joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100281c1
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov esi, ecx
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
call fcn.10019d2b
cmp dword [esi + 0x10], edi
jne 0x100281fe
push 0x1000204c
push 0x10001f48
mov edi, 0x80048481
push 0x167
jmp 0x100282de
push edi
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x100282fd
mov esi, dword [ebp - 4]
xor edi, edi
cmp esi, 0xa00000
jbe 0x10028254
push 0x1000204c
push 0x10001f48
push 0x173
mov esi, 0x8007000e
mov ecx, 0x100034e0
mov edi, esi
call fcn.1002d054
push eax
push esi
jmp 0x100282ea
shr esi, 1
mov ecx, ebx
dec esi
push esi
call fcn.10019ea4
push esi
mov ecx, ebx
mov dword [ebp - 8], eax
call fcn.10019ed1
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10028282
push 0x1000204c
push 0x10001f48
push 0x179
jmp 0x1002823c
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp - 0xc]
push 0
push dword [ebp + 8]
push dword [eax + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [ebx]
mov esi, eax
call fcn.10019f75
push eax
mov ecx, ebx
call fcn.10019ed1
test esi, esi
jne 0x100282fd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100282c4
movzx edi, di
or edi, 0x80070000
mov ecx, ebx
call fcn.10019d2b
test edi, edi
jns 0x100282fd
push 0x1000204c
push 0x10001f48
push 0x188
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push edi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002859f
Capabilities:
Receive http response

Disassembly:
mov eax, dword [ecx + 0x10]
push esi
test eax, eax
jne 0x100285bd
push 0x1000204c
push 0x10001f48
mov esi, 0x80048481
push 0x1e6
jmp 0x100285f3
xor esi, esi
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x10028612
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100285e2
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x10028612
push 0x1000204c
push 0x10001f48
push 0x1e9
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
mov eax, esi
pop esi
ret
Function at 0x10028616
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax + 0x10], 0
mov dword [ebp - 8], eax
jne 0x10028644
push 0x1000204c
push 0x10001f48
mov edi, 0x80048481
push 0x1f5
jmp 0x100286da
lea esi, [eax + 0x20]
push ecx
push dword [esi + 4]
mov ecx, esi
call fcn.10028ed8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1002865d
mov dword [ecx], eax
jmp 0x1002865f
mov dword [esi], eax
xor edi, edi
mov dword [esi + 4], eax
test eax, eax
je 0x100286f9
mov ebx, dword [ebp + 8]
lea edi, [eax + 8]
lea eax, [edi + 0xc]
mov dword [ebp - 4], eax
mov dword [eax], ebx
call fcn.1002707d
push ebx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov ecx, edi
mov esi, eax
call fcn.10026732
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
mov dword [edi], esi
mov dword [edi + 4], ebx
xor edi, edi
push esi
push dword [eax + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x100286f9
mov eax, dword [ebp - 4]
and dword [eax], edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100286c9
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x100286f9
push 0x1000204c
push 0x10001f48
push 0x202
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push edi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002a56f
Capabilities:
Initialize winhttp library

Disassembly:
push 0x18
mov eax, 0x10048107
call fcn.100472cf
xor ebx, ebx
mov ecx, 0x10003968
mov dword [ebp - 0x14], ebx
call fcn.1002d054
mov edx, 0x1000399c
mov dword [ebp - 0x24], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], edx
push ebx
push 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
call fcn.1002d079
add esp, 0x14
push ebx
push ebx
push ebx
push 4
push 0x100038e8
mov dword [ebp - 4], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
jne 0x1002a611
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002a5de
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x1002a611
push 0x1000204c
push 0x10001f48
push 0x5a
mov ecx, 0x10003968
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
jmp 0x1002a61c
mov ecx, 0x1004e0fc
xor eax, eax
lock cmpxchg dword [ecx], edi
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret 4
Function at 0x1002e144
Capabilities:
Delete registry value

Disassembly:
push 0x14
mov eax, 0x10047ea8
call fcn.100472cf
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ecx, 0x100047d0
mov dword [ebp - 0x10], ebx
call fcn.1002d054
mov edx, 0x100048e4
mov dword [ebp - 0x20], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], edx
push ebx
push 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
call fcn.1002d079
add esp, 0x14
mov dword [ebp - 4], ebx
test edi, edi
je 0x1002e1c5
test esi, esi
je 0x1002e1c5
push esi
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x1002e1fa
jle 0x1002e1ad
movzx esi, si
or esi, 0xc0070000
mov dword [ebp - 0x10], esi
test esi, esi
jns 0x1002e1fa
push 0x1000204c
push 0x10002570
push 0x177
jmp 0x1002e1dc
push 0x1000204c
mov esi, 0xc000000d
push 0x10002570
mov dword [ebp - 0x10], esi
push 0x16e
mov ecx, 0x100047d0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret

Function at 0x1002e556
Capabilities:
Set registry value

Disassembly:
push 0x14
mov eax, 0x10047ea8
call fcn.100472cf
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov ecx, 0x100047d0
mov dword [ebp - 0x10], ebx
call fcn.1002d054
mov edx, 0x1000496c
mov dword [ebp - 0x20], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], edx
push ebx
push 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
call fcn.1002d079
add esp, 0x14
mov dword [ebp - 4], ebx
test esi, esi
jne 0x1002e5bb
push 0x1000204c
mov esi, 0xc000000d
push 0x10002570
mov dword [ebp - 0x10], esi
push 0x25c
jmp 0x1002e5f3
push 8
lea eax, [ebp + 8]
push eax
push 0xb
push ebx
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1002e611
jle 0x1002e5dd
movzx esi, si
or esi, 0xc0070000
mov dword [ebp - 0x10], esi
test esi, esi
jns 0x1002e611
push 0x1000204c
push 0x10002570
push 0x269
mov ecx, 0x100047d0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret 8
Function at 0x1002e769
Capabilities:
Set registry value

Disassembly:
push 0x18
mov eax, 0x10048107
call fcn.100472cf
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov ecx, 0x100047d0
mov dword [ebp - 0x14], ebx
call fcn.1002d054
mov edx, 0x100049ac
mov dword [ebp - 0x24], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], edx
push ebx
push 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
call fcn.1002d079
add esp, 0x14
mov dword [ebp - 4], ebx
test esi, esi
jne 0x1002e7ce
push 0x1000204c
mov esi, 0xc000000d
push 0x10002570
mov dword [ebp - 0x14], esi
push 0x2b1
jmp 0x1002e806
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1002e824
jle 0x1002e7f0
movzx esi, si
or esi, 0xc0070000
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x1002e824
push 0x1000204c
push 0x10002570
push 0x2be
mov ecx, 0x100047d0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret 4
Function at 0x1002eb1e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
push esi
push edi
test ecx, ecx
je 0x1002ec45
cmp dword [ebp + 8], ebx
je 0x1002ec45
sub esp, 0x10
lea esi, [ebp + 0x14]
mov edi, esp
lea eax, [ebp - 8]
xor dl, dl
push eax
movsd dword es:[edi], dword [esi]
push 0x20019
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1002e839
mov edi, dword [ebp - 8]
mov esi, eax
test esi, esi
jns 0x1002eb7e
push 0x1000204c
push 0x10002570
push 0x329
jmp 0x1002ec1a
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 6
push 0x100047a4
push ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x1002ebbe
jg 0x1002eba0
mov esi, eax
jmp 0x1002eba9
movzx esi, ax
or esi, 0xc0070000
test esi, esi
jns 0x1002ebbe
push 0x1000204c
push 0x10002570
push 0x336
jmp 0x1002ec1a
cmp dword [ebp - 4], 0x15
jbe 0x1002ebda
push 0x1000204c
push 0x10002570
mov esi, 0x80000005
push 0x33b
jmp 0x1002ec1a
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 6
push 0x100047a4
push ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x1002ec38
jg 0x1002ebfe
mov esi, eax
jmp 0x1002ec07
movzx esi, ax
or esi, 0xc0070000
test esi, esi
jns 0x1002ec38
push 0x1000204c
push 0x10002570
push 0x349
mov ecx, 0x100047d0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
test edi, edi
je 0x1002ec77
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1002ec77
push 0x1000204c
push 0x10002570
push 0x321
mov ecx, 0x100047d0
mov esi, 0xc000000d
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1002f950
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x1c
mov eax, 0x1004809f
call fcn.100472cf
mov edi, ecx
xor ebx, ebx
mov ecx, 0x10004d3c
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.1002d054
mov edx, 0x10004d24
mov dword [ebp - 0x28], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], edx
push ebx
push 4
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
call fcn.1002d079
add esp, 0x14
mov dword [ebp - 4], ebx
test edi, edi
je 0x1002f9a6
mov ecx, edi
call fcn.1003007f
jmp 0x1002f9a8
mov al, bl
test al, al
jne 0x1002f9c2
push 0x1000204c
mov esi, 0x80070057
push 0x10001f48
mov dword [ebp - 0x14], esi
push 0x2c
jmp 0x1002fa3d
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptAcquireContextW]
test eax, eax
jne 0x1002fa03
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002f9ee
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x1002fa03
push 0x1000204c
push 0x10001f48
push 0x31
jmp 0x1002fa3d
push dword [edi + 4]
push dword [edi]
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptGenRandom]
test eax, eax
jne 0x1002fa5b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002fa2a
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x1002fa5b
push 0x1000204c
push 0x10001f48
push 0x36
mov ecx, 0x10004d3c
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push ebx
push 2
call fcn.1002d079
add esp, 0x24
cmp dword [ebp - 0x18], 0
je 0x1002fa6b
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptReleaseContext]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret
Function at 0x100314f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov esi, edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
jne 0x10031535
push 0x10005d54
push 0x10005d60
push 0x10005488
call fcn.1003511d
add esp, 0xc
push 0x57
pop eax
jmp 0x100315ad
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 2
jne 0x1003156e
test esi, esi
jne 0x1003155b
mov esi, 0x10005864
push 2
push ebx
push esi
push dword [ebp + 8]
push 0x10005d60
push 0x10005d88
jmp 0x10031599
cmp edi, 0xea
je 0x10031580
test edi, edi
jne 0x100315b4
cmp dword [ebp - 4], 4
je 0x100315a3
test esi, esi
jne 0x10031589
mov esi, 0x10005864
push edi
push ebx
push esi
push dword [ebp + 8]
push 0x10005d60
push 0x10005e48
call fcn.10035105
add esp, 0x18
xor edi, edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
push esi
push dword [ebp + 8]
mov edx, 0x10005f14
mov ecx, edi
call fcn.1003551e
test esi, esi
jne 0x100315cd
mov esi, 0x10005864
push edi
push esi
push dword [ebp + 8]
push 0x10005d60
push 0x10005f38
call fcn.10035105
add esp, 0x14
jmp 0x100315a3

Function at 0x100316a5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], 8
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
test edi, edi
jne 0x100316e5
push 0x10005d54
push 0x1000612c
push 0x10005488
call fcn.1003511d
add esp, 0xc
push 0x57
pop eax
jmp 0x1003175f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0xffff
push 0x1000a824
push edx
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
cmp esi, 2
jne 0x10031721
push eax
push ebx
push ebx
push 0x1000a824
push dword [ebp + 0xc]
push 0x1000612c
push 0x10006150
jmp 0x10031748
cmp esi, 0xea
je 0x10031733
test esi, esi
jne 0x10031766
cmp dword [ebp - 4], 0xb
je 0x10031752
push esi
push ebx
push ebx
push 0x1000a824
push dword [ebp + 0xc]
push 0x1000612c
push 0x10006218
call fcn.10035105
mov esi, ebx
add esp, 0x1c
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
mov ebx, 0x1000a824
mov edx, 0x100062e8
push ebx
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1003551e
push esi
push ebx
push dword [ebp + 0xc]
push 0x1000612c
push 0x10005f38
call fcn.10035105
add esp, 0x14
jmp 0x10031752
Function at 0x10031794
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, edx
push esi
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x100317d5
push 0x10005d54
push 0x10006304
push 0x10005488
call fcn.1003511d
add esp, 0xc
push 0x57
pop eax
jmp 0x100318e4
lea edx, [ebp - 4]
mov dword [ebx], esi
push edx
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 2
push esi
push eax
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
cmp edi, 2
jne 0x10031824
xor ebx, ebx
test esi, esi
je 0x10031800
cmp word [esi], bx
jne 0x10031805
mov esi, 0x10005874
push 2
push esi
push dword [ebp + 0xc]
push 0x10006304
push 0x10006330
call fcn.10035105
add esp, 0x14
mov edi, ebx
jmp 0x100318e2
cmp edi, 0x65e
jne 0x1003184e
xor ebx, ebx
test esi, esi
je 0x10031837
cmp word [esi], bx
jne 0x1003183c
mov esi, 0x10005874
push 2
push esi
push dword [ebp + 0xc]
push 0x10006304
push 0x100063f8
jmp 0x10031815
test edi, edi
je 0x1003185a
cmp edi, 0xea
jne 0x1003189c
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1003189c
call fcn.10030bb0
mov dword [ebx], eax
test eax, eax
je 0x10031888
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 2
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
jmp 0x1003189c
push 0xe
pop edi
push 0x10006304
push 0x10005518
call fcn.10035135
pop ecx
pop ecx
test edi, edi
je 0x100318e2
push esi
push dword [ebp + 0xc]
mov edx, 0x100062e8
mov ecx, edi
call fcn.1003551e
test esi, esi
je 0x100318bb
xor eax, eax
cmp word [esi], ax
jne 0x100318c0
mov esi, 0x10005874
push edi
push esi
push dword [ebp + 0xc]
push 0x10006304
push 0x10005f38
call fcn.10035105
mov ecx, dword [ebx]
add esp, 0x14
call fcn.10030bc3
xor eax, eax
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1003196d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
mov ebx, ecx
push edi
mov edi, edx
test esi, esi
je 0x100319b0
push 0x7fffffff
push esi
call dword [sym.imp.msvcrt.dll_wcsnlen]
pop ecx
pop ecx
cmp eax, 0x7fffffff
jne 0x100319af
push 0x100065c8
push 0x100065f0
call fcn.10035105
pop ecx
pop ecx
mov edi, 0x6cf
jmp 0x100319ff
inc eax
add eax, eax
push eax
push esi
mov esi, dword [ebp + 8]
push 1
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov edi, eax
test edi, edi
je 0x100319ff
push esi
push dword [ebp + 0xc]
mov edx, 0x100064e0
mov ecx, edi
call fcn.1003551e
test esi, esi
je 0x100319e3
xor eax, eax
cmp word [esi], ax
jne 0x100319e8
mov esi, 0x10005874
push edi
push esi
push dword [ebp + 0xc]
push 0x100065c8
push 0x10006528
call fcn.1003511d
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100392c7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ecx + 0x10], 0
push esi
push edi
je 0x1003932c
mov esi, dword [ecx]
test esi, esi
je 0x1003932c
xor edi, edi
cmp word [esi], di
je 0x1003932c
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x100392fa
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, eax
push esi
call fcn.100385a7
jmp 0x10039340
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
push dword [ecx + 0xc]
push dword [ecx + 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0x10039328
mov ecx, dword [ebp + 8]
mov edx, esi
push eax
call fcn.100318eb
mov edi, eax
mov eax, edi
jmp 0x10039340
push 0x1000a704
push 0x1000c790
call fcn.1003511d
pop ecx
pop ecx
push 0x57
pop eax
pop edi
pop esi
leave
ret 8

Function at 0x1003939a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x10], 0
push esi
push edi
je 0x10039406
mov esi, dword [ecx]
test esi, esi
je 0x10039406
xor edi, edi
cmp word [esi], di
je 0x10039406
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x100393ce
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push esi
call fcn.100385e4
jmp 0x1003941a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push 8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xb
push 0x1000a824
push dword [ecx + 0xc]
push dword [ecx + 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0x10039402
mov edx, eax
mov ecx, esi
call fcn.10031936
mov edi, eax
mov eax, edi
jmp 0x1003941a
push 0x1000a840
push 0x1000c790
call fcn.1003511d
pop ecx
pop ecx
push 0x57
pop eax
pop edi
pop esi
leave
ret 0xc

Function at 0x1004097f
Capabilities:
Initialize winhttp library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov byte [ebp - 1], 1
push edi
lea edx, [ebp - 1]
mov ecx, 0x10014fcc
call fcn.1004627a
test eax, eax
jns 0x100409b7
push eax
push 0x10014fac
push 0x10014ff4
push 0x100054c8
call fcn.1003511d
add esp, 0x10
movzx edi, byte [ebp - 1]
mov dword [esi + 8], edi
neg edi
push 0x10000000
sbb edi, edi
xor ebx, ebx
push ebx
push ebx
and edi, 4
push edi
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 4], eax
test eax, eax
jne 0x10040a14
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov edx, edi
push esi
sub esp, 0xc
call fcn.100356ee
push esi
push 0x1000fb8c
push 0x10012170
call fcn.1003511d
add esp, 0xc
test esi, esi
jle 0x10040a10
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x10040a31
push 0x10000000
push ebx
push ebx
push edi
push ebx
push 0x1000fb8c
push 0x100121d0
call fcn.100350d6
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10041563
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [eax], esi
mov ebx, esi
mov eax, dword [ebp + 8]
sub eax, 0xffff
mov dword [ebp - 4], esi
push edi
neg eax
push esi
sbb eax, eax
push edx
not eax
and eax, dword [ebp + 0xc]
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ecx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x100415e2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
cmp edi, 0x7a
je 0x100415e2
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
call fcn.1003582e
test edi, edi
je 0x100415e2
push edi
push 0x10012d00
push 0x10012d28
push 0x10005980
call fcn.1003511d
add esp, 0x10
jmp 0x10041666
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004705a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1004161a
push 0x10012d28
push 0x10005518
mov esi, 0x8007000e
call fcn.10035135
pop ecx
jmp 0x10041684
push esi
lea eax, [ebp - 4]
mov edi, esi
push eax
mov eax, dword [ebp - 0xc]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x10041654
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov edi, eax
mov ecx, dword [ebp + 8]
push edi
call fcn.1003582e
test edi, edi
jne 0x100415c5
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2], cx
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov ebx, esi
test edi, edi
je 0x10041679
jg 0x10041670
mov esi, edi
jmp 0x10041679
movzx esi, di
or esi, 0x80070000
test ebx, ebx
je 0x10041685
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push esi
push 0x10012d28
push 0x10005690
call fcn.100350d6
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc