joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403428
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, 0x407620
mov esi, 0x407030
cmp byte [ebx + 0x28], 0
jne 0x403453
cmp dword [esi], 0
je 0x403453
mov eax, dword [esi]
mov dword [esp], eax
xor eax, eax
mov dword [esi], eax
call dword [esp]
cmp dword [esi], 0
jne 0x403442
cmp dword [0x406004], 0
je 0x40346d
call fcn.00403310
call fcn.0040339c
xor eax, eax
mov dword [0x406004], eax
cmp byte [ebx + 0x28], 2
jne 0x403481
cmp dword [section.DATA], 0
jne 0x403481
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004031f0
cmp byte [ebx + 0x28], 1
jbe 0x403495
cmp dword [section.DATA], 0
je 0x4034b8
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x4034b8
mov eax, edi
call fcn.004038c4
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebp + 0x10]
cmp esi, dword [ebp + 4]
je 0x4034b8
test esi, esi
je 0x4034b8
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004031c8
cmp byte [ebx + 0x28], 1
jne 0x4034c6
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x4034d1
call fcn.0040336c
cmp dword [ebx], 0
jne 0x4034f0
cmp dword [0x407018], 0
je 0x4034e5
call dword [0x407018]
mov eax, dword [section.DATA]
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov eax, dword [ebx]
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
jmp 0x40346d

Function at 0x403fdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403788
xor eax, eax
push ebp
push 0x40406c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403520
mov eax, dword [ebp - 4]
call fcn.0040363c
mov ebx, eax
test bx, bx
jbe 0x40404e
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0x7b
call fcn.00403614
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403644
inc edi
dec bx
jne 0x40401f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404073
lea eax, [ebp - 0xc]
call fcn.00403520
lea eax, [ebp - 4]
call fcn.00403520
ret
Function at 0x92a080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66500d
lea edi, [esi - 0x26400d]
push edi
or ebp, 0xffffffff
jmp 0x92a0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x92a0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x92a098
mov eax, 1
add ebx, ebx
jne 0x92a0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x92a0b0
jne 0x92a0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x92a0b0
xor ecx, ecx
sub eax, 3
jb 0x92a0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x92a152
mov ebp, eax
add ebx, ebx
jne 0x92a0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x92a0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x92a11c
inc ecx
add ebx, ebx
jne 0x92a108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x92a0fd
jne 0x92a119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x92a0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x92a13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x92a12d
jmp 0x92a09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x92a13c
add edi, ecx
jmp 0x92a09e
pop esi
mov edi, esi
mov ecx, 0x173e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x92a15a
cmp byte [edi], 0x11
jne 0x92a15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x92a15f
lea edi, [esi + 0x526000]
mov eax, dword [edi]
or eax, eax
je 0x92a1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5320d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x53212c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x92a18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x532134]
or eax, eax
je 0x92a1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x92a1a9
call dword [esi + 0x532130]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x92a1ff
cmp al, 0xef
ja 0x92a1f2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x92a1d4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x92a1e1
mov ebp, dword [esi + 0x532138]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x92a233
sub esp, 0xffffff80
jmp 0x40c41c
Function at 0x10001691
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x1000f6d4], eax
je 0x10010c9e
cmp dword [0x1000f6d4], ebx
je 0x10010c9e
pop ebx
leave
ret
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x1000f6d4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1000f6d4], esi
test esi, esi
jne 0x10010d0d
mov dword [0x1000f6d4], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x1000f6d4
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x1000f6d4]
not eax
mov dword [0x1013c6d8], eax
pop esi
jmp 0x100016b7

Function at 0x10002069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f6d4]
jne fcn.100c49b4
ret
Function at 0x100036b3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [0x101066ac]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x1001135e
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0x10
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x2a0], edi
test edi, edi
je 0x1001150a
push esi
xor esi, esi
cmp dword [edi], esi
jne 0x10011509
mov dword [edi], 1
cmp ebx, 0x7e
ja 0x10011507
mov ebx, dword [edi + ebx*4 + 4]
mov dword [ebp - 0x2a4], ebx
test ebx, ebx
je 0x10011507
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x14]
and eax, 3
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push ebx
mov dword [ebp - 0x294], eax
call fcn.100ce0f5
cmp eax, dword [ebx + 0x24]
jg 0x1001142c
mov ecx, dword [ebx + 0x48]
cmp ecx, dword [ebx + 0x44]
jae 0x1001142c
test byte [ebx + 4], 1
jne 0x1001142c
test dword [ebx + 4], 0x400
jne 0x1001142c
test byte [ebp + 0x14], 0x10
jne 0x1001142c
cmp dword [0x10141540], esi
je 0x1001142c
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x20
push 1
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov dword [ebp - 0x290], eax
jmp 0x1001142e
mov eax, esi
mov edi, dword [ebp - 0x298]
mov esi, ebx
mov ebx, dword [ebp - 0x29c]
push ebx
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.100ce1ea
test byte [esi + 4], 2
jne 0x1001146d
mov esi, dword [esi]
mov eax, dword [ebp - 0x290]
test esi, esi
jne 0x1001143c
mov ebx, dword [ebp - 0x2a4]
test edi, edi
mov edi, dword [ebp - 0x2a0]
jne 0x100114b4
test byte [0x101065c0], 2
je 0x100114b4
push dword [ebp - 0x29c]
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push dword [ebx + 8]
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0x10011510
push dword [0x10106e6c]
push dword [0x10106e68]
call fcn.100cdfdc
mov esi, dword [ebx + 0xc]
cmp esi, 0xffffffff
je 0x10011502
mov esi, dword [edi + esi*4 + 4]
test esi, esi
je 0x10011502
mov edi, dword [ebp - 0x298]
mov ebx, dword [ebp - 0x290]
push 0
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.100ce1ea
test byte [esi + 4], 2
jne 0x100114fc
mov esi, dword [esi]
test esi, esi
jne 0x100114d0
mov edi, dword [ebp - 0x2a0]
and dword [edi], 0
jmp 0x10011509
mov dword [edi], esi
pop esi
pop edi
jmp 0x100036e1
Function at 0x1000373d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
call fcn.1000376f
test eax, eax
jne 0x100128e8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor edi, edi
push edi
push 0x100129f0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], edi
call esi
test eax, eax
jne 0x100129b8
lea eax, [ebp - 0x218]
push eax
push 0x20119
push edi
push 0x100129f0
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x100129b8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x10029070
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x100129b8
cmp dword [ebp - 0x220], 1
jne 0x100129b8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x10029070
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x100129b8
cmp dword [ebp - 0x220], 1
jne 0x100129b8
inc bl
mov eax, dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100129d1
push eax
mov dword [ebp - 0x218], edi
call esi
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x100129e4
push ecx
mov dword [ebp - 0x214], edi
call esi
pop edi
pop esi
jmp 0x10003760
Function at 0x1000398c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
test ebx, ebx
je 0x100116e4
cmp dword [0x10107708], eax
jne 0x10011706
push edi
mov dword [ebx], eax
lea eax, [ebp - 0x4c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10011715
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
jne 0x10011726
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001172d
push esi
push dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
call fcn.10003af5
mov esi, dword [ebp - 0x50]
test al, al
je 0x10011734
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x10011745
push 0x43
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1001174c
and dword [ebp - 0x58], 0
xor edi, edi
inc edi
cmp dword [esi], 0
jbe 0x10003ab8
lea eax, [esi + 4]
mov dword [ebp - 0x50], eax
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x10003aa4
mov eax, dword [ebp - 0x50]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10003b3d
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
inc ecx
add eax, 8
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], eax
cmp ecx, dword [esi]
jb 0x10003a81
mov dword [0x10107708], edi
mov eax, dword [ebx]
mov dword [0x10106600], eax
test esi, esi
je 0x10003ad0
push esi
call fcn.10003b44
pop ecx
pop esi
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10003ae3
and dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 4
mov dword [ebx], edi
jmp 0x10003ab8
push 0x15b3c8
call fcn.100bbd1d
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x100116ff
and dword [ebp - 0x4c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10003ae6
mov eax, dword [0x10106600]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x10003ae6
push 0x15b3c9
call fcn.100bbd1d
xor edi, edi
jmp 0x10003ad1
push 0x15b3ca
jmp 0x1001171a
push 0x15b3cb
jmp 0x1001171a
push 0x15b3cc
call fcn.100bbd1d
xor edi, edi
jmp 0x10003ac5
push 0x15b3cd
jmp 0x10011739
push 0x15b3ce
jmp 0x10011739
Function at 0x10005f25
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x10106de8
push ebx
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10106e00], 0
jne 0x1001177e
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10011788
mov eax, dword [ecx]
mov dword [0x10106dc8], eax
cmp dword [ecx], 0
push edi
jne 0x1000605a
cmp dword [ecx + 4], 0
je 0x10006053
mov eax, dword [ecx + 0x10]
mov dword [0x10106e4c], eax
mov eax, dword [ecx + 8]
mov dword [0x10106544], eax
mov eax, dword [ecx + 0xc]
mov dword [0x10106548], eax
push dword [ecx + 4]
call fcn.10006068
mov edx, eax
pop ecx
mov dword [0x10106dc4], edx
test edx, edx
je 0x10011792
mov eax, dword [0x10106544]
mov edi, dword [0x10106548]
mov ecx, 0x315
test eax, eax
je 0x10006053
test edi, edi
je 0x10006053
mov edi, dword [0x10106e2c]
lea eax, [ebp - 4]
push eax
movzx eax, cx
push 0xa
push eax
push edx
call fcn.100060aa
mov ecx, eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov dword [0x10106e2c], ecx
cmp eax, 6
jb 0x100117fe
lea edx, [ecx + eax]
mov ax, word [0x10006064]
mov dword [0x10106e30], edx
cmp ax, word [ecx]
jne 0x10006053
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
add eax, 4
cmp eax, edx
jae 0x10006011
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.100060fa
mov esi, eax
test esi, esi
js 0x10006053
call fcn.10006468
mov esi, eax
test esi, esi
js 0x10006053
push 7
xor eax, eax
pop ecx
mov edi, 0x10106dcc
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [0x10106e00], 1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
leave
ret 4
call fcn.100b9472
jmp 0x10006043
cmp dword [ecx], 1
jne 0x10006043
jmp 0x100117d3
mov esi, 0x100001
jmp 0x10006044
mov esi, 0x8ff00003
jmp 0x10006044
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10006053
cmp eax, 3
jbe 0x100117c9
cmp eax, 0x1f
je 0x100117c9
cmp eax, 0x7e
je 0x100117c9
cmp eax, 0xc1
je 0x100117c9
cmp eax, 0x3ee
je 0x100117c9
cmp eax, 0x485
jne 0x10006053
mov esi, 0x8ff00004
jmp 0x10006053
mov eax, dword [ecx + 0x14]
mov dword [0x10106e4c], eax
mov eax, dword [ecx + 0xc]
mov dword [0x10106544], eax
mov edi, dword [ecx + 0x10]
mov dword [0x10106548], edi
mov edx, dword [ecx + 4]
mov dword [0x10106dc4], edx
movzx ecx, word [ecx + 8]
jmp 0x10005fb0
mov dword [0x10106e2c], edi
jmp 0x10006053
Function at 0x100065f4
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR100.dll_memset
mov ecx, 0x10107420
add esp, 0xc
mov dword [ebp - 0x210], 0x208
xor esi, esi
mov eax, ecx
cmp dword [eax], 0
jne 0x10011856
imul esi, esi, 0x14
add esi, ecx
je 0x1000669e
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001186a
test esi, esi
je 0x1000669e
cmp dword [esi], 0
jne 0x1001198b
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0xc
add eax, 0x14
inc esi
cmp eax, 0x10107448
jge 0x1000669e
jmp 0x1000664b
cmp dword [ebp - 0x214], 1
jne 0x10006682
cmp word [ebp - 0x20c], ax
je 0x10006682
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x10006682
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x100118bb
add eax, eax
cmp eax, 0x208
jae 0x100118b6
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x100118c1
call fcn.100c49b4
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.100c5440
mov dword [esi], eax
test eax, eax
je 0x10006682
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10011998
push eax
call edi
test eax, eax
jne 0x100118ee
mov eax, dword [ebp + 0x10]
jmp 0x100118f0
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x10011914
push 0x100119b4
push dword [esi]
call edi
push 0x100119c0
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x100119d4
jmp 0x10011948
cmp eax, 2
jne 0x10011929
push 0x100119b4
push dword [esi]
call edi
push 0x100119e4
jmp 0x10011906
cmp eax, 3
jne 0x10011952
push 0x100119f8
push dword [esi]
call edi
push 0x10011a08
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x10011a20
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x10006682
cmp dword [esi + 0x10], 0
je 0x10006682
cmp dword [esi + 0xc], 0
je 0x10006682
push dword [0x10107448]
push esi
call fcn.1002c91a
test eax, eax
js 0x10006682
xor esi, esi
jmp 0x10006682
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000668f
Function at 0x10006cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x100d1fc8
call fcn.1000240f
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
and dword [ebx], 0
push ebx
push eax
mov dword [ebp - 0x18], eax
call fcn.10006d34
test al, al
jne 0x10011c45
mov ecx, esi
call fcn.10006bd5
test al, al
jne 0x10011c56
mov dword [ebp - 0x14], 4
test esi, esi
je 0x10006d30
lea eax, [esi + 4]
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push 0
push dword [ebp - 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006c72
call fcn.10002550
ret 0xc
xor eax, eax
jmp 0x10006d0d
test edi, edi
je 0x10011c4f
mov dword [edi], 4
xor eax, eax
jmp 0x10006d28
cmp byte [esi + 0x18], 0
je 0x10011c86
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.10043c9d
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10042b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.100424ca
push 2
pop eax
jmp 0x10006d28
Function at 0x1002bf6b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100f054c
call fcn.10001e61
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x1002bf94
cmp dword [0x10107738], edi
je 0x1002c07e
push 2
pop ebx
jmp 0x1002bfae
cmp edi, 1
jne 0x1002c07e
mov eax, ebx
call fcn.100cc816
test al, al
je 0x1002c07e
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.1002c0e2
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x1002c060
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1002bff5
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call fcn.100cc745
test eax, eax
je 0x1002c092
push 0x1c049f
push 0
call fcn.100bbd72
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x10106608], 0
push ebx
mov ecx, 0x10107740
call fcn.100cc0c3
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.1002c103
mov esi, eax
test esi, esi
je 0x1002bfe1
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.1002c8d7
inc edi
cmp edi, 2
jl 0x1002bf7c
mov eax, esi
call fcn.10001ea0
ret 0x18
push ebx
mov ecx, 0x10107740
call fcn.100038fb
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x1002c072
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x1002c0cd
cmp dword [ebp - 0x20], 3
jne 0x1002c0c8
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x1002c0c8
and cl, 0xf
cmp cl, 4
je 0x1002c0cd
push 2
pop esi
jmp 0x1002c072
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.1002c8d7
xor eax, eax
jmp 0x1002c08a

Function at 0x100352a8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]