joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402bff
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c93
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402c50
cmp dword [ebp + 0x10], ebx
jne 0x402c87
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402bff
test eax, eax
jne 0x402c62
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402c37
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406558
cmp eax, ebx
je 0x402c9a
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c93
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402c90
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c90
jmp 0x402c93

Function at 0x4030e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x403112
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004031ef
cmp eax, esi
jl 0x4031e9
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.004031ef
mov ebx, eax
cmp ebx, esi
jl 0x4031e7
cmp dword [ebp + 0x10], esi
jne 0x4031b5
cmp dword [ebp + 8], esi
jle 0x4031e7
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403177
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405e05
test eax, eax
je 0x4031b1
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x403166
jmp 0x4031e7
push 0xfffffffffffffffe
jmp 0x4031db
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4031c0
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4031de
push 0xfffffffffffffffd
pop eax
jmp 0x4031e9
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4064e8
Capabilities:
Access peb ldr_data

Disassembly:
pushal
mov ebp, esp
add ebp, 0x24
push esp
call fcn.00404349
push eax
push esi
jg 0x406574
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40650d
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00404349
push ebx
cli
pop dword [eax - 0x75]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00404349
in al, dx
mov ch, 0x15
sub dword [ecx - 0x75], ecx
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x406536
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x406536
call fcn.00404349
call 0x8bdda384
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc
Function at 0x405073
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x47d084]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.004052e3
mov ebx, eax
cmp ebx, esi
je 0x4050d5
cmp dword [esp + 0x10], esi
je 0x4050d1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40514b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4050f3
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00405073
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x405162
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x4050dd
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
je 0x40512e
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00405005
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x405149
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00411527
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x405172
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x40514b
Function at 0x407d4d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x459e39
call fcn.00453643
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x407da5
call fcn.00406b2a
mov esi, eax
jmp 0x407eaf
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x407dbe
call fcn.00406b2a
jmp 0x407ea1
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x407db4
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x407dfb
mov esi, 0x8007000e
jmp 0x407ea3
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x407e10
cmp eax, 0xffffffff
jbe 0x407e1a
push 0x80070216
call fcn.0040590f
cmp eax, 0x400
jbe 0x407e47
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00406b07
jmp 0x407e53
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x407df1
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x407db4
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.00407bed
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x407ec8
lea eax, [ebp - 0x418]
call fcn.00406fa0
mov eax, esi
call fcn.0045369f
ret 0xc
Function at 0x40b5bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b621
cmp dword [ebp + 0xc], 1
je 0x40b5f9
cmp dword [ebp + 0xc], 2
je 0x40b5f9
push 0xd
pop eax
jmp 0x40b621
mov eax, dword [ebp - 4]
test edi, edi
je 0x40b61b
test eax, eax
je 0x40b616
test al, 1
jne 0x40b5f4
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40b61b
jmp 0x40b5f4
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x4111fa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47f100], 0
push esi
push edi
jne 0x411170
call fcn.004110dc
test eax, eax
je 0x4111b5
mov eax, dword [0x47f100]
cmp eax, 1
jne 0x411191
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4111b5
jmp 0x4111f7
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4111f7
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4111b9
xor eax, eax
jmp 0x4111f7
mov eax, dword [esi]
push dword [0x47f100]
call edi
mov edi, eax
test edi, edi
je 0x4111db
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4111f7
lea edi, [esi + 0xff0]
push esi
push dword [0x47f100]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4111e1
mov eax, esi
pop edi
pop esi
ret
jmp 0x41115c

Function at 0x411527
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47d084]
jne 0x411531
repz ret
jmp fcn.004147d2
Function at 0x41eecb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47d084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041793a
and dword [ebp - 0x14], 0
cmp dword [0x47ff44], 0
mov dword [ebp - 0x18], eax
jne 0x41ef7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41f026
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45cca4
push ebx
call edi
test eax, eax
je 0x41f026
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47ff44], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47ff48], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47ff4c], eax
call edi
push eax
call esi
mov dword [0x47ff54], eax
test eax, eax
je 0x41ef7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47ff50], eax
mov eax, dword [0x47ff50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41efd7
cmp dword [0x47ff54], ecx
je 0x41efd7
push eax
call esi
push dword [0x47ff54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41efd7
test ebx, ebx
je 0x41efd7
call edi
test eax, eax
je 0x41efce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41efce
test byte [ebp - 8], 1
jne 0x41efd7
or dword [ebp + 0x10], 0x200000
jmp 0x41f00a
mov eax, dword [0x47ff48]
cmp eax, dword [ebp - 0x18]
je 0x41f00a
push eax
call esi
test eax, eax
je 0x41f00a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41f00a
mov eax, dword [0x47ff4c]
cmp eax, dword [ebp - 0x18]
je 0x41f00a
push eax
call esi
test eax, eax
je 0x41f00a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47ff44]
call esi
test eax, eax
je 0x41f026
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41f028
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411527
leave
ret
Function at 0x43c573
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x43c583
mov eax, dword [esi]
jmp 0x43c585
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c594
xor al, al
jmp 0x43c5bf
test bl, 3
jne 0x43c59d
mov al, 1
jmp 0x43c5bf
cmp dword [esi + 0x14], 8
jb 0x43c5a5
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43c5b5
and ebx, 2
jmp 0x43c5b8
and ebx, 1
xor eax, eax
test ebx, ebx
setne al
pop esi
pop ebx
ret
Function at 0x43fdb6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x28
add dword [ebp - 4], 0x62
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
imul ecx, eax
mov eax, dword [ebp - 4]
cdq
push esi
push 0x54
pop esi
idiv esi
push 0x2c
add ecx, eax
mov eax, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x11
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cdq
pop ecx
idiv ecx
push 0x34
pop ecx
cdq
idiv ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul eax, eax, 0x3d
sub ecx, eax
mov eax, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
imul eax, eax, 9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x59
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
pop esi
leave
ret

Function at 0x43fead
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x3e
push 0x4d
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x5c
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x1d
mov eax, dword [ebp - 0xc]
imul eax, eax, 7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
imul eax, ecx
mov ecx, dword [ebp - 8]
sub eax, ecx
mov ecx, dword [ebp - 0x14]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
sub eax, ecx
sub eax, 0x62
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
add eax, 0x2b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x14]
sub ecx, eax
push dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
push dword [ebp + 0xc]
lea eax, [ecx + eax + 0x5b]
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret 0x10

Function at 0x443264
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5a4d
sub esp, 0x14
cmp word [edx], ax
je 0x443278
xor eax, eax
leave
ret
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
jne 0x443274
cmp dword [eax + edx + 0x98], 0
je 0x443274
mov dword [ebp - 0x14], 0x3e
push esi
push 0x4d
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0x5c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x1d
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 7
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
sub ecx, esi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul ecx, esi
mov esi, dword [ebp - 8]
sub ecx, esi
mov esi, dword [ebp - 0x14]
sub ecx, esi
mov esi, dword [ebp - 0x10]
sub ecx, esi
sub ecx, 0x62
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x2b
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
sub esi, ecx
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov eax, dword [eax + edx + 0x98]
lea ecx, [esi + ecx + 0x5b]
mov dword [ebp - 0x14], ecx
add eax, edx
pop esi
leave
ret
Function at 0x13051be0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x1310643c]
test eax, eax
jne 0x13051c5b
mov dword [0x1310643c], 1
call fcn.130728f0
test eax, eax
je 0x13051c4b
push 0
push 0x104
push 0x13106440
call fcn.13075cf0
add esp, 0xc
test eax, eax
je 0x13051c5b
push esi
push edi
mov edi, 0x130f12f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x13106440
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x13106440
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x13106440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x13106440
ret

Function at 0x13052de0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x13052e18
lea ecx, [esp + 4]
push ecx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13052e52
mov esi, dword [esp + 0x14]
test esi, esi
je 0x13052e2f
push esi
call fcn.130822a3
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x13052e31
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x13052e60
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x13052e98
lea ecx, [esp + 4]
push ecx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13052ebe
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc
Function at 0x13052ed0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push 0x80000002
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x13052f0d
lea ecx, [esp + 8]
push ecx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13052f8d
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x13052f77
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.13082436
mov esi, eax
add esp, 4
test esi, esi
je 0x13052f77
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8

Function at 0x13052fa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push 0x80000002
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x13052fd9
lea ecx, [esp + 8]
push ecx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x13053056
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
test eax, eax
jne 0x13053040
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0x13053040
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.13082436
mov esi, eax
add esp, 4
test esi, esi
je 0x13053040
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push esi
push eax
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
Function at 0x13053060
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push esi
push 0x80000002
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x130530a2
lea ecx, [esp + 4]
push ecx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x130530de
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
pop esi
add esp, 0xc
ret 8

Function at 0x130543d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jne 0x130543e7
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
xor edx, edx
mov edi, dword [eax + 8]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
mov ecx, dword [eax + edi + 0x1c]
add eax, edi
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ecx, edi
add eax, edi
cmp ebx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
jbe 0x13054496
mov dword [ebp - 4], ecx
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
add eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x1305445f
test cl, cl
je 0x1305445b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x1305445f
add eax, 2
add esi, 2
test cl, cl
jne 0x1305443b
xor eax, eax
jmp 0x13054464
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x13054485
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
add ecx, 4
cmp edx, eax
mov dword [ebp - 4], ecx
jb 0x13054434
mov esi, dword [ebp - 0xc]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [ecx + edx*2]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + eax*4]
add esi, edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret