joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e0c10
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024b9c8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
jne 0x101e0c4b
mov esi, dword [ebx]
mov ecx, edi
call fcn.101ddb10
push eax
mov ecx, ebx
call dword [esi + 0x90]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call fcn.101dde80
push eax
mov ecx, edi
call fcn.101ddaa0
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x101e0cc7
call esi
cmp eax, 0x2714
je 0x101e0c51
call esi
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x24]
push eax
call fcn.101ddfe0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.101e0fb0
mov edx, dword [ebp - 0x10]
add esp, 8
cmp edx, 0x10
jb 0x101e0cc7
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x101e0cbd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101e0cda
push edx
push ecx
call fcn.101e74c0
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.102086be
int3

Function at 0x101e0ce0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024c1e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
cmp dword [edi + 8], 0xffffffff
jne 0x101e0d21
mov esi, dword [edi]
mov ecx, ebx
call fcn.101ddb10
push eax
mov ecx, edi
call dword [esi + 0x90]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x84]
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.101dde80
mov ecx, ebx
mov esi, eax
call fcn.101ddaa0
push esi
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x101e0db6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x101e0d90
cmp esi, 0x2733
je 0x101e0d90
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.101ddfe0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.101e0fb0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100087cd
mov eax, dword [edi]
mov ecx, edi
push 7
push dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x101e0df2
mov ecx, edi
call fcn.101e20e0
test eax, eax
je 0x101e0db6
push eax
call fcn.101e0f20
add esp, 4
mov eax, dword [edi]
mov ecx, edi
push 1
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x84]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.connect_timed_out
lea ecx, [ebp - 0x44]
call fcn.100087d2
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.101ddfe0
push 0
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.101e3040
push 0x102c36a0
lea eax, [ebp - 0x88]
push eax
call fcn.101feab4
int3
Function at 0x101e0e40
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024b9c8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0xffffffff
jne 0x101e0e7b
mov esi, dword [edi]
mov ecx, ebx
call fcn.101ddb10
push eax
mov ecx, edi
call dword [esi + 0x90]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x84]
mov ecx, ebx
call fcn.101dde80
push eax
mov ecx, ebx
call fcn.101ddaa0
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x101e0ee0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x101e0ee0
cmp esi, 0x2733
je 0x101e0ee0
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.101ddfe0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.101e0fb0
add esp, 8
lea ecx, [ebp - 0x24]
call fcn.100087cd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x101e18e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024c320
push eax
mov dword fs:[0], esp
sub esp, 0x360
push ebx
push esi
mov esi, dword [ecx + 8]
push edi
cmp esi, 0xffffffff
je 0x101e1a92
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x164], 0
test al, 1
je 0x101e1942
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x36c], 1
test al, 2
je 0x101e1956
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], 1
test al, 4
je 0x101e196a
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x164], 1
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.101e41c0
lea eax, [esi + 1]
xor ebx, ebx
mov dword [ebp + 0xc], eax
nop dword [eax]
push dword [0x10252c0c]
mov esi, dword [ebp - 0x10]
push dword [0x10252c08]
mov edi, dword [ebp - 0x14]
push esi
push edi
call fcn.101e7a90
push 0
push 0xf4240
push esi
push edi
mov dword [ebp - 0x34], eax
call fcn.101e7a90
imul eax, eax, 0xf4240
lea ecx, [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 0x30], edi
call fcn.101e4170
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x36c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x101e1a52
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2714
jne 0x101e1a52
lea ecx, [ebp - 0x24]
call fcn.101e4170
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10086740
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jg 0x101e1a3e
jl 0x101e1a30
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x101e1a3e
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.101e41e0
jmp 0x101e1a4a
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.10086740
lea ecx, [ebp - 0x24]
call fcn.10005500
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10005500
test esi, esi
jns 0x101e1a7c
cmp ebx, 0x2714
je 0x101e1980
push ebx
call fcn.101e0f20
add esp, 4
test esi, esi
mov ecx, dword [ebp - 0xc]
setg al
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0
lea ecx, [ebp - 0x60]
call fcn.101dc680
push 0x102c2cc4
lea eax, [ebp - 0x60]
push eax
call fcn.101feab4
int3
Function at 0x101e1ab0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x101e1adb
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
or eax, dword [ecx + 4]
je 0x101e1adb
mov eax, dword [esi]
push 1
push ecx
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x101e1b6c
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x101e1b52
push ebp
push dword [esp + 0x48]
push dword [esp + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp byte [esi + 0x20], 0
mov edi, eax
je 0x101e1b15
test edi, edi
jns 0x101e1b46
call ebx
cmp eax, 0x2714
je 0x101e1ae8
test edi, edi
jns 0x101e1b46
call ebx
cmp eax, 0x2733
jne 0x101e1b2a
cmp byte [esi + 0x20], 0
jne 0x101e1b86
jmp 0x101e1b46
cmp eax, 0x274c
je 0x101e1b86
push eax
call fcn.101e0f20
add esp, 4
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2c
ret 0xc
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2c
ret 0xc
push 0
lea ecx, [esp + 0x14]
call fcn.101dc680
push 0x102c2cc4
lea eax, [esp + 0x14]
push eax
call fcn.101feab4
push 0
lea ecx, [esp + 8]
call fcn.101e3070
push 0x102c36a0
lea eax, [esp + 8]
push eax
call fcn.101feab4
push eax
lea ecx, [esp + 0x14]
call fcn.101e3070
push 0x102c36a0
lea eax, [esp + 0x14]
push eax
call fcn.101feab4
int3
Function at 0x101e1ba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024c338
push eax
mov dword fs:[0], esp
sub esp, 0xdc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x21], 0
je 0x101e1be8
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
or eax, dword [ecx + 4]
je 0x101e1be8
mov eax, dword [esi]
push 1
push ecx
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x101e1cba
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], 0x80
nop word [eax + eax]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x101e1ca2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp byte [esi + 0x20], 0
mov edi, eax
je 0x101e1c3c
test edi, edi
jns 0x101e1c40
call ebx
cmp eax, 0x2714
je 0x101e1c00
test edi, edi
js 0x101e1c6c
push dword [ebp - 0x10]
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp + 0x14]
call fcn.101dd7e0
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.101dd980
lea ecx, [ebp + 0x14]
call fcn.101dd130
jmp 0x101e1c8d
call ebx
cmp eax, 0x2733
jne 0x101e1c7d
cmp byte [esi + 0x20], 0
jne 0x101e1cd2
jmp 0x101e1c8d
cmp eax, 0x274c
je 0x101e1cd2
push eax
call fcn.101e0f20
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push 0
lea ecx, [ebp - 0x3c]
call fcn.101dc680
push 0x102c2cc4
lea eax, [ebp - 0x3c]
push eax
call fcn.101feab4
push 0
lea ecx, [ebp - 0x3c]
call fcn.101e3070
push 0x102c36a0
lea eax, [ebp - 0x3c]
push eax
call fcn.101feab4
push eax
lea ecx, [ebp - 0x68]
call fcn.101e3070
push 0x102c36a0
lea eax, [ebp - 0x68]
push eax
call fcn.101feab4
int3

Function at 0x101e1cf0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x101e1d17
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x18]
or eax, dword [ecx + 4]
je 0x101e1d17
mov eax, dword [esi]
push 2
push ecx
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x101e1d80
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x101e1d66
push ebp
push dword [esp + 0x48]
push dword [esp + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp byte [esi + 0x20], 0
mov edi, eax
je 0x101e1d51
test edi, edi
jns 0x101e1d5a
call ebx
cmp eax, 0x2714
je 0x101e1d24
test edi, edi
jns 0x101e1d5a
call fcn.101e1580
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x2c
ret 0xc
push 0
lea ecx, [esp + 0x14]
call fcn.101dc680
push 0x102c2cc4
lea eax, [esp + 0x14]
push eax
call fcn.101feab4
push 0
lea ecx, [esp + 8]
call fcn.101e3070
push 0x102c36a0
lea eax, [esp + 8]
push eax
call fcn.101feab4
int3
Function at 0x101e1da0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0xffffffff
je 0x101e1e08
mov ecx, ebp
call fcn.101dde80
push eax
mov ecx, ebp
call fcn.101ddaa0
push eax
push dword [esp + 0x54]
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
cmp byte [edi + 0x20], 0
mov esi, eax
je 0x101e1df3
test esi, esi
jns 0x101e1dfc
call ebx
cmp eax, 0x2714
je 0x101e1db3
test esi, esi
jns 0x101e1dfc
call fcn.101e1580
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
push 0
lea ecx, [esp + 0x14]
call fcn.101dc680
push 0x102c2cc4
lea eax, [esp + 0x14]
push eax
call fcn.101feab4
int3

Function at 0x101e1e30
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 0x2c
cmp eax, 0xffffffff
je 0x101e1e5a
push 1
push 1
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x101e1e54
call fcn.101e1580
add esp, 0x2c
ret 4
push 0
lea ecx, [esp + 4]
call fcn.101dc680
push 0x102c2cc4
lea eax, [esp + 4]
push eax
call fcn.101feab4
int3

Function at 0x101e1ed0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 0x2c
cmp eax, 0xffffffff
je 0x101e1f02
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x101e1efc
call fcn.101e1580
add esp, 0x2c
ret 0x10
push 0
lea ecx, [esp + 4]
call fcn.101dc680
push 0x102c2cc4
lea eax, [esp + 4]
push eax
call fcn.101feab4
int3

Function at 0x101ea682
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1021caf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1021c972

Function at 0x1022253e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.102221fe

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x101f78a
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp ecx, 2
jbe 0x101f7a3
add ecx, 0xfffffffe
and eax, 0xff
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, 2
push eax
call fcn.01023ea2
add esp, 0xc
xor eax, eax
pop ebp
ret 4

Function at 0x101f8d2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102837c]
test eax, eax
jne 0x101f921
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.01023ea2
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x101f913
cmp dword [ebp - 0x318], 2
jne 0x101f909
cmp dword [ebp - 0x324], 6
jae 0x101f909
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x1028380]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x101f913
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.01025656
mov dword [0x102837c], eax
cmp eax, dword [0x1028380]
jne 0x101f913
push eax
call fcn.01025505
jmp 0x101f913
mov eax, dword [0x1028380]
mov dword [0x102837c], eax
mov eax, dword [0x102837c]
test eax, eax
jne 0x101f921
mov eax, dword [0x1028380]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01023ead
leave
ret

Function at 0x101fb24
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push 4
pop ebx
push ebx
push esi
push esi
push esi
push 0x1001490
push 0x80000001
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x101fbb0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001478
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x101fba7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
mov edi, 0x1001460
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 4], 0x100000
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.0101f845
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101fe12
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x100
push esi
push edi
je 0x101fee5
push eax
push 0x7fffffff
push dword [ebp + 8]
mov ecx, edx
call fcn.0101f74a
test eax, eax
jl 0x101fe48
test edx, edx
jne 0x101ff00
and dword [ebp - 4], 0
mov esi, eax
test eax, eax
jl 0x101fedd
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebx
sub edi, eax
xor esi, esi
lea ebx, [ecx + eax*2]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
cmp dword [ebp - 8], esi
je 0x101fe7e
cmp dword [ebp + 0x10], esi
jne 0x101fe7e
mov dword [ebp + 0x10], 0x1001420
test dword [ebp + 0x1c], 0xffffe000
je 0x101ff10
mov esi, 0x80070057
test dword [ebp + 0x1c], 0x1c00
je 0x101febe
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101febe
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
add eax, eax
push eax
lea ebx, [ebp - 0x10]
call fcn.0101f7ae
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
test esi, esi
jge 0x101feca
cmp esi, 0x8007007a
jne 0x101fedc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101fed3
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x101fedc
mov dword [eax], edi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
xor eax, eax
test edx, edx
je 0x101fef3
cmp edx, 0x7fffffff
jbe 0x101fef8
mov eax, 0x80070057
test eax, eax
jl 0x101fe48
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
call fcn.0101f6f5
jmp 0x101fe4c
cmp edi, 1
ja 0x101ff31
mov eax, dword [ebp + 0x10]
cmp word [eax], si
je 0x101feca
mov esi, ecx
neg esi
sbb esi, esi
and esi, 0x23
add esi, 0x80070057
jmp 0x101fe90
push 0x7ffffffe
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
mov edx, edi
mov ecx, ebx
mov dword [ebp - 0x10], esi
call fcn.01020a69
mov esi, eax
mov eax, dword [ebp - 0x10]
sub edi, eax
lea ebx, [ebx + eax*2]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
test esi, esi
jl 0x101fe90
mov eax, dword [ebp + 0x1c]
test eax, 0x200
je 0x101feca
cmp edi, 1
jbe 0x101feca
lea ecx, [edi + edi]
push ebx
call fcn.0101f780
jmp 0x101feca
Function at 0x101fee9
Capabilities:
Check os version
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x100
push esi
push edi
je 0x101fee5
push eax
push 0x7fffffff
push dword [ebp + 8]
mov ecx, edx
call fcn.0101f74a
test eax, eax
jl 0x101fe48
test edx, edx
jne 0x101ff00
and dword [ebp - 4], 0
mov esi, eax
test eax, eax
jl 0x101fedd
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebx
sub edi, eax
xor esi, esi
lea ebx, [ecx + eax*2]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
cmp dword [ebp - 8], esi
je 0x101fe7e
cmp dword [ebp + 0x10], esi
jne 0x101fe7e
mov dword [ebp + 0x10], 0x1001420
test dword [ebp + 0x1c], 0xffffe000
je 0x101ff10
mov esi, 0x80070057
test dword [ebp + 0x1c], 0x1c00
je 0x101febe
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101febe
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
add eax, eax
push eax
lea ebx, [ebp - 0x10]
call fcn.0101f7ae
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
test esi, esi
jge 0x101feca
cmp esi, 0x8007007a
jne 0x101fedc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101fed3
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x101fedc
mov dword [eax], edi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
xor eax, eax
test edx, edx
je 0x101fef3
cmp edx, 0x7fffffff
jbe 0x101fef8
mov eax, 0x80070057
test eax, eax
jl 0x101fe48
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
call fcn.0101f6f5
jmp 0x101fe4c
cmp edi, 1
ja 0x101ff31
mov eax, dword [ebp + 0x10]
cmp word [eax], si
je 0x101feca
mov esi, ecx
neg esi
sbb esi, esi
and esi, 0x23
add esi, 0x80070057
jmp 0x101fe90
push 0x7ffffffe
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
mov edx, edi
mov ecx, ebx
mov dword [ebp - 0x10], esi
call fcn.01020a69
mov esi, eax
mov eax, dword [ebp - 0x10]
sub edi, eax
lea ebx, [ebx + eax*2]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
test esi, esi
jl 0x101fe90
mov eax, dword [ebp + 0x1c]
test eax, 0x200
je 0x101feca
cmp edi, 1
jbe 0x101feca
lea ecx, [edi + edi]
push ebx
call fcn.0101f780
jmp 0x101feca
Function at 0x1020359
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x630]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, 0x1001738
push ebx
push 0x80000002
call edi
test eax, eax
jne 0x10203ca
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x1001720
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x10203be
mov eax, 0x104
push ebx
push eax
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
call fcn.0101fdd2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10203b2
mov ebx, 0x100171c
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x630]
call edi
test eax, eax
jne 0x102031f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push esi
push 0x10016fc
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x1020376
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x80000001
call edi
test eax, eax
jne 0x1020376
push dword [ebp - 0x620]
push esi
push esi
call fcn.01024dc2
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x62c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x62c]
mov dword [ebp - 0x628], 0x104
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10202d2
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret