110]
lea eax, [esp + 8]
push edx
push eax
push 2
push 1
push ecx
mov ecx, edi
call fcn.10001180
pop edi
add esp, 0x108
ret 0xc

Function at 0x10001510
Capabilities:
Get session user name

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x108
test edx, edx
push edi
mov edi, ecx
jne 0x1000153b
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], 0x101
call dword [section..rdata]
jmp 0x10001563
lea ecx, [esp + 8]
push esi
mov esi, 0x101
lea eax, [esp + 0xc]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x1000155a
mov byte [eax], cl
inc eax
dec esi
jne 0x1000154b
jmp 0x1000155e
test esi, esi
jne 0x1000155f
dec eax
mov byte [eax], 0
pop esi
mov edx, dword [esp + 0x118]
mov ecx, dword [esp + 0x110]
lea eax, [esp + 8]
push edx
push eax
push 3
push 1
push ecx
mov ecx, edi
call fcn.10001180
pop edi
add esp, 0x108
ret 0xc
Function at 0x10002010
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1000c0eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov al, byte [0x1000f6d4]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov byte [esp + 0x1c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
mov ecx, dword [0x1000f07c]
mov dword [esp + 0x14], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x138]
mov ebx, dword [esp + 0x134]
mov ebp, dword [esp + 0x130]
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push edi
push ebx
push ebp
mov dword [esp + 0x140], 0
call dword [0x1000d1ac]
cmp dword [esp + 0x14], 1
jne 0x100020c7
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
push edi
push ebx
push ebp
call fcn.10002150
push eax
lea eax, [esp + 0x20]
push str.Reg:DelValue:__s_s___s___s_
push eax
call fcn.10002820
add esp, 0x18
jmp 0x100020e4
push edi
push ebx
push ebp
mov ecx, esi
call fcn.10002150
push eax
lea ecx, [esp + 0x1c]
push str.Reg:DelValue:__s_s___s_
push ecx
call fcn.10002820
add esp, 0x14
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x18]
lea edx, [esp + 0x10]
push edx
push 1
push eax
call fcn.10002240
mov eax, dword [esp + 0x10]
mov edx, dword [0x1000f030]
pop edi
pop esi
lea ecx, [eax - 0xc]
pop ebp
cmp ecx, edx
pop ebx
je 0x1000212a
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000212a
mov edx, dword [esp]
add edx, 0xfffffff4
push edx
call fcn.1000bdea
add esp, 4
mov ecx, dword [esp + 0x110]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x11c
ret 0xc