joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x414a7b
call fcn.00405c1f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x414a7b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414a97
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004145ae
mov esi, eax
test edi, edi
je 0x414a95
test ebx, ebx
je 0x414a95
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415277
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x437c07
call fcn.00423f3a
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41529c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4152e2
lea ecx, [ebp - 0x10]
call fcn.004015d0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403505
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011f0
mov eax, esi
call fcn.00424012
ret 8

Function at 0x41fff3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x420017
cmp dword [edi + 0x54], 0
jne 0x420017
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00405c1f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041ffb4
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422cfe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449828]
jne 0x422d08
repz ret
jmp fcn.0042a8cc
Function at 0x433b80
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042a2c0
and dword [ebp - 4], 0
cmp dword [0x44d788], 0
mov ebx, eax
jne 0x433c31
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x433ce2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43f97c
push edi
call esi
test eax, eax
je 0x433ce2
push eax
call fcn.0042a24e
mov dword [esp], 0x43f96c
push edi
mov dword [0x44d788], eax
call esi
push eax
call fcn.0042a24e
mov dword [esp], 0x43f958
push edi
mov dword [0x44d78c], eax
call esi
push eax
call fcn.0042a24e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44d790], eax
call esi
push eax
call fcn.0042a24e
pop ecx
mov dword [0x44d798], eax
test eax, eax
je 0x433c31
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042a24e
pop ecx
mov dword [0x44d794], eax
mov eax, dword [0x44d794]
cmp eax, ebx
je 0x433c89
cmp dword [0x44d798], ebx
je 0x433c89
push eax
call fcn.0042a2c9
push dword [0x44d798]
mov esi, eax
call fcn.0042a2c9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x433c89
test edi, edi
je 0x433c89
call esi
test eax, eax
je 0x433c80
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x433c80
test byte [ebp - 0xc], 1
jne 0x433c89
or dword [ebp + 0x10], 0x200000
jmp 0x433cc2
mov eax, dword [0x44d78c]
cmp eax, ebx
je 0x433cc2
push eax
call fcn.0042a2c9
pop ecx
test eax, eax
je 0x433cc2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x433cc2
mov eax, dword [0x44d790]
cmp eax, ebx
je 0x433cc2
push eax
call fcn.0042a2c9
pop ecx
test eax, eax
je 0x433cc2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44d788]
call fcn.0042a2c9
pop ecx
test eax, eax
je 0x433ce2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x433ce4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1012058
Capabilities:
Create thread

Disassembly:
mov eax, 0x10332b0
call fcn.01027f98
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0x1001710
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0
push 0x4000
push 0x5c
mov ebx, 0x10015d4
push ebx
mov edi, 0x1001548
push edi
call fcn.01011ab4
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.01011b28
mov dword [ebp - 4], 1
cmp dword [esi], 0
je 0x10120ba
xor esi, esi
jmp 0x101224b
mov byte [ebp - 4], 2
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x10120da
mov ecx, eax
call fcn.01011f99
jmp 0x10120dc
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov dword [esi], eax
test eax, eax
jne 0x101211e
push 0x10016c0
push 0x8007000e
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
push 0x4000
push 0x65
push ebx
push edi
call fcn.01011ab4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.01011cf6
add esp, 0x4c
lea eax, [ebp - 0x2c]
push eax
push 0
push esi
push 0x1011de9
push 0x40000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x101217b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001678
push 0x8000ffff
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0
push 0x4000
push 0x76
push ebx
push edi
call fcn.01011ab4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.01011cf6
add esp, 0x50
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x5c], eax
jmp 0x101222e
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x5c], 0
jge 0x1012248
mov ecx, dword [esi]
test ecx, ecx
je 0x1012248
mov edx, dword [ecx]
push eax
call dword [edx]
and dword [esi], 0
mov esi, dword [ebp - 0x5c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.01011bd1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1015685
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1033981
call fcn.01027f98
sub esp, 0x58
mov eax, dword [0x10400ac]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
push 0x1003150
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x64], esp
push 0
push 0x200
push 0x328
push 0x10021c4
mov ebx, 0x1002140
push ebx
call fcn.01011ab4
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.01011b28
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x2c], eax
push eax
push 0x1003114
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0
push 0x200
push 0x32e
push 0x10021c4
push ebx
call fcn.01011ab4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.01011c4f
add esp, 0x4c
push 0
push edi
push 0x1040060
lea ecx, [esi + 4]
call fcn.01013357
mov dword [esi + 0xbc], edi
mov esi, 0x100310c
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2c]
call fcn.01013d39
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x1d], 0
cmp dword [ebp - 0x24], 0
je 0x1015819
push dword [ebp - 0x24]
push 0x10030e0
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0
push 0x200
push 0x33e
push 0x10021c4
push ebx
call fcn.01011ab4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.01011c4f
add esp, 0x4c
push 0x10030cc
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1015805
mov byte [ebp - 0x1d], 1
push 1
mov ecx, dword [ebp - 0x28]
call fcn.010158f5
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x28]
mov esi, dword [eax + 0x98]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.01011bd1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01027c7a
pop edi
pop esi
pop ebx
leave
ret 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call fcn.01013d39
mov dword [ebp - 0x24], eax
jmp 0x1015763
cmp byte [ebp - 0x1d], 0
jne 0x10157ce
mov ecx, dword [ebp - 0x28]
call fcn.010153cf
jmp 0x10157ce
Function at 0x1015e91
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1033a8c
call fcn.01027f98
sub esp, 0x28
push ebx
push esi
push edi
push 0x10037d4
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
mov ebx, 0x200
push ebx
push 0x123
mov edi, 0x10037cc
push edi
mov esi, 0x1003760
push esi
call fcn.01011ab4
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.01011b28
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1015f2a
push eax
push dword [ebp + 8]
push 0x10036d8
push 0x8004230c
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
push ebx
push 0x128
push edi
push esi
call fcn.01011ab4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.01011cf6
add esp, 0x54
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x10]
push ecx
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1015fed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x1015f62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x48f
jne 0x1015fa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1003640
push 0x80042308
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0
push ebx
push 0x13b
push edi
push esi
call fcn.01011ab4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.01011cf6
add esp, 0x54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ed
je 0x1015fed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x10035d0
push 0x8004230c
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
push ebx
push 0x140
push edi
push esi
call fcn.01011ab4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.01011cf6
add esp, 0x54
test byte [ebp - 0xe], 8
je 0x101602b
push dword [ebp + 8]
push 0x1003558
push 0x8004230c
sub esp, 0x40
mov ecx, esp
mov dword [ebp + 8], esp
push 0
push ebx
push 0x147
push edi
push esi
call fcn.01011ab4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.01011cf6
add esp, 0x50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.01011bd1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1019d6a
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x1034251
call fcn.01027f98
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x10400ac]
mov edx, dword [ebp + 0x10]
push edi
mov ebx, dword [ebp + 8]
push 9
pop ecx
mov esi, 0x1005ad8
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x4c]
push ecx
push 0xf003f
movsw word es:[edi], word [esi]
xor esi, esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov dword [ebp - 0x48], eax
je 0x1019e34
cmp dword [ebx], esi
jne 0x1019dc4
mov dword [ebx], eax
push eax
push dword [ebp - 0x40]
mov ebx, 0x200
push dword [ebp - 0x44]
mov edi, 0x1005acc
push 0x1005a78
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x44], esp
push esi
push ebx
push 0x6c
push edi
mov esi, 0x10059e8
push esi
call fcn.01011ab4
and dword [ebp - 4], 0
push dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.010297ff
add esp, 0x54
push dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push dword [ebp - 0x40]
push eax
push 0x1005960
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0
push ebx
push 0x6d
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 1
jmp 0x1019f1d
push dword [ebp - 0x4c]
push ebx
call fcn.01019f4a
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ebx, 0x200
mov edi, 0x1005acc
mov esi, 0x10059e8
je 0x1019e9a
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0
jne 0x1019e63
mov dword [ecx], eax
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x38]
push eax
push 0x10058f0
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0
push ebx
push 0x7c
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 2
push dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.01011c4f
add esp, 0x54
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov dword [ebp - 0x48], eax
je 0x1019f2c
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0
jne 0x1019eb7
mov dword [ecx], eax
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x10058a0
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0
push ebx
push 0x8a
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 3
push dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.010297ff
add esp, 0x54
push dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push dword [ebp - 0x40]
push eax
push 0x1005830
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0
push ebx
push 0x8b
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 4
push dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
call fcn.01011c4f
add esp, 0x54
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01027c7a
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1019f4a
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1034276
call fcn.01027f98
sub esp, 0x24c
mov eax, dword [0x10400ac]
push ebx
push esi
push edi
push 0xb
pop ecx
mov ebx, dword [ebp + 0xc]
mov esi, 0x1005b94
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x258]
push eax
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x240]
push eax
push esi
push ebx
mov dword [ebp - 0x24c], 0x100
call edi
cmp eax, esi
mov dword [ebp - 0x244], eax
jne 0x1019ffb
lea eax, [ebp - 0x240]
push eax
push ebx
push dword [ebp - 0x248]
call fcn.01019d6a
lea eax, [ebp - 0x258]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x240]
push eax
push esi
push ebx
mov dword [ebp - 0x24c], 0x100
call edi
cmp eax, esi
mov dword [ebp - 0x244], eax
je 0x1019fb8
cmp eax, 0x103
je 0x101a0a1
mov ecx, dword [ebp - 0x248]
cmp dword [ecx], esi
jne 0x101a012
mov dword [ecx], eax
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
push 0x1005b40
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x250], esp
push esi
push 0x200
push 0xc6
mov ebx, 0x1005acc
push ebx
mov edi, 0x10059e8
push edi
call fcn.01011ab4
mov dword [ebp - 4], esi
push dword [ebp - 0x248]
or dword [ebp - 4], 0xffffffff
call fcn.010297ff
add esp, 0x54
push dword [ebp - 0x244]
lea eax, [ebp - 0x40]
push eax
push 0x1005b00
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x244], esp
push esi
push 0x200
push 0xc7
push ebx
push edi
call fcn.01011ab4
mov dword [ebp - 4], 1
push dword [ebp - 0x248]
or dword [ebp - 4], 0xffffffff
call fcn.01011c4f
add esp, 0x50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01027c7a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x101a0bf
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10342c9
call fcn.01027f98
sub esp, 0x140
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x10400ac]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x40], ecx
push 8
pop ecx
mov esi, 0x1005ca4
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
movsw word es:[edi], word [esi]
and dword [eax], 0
add edx, edx
mov dword [ebp - 0x44], eax
mov ecx, edx
mov esi, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x38]
push eax
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, 0x200
mov edi, 0x1005acc
mov esi, 0x10059e8
je 0x101a18f
jle 0x101a159
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0x1005c6c
push eax
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0
push ebx
push 0x111
push edi
push esi
call fcn.01011ab4
and dword [ebp - 4], 0
push dword [ebp - 0x44]
or dword [ebp - 4], 0xffffffff
call fcn.01029013
add esp, 0x54
cmp dword [ebp - 0x38], 1
je 0x101a2a0
push 1
push 0
push ebx
push 0x117
push edi
push esi
lea ecx, [ebp - 0x14c]
call fcn.01011ab4
mov dword [ebp - 4], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, eax
call fcn.01013e8d
mov byte [ebp - 4], 2
push 1
lea ecx, [ebp - 0x8c]
push ecx
mov ecx, eax
call fcn.01013e8d
mov byte [ebp - 4], 3
push dword [ebp - 0x40]
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, eax
call fcn.010122cb
mov byte [ebp - 4], 4
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x48], esp
push dword [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.010122cb
mov byte [ebp - 4], 5
push 0x3007
push dword [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.0101236e
add esp, 0x4c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10c]
call fcn.01011afc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.01011afc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc]
call fcn.01011afc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.01011afc
push dword [ebp - 0x38]
lea eax, [ebp - 0x34]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push eax
push 0x1005bc8
push 0x8000ffff
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0
push ebx
push 0x118
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 6
push dword [ebp - 0x44]
or dword [ebp - 4], 0xffffffff
call fcn.01011cf6
add esp, 0x5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01027c7a
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101a2be
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x103431c
call fcn.01027f98
sub esp, 0x13c
mov eax, dword [0x10400ac]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push 8
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov esi, 0x1005d74
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [edx], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x48]
push edx
push eax
mov dword [eax], ecx
lea eax, [ebp - 0x38]
push eax
push ecx
push dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
push ebx
mov dword [ebp - 0x48], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, 0x200
mov edi, 0x1005acc
mov esi, 0x10059e8
je 0x101a377
jle 0x101a341
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x3c]
push dword [ebp - 0x34]
push 0x1005c6c
push eax
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0
push ebx
push 0x15c
push edi
push esi
call fcn.01011ab4
and dword [ebp - 4], 0
push dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
call fcn.01029013
add esp, 0x54
cmp dword [ebp - 0x38], 4
je 0x101a488
push 1
push 0
push ebx
push 0x162
push edi
push esi
lea ecx, [ebp - 0x148]
call fcn.01011ab4
mov dword [ebp - 4], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, eax
call fcn.01013e8d
mov byte [ebp - 4], 2
push 4
lea ecx, [ebp - 0x88]
push ecx
mov ecx, eax
call fcn.01013e8d
mov byte [ebp - 4], 3
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x108]
push ecx
mov ecx, eax
call fcn.010122cb
mov byte [ebp - 4], 4
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.010122cb
mov byte [ebp - 4], 5
push 0x3007
push dword [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.0101236e
add esp, 0x4c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x108]
call fcn.01011afc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.01011afc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.01011afc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.01011afc
push dword [ebp - 0x38]
lea eax, [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x3c]
push eax
push 0x1005cc8
push 0x8000ffff
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0
push ebx
push 0x163
push edi
push esi
call fcn.01011ab4
mov dword [ebp - 4], 6
push dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
call fcn.01011cf6
add esp, 0x5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01027c7a
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x101e79e
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1034c31
call fcn.01027f98
sub esp, 0x24
push ebx
push esi
push edi
push 0x1007ab0
sub esp, 0x40
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ecx, esp
push 0
push 0x200
push 0x171
mov ebx, 0x1007aa4
push ebx
mov edi, 0x1007a38
push edi
call fcn.01011ab4
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.01011b28
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
test eax, eax
je 0x101e8ab
cmp dword [esi + 0x10], 2
jne 0x101e8ab
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x101e8a3
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push 0x10079a8
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0
push 0x4000
push 0x184
push ebx
push edi
call fcn.01011ab4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.010297ff
add esp, 0x54
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007948
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
push 0x4000
push 0x187
push ebx
push edi
call fcn.01011ab4
mov byte [ebp - 4], 4
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.01011c4f
mov dword [esi + 0x10], 5
add esp, 0x50
mov esi, 0x8007000e
jmp 0x101e8e7
mov byte [esi + 0x14], 1
xor esi, esi
jmp 0x101e8e7
push dword [esi + 0x10]
push 0x100792c
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
push 0x4000
push 0x176
push ebx
push edi
call fcn.01011ab4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.01011c4f
add esp, 0x4c
mov esi, 0x8000ffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.01011bd1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret