joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040350
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100915bf
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100b736c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10009450
mov ecx, eax
test ecx, ecx
je 0x10040504
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10009450
mov ecx, eax
test ecx, ecx
je 0x1004050e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10009450
mov ecx, eax
test ecx, ecx
je 0x10040518
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10040428
xor ecx, ecx
jmp 0x10040440
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040430
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10010c70
push edi
mov ecx, ebx
call fcn.10007c40
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1004045c
xor ecx, ecx
jmp 0x10040474
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040464
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10010c70
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.100411b0
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.10007c40
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100404b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x100404ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100404ee
cmp dword [esi + 0x10], 0
je 0x100404e5
push dword [edi]
call fcn.1007839e
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10008910
push 0x80004005
call fcn.10008910
push 0x80004005
call fcn.10008910
int3
Function at 0x10040fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100916a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x10041131
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x10041028
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x10041131
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x10041042
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x10041131
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x1004105c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x10041131
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x10041076
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x10041131
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x10041131
push 3
mov ecx, esi
call fcn.10040f80
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.100063d0
push 0x1009c260
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100426b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100410ce
push 0
mov ecx, esi
call fcn.10040f80
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x100410df
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x10041121
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x10041121
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x10041121
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.100256b3
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.100073c0
lea ecx, [ebp - 0x2c]
call fcn.1002bb00
lea ecx, [ebp - 0x28]
call fcn.100073c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret 4
Function at 0x10042df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x10042dff
pop ebp
jmp fcn.10043a10
xor eax, eax
pop ebp
ret 0xc
Function at 0x10043d10
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091bd3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x10043db5
cmp word [esi], di
je 0x10043db5
test eax, eax
je 0x10043d71
cmp word [eax], di
je 0x10043d71
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x10043db5
jmp 0x10043db0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100644e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x10043db5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x10043e2c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x10043e17
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x10043de5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x10043e06
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x10043e4c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x10043e17
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x10043e2c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret 0x30
call fcn.10020bb3
int3

Function at 0x10044320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10044335
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10044340
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10044f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008df7b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x100b736c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x14]
push 0x20000
push 0
push esi
call fcn.100644e0
add esp, 0xc
lea eax, [ebx + 0x20014]
push 0
push eax
push 0x20000
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004510a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x100450c7
cmp eax, 0xffffffff
je 0x100450c7
call fcn.10041620
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100450c7
cmp dword [ebx + 0x2005c], 8
lea eax, [ebx + 0x20048]
mov dword [ebp - 0x14], eax
jb 0x10044ff5
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.100140d0
push 3
push 0x10094a34
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100140d0
mov byte [ebp - 4], 1
call fcn.10041620
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x95
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100066e0
mov esi, eax
push str.RecvData_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.10008040
add esp, 8
mov ecx, esi
push dword [ebp - 0x10]
call fcn.10007ea0
push str.__channel_name:
push esi
call fcn.10008040
mov ecx, dword [ebp - 0x14]
mov eax, 0x10094ae4
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.100031f0
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10008310
lea ecx, [ebp - 0x2c]
call fcn.10007370
lea ecx, [ebp - 0x44]
call fcn.10007370
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0xc], 6
cmp esi, 0xe8
je 0x100450e8
cmp esi, 0xe9
je 0x100450e8
cmp esi, 0x6d
je 0x100450e8
cmp esi, 6
jne 0x1004513e
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
mov dword [ecx + 4], eax
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x20014]
test eax, eax
je 0x10045137
test esi, esi
je 0x10045137
push dword [ebp - 0x10]
add eax, esi
push eax
push esi
push dword [ecx + 4]
call fcn.100056b0
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10046c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x10046d27
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10046c75
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10048420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092073
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100b83e0]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10048370
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10048601
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.100644e0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x1009dab8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10048601
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x100484f5
cmp eax, 2
jne 0x10048601
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x10048516
test cl, 1
jne 0x10048601
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x1004851c
jmp 0x10048601
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10048601
call fcn.10009450
mov ecx, eax
test ecx, ecx
je 0x1004862c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100466d0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x1009dac0
push eax
call fcn.10048aa0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.10046c60
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x100485e5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10048586
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10048640
push dword [0x100b83e8]
lea eax, [ebp - 0x74]
push dword [0x100b83e4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100485c2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100485de
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10048603
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10048601
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x1004860e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008910
int3
Function at 0x100487a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100920a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b736c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100b83e0]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10048370
test eax, eax
je 0x100488c8
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10048873
cmp dword [esi], 0
je 0x10048866
push 0x1009d96c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10048833
mov eax, 1
jmp 0x10048894
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004886c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x10048894
cmp dword [esi + 4], 0
jne 0x10048873
mov eax, 1
jmp 0x10048894
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100488be
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100488a6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x100488cb
xor ebx, ebx
jmp 0x1004896f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x1004896f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10048928
mov ecx, dword [ebx]
test ecx, ecx
je 0x1004898e
push ecx
push eax
call fcn.1006c63f
add esp, 8
test eax, eax
je 0x10048928
mov edx, dword [edi]
test edx, edx
je 0x10048928
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10048900
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10048933
lea eax, [edx + 0xd]
jmp 0x10048968
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10048940
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1009dab8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1004897a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008910
int3
Function at 0x1004a090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004a101
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1004a0cf
cmp eax, 2
jne 0x1004a0eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1004a0fb
test ecx, ecx
je 0x1004a0f6
test cl, 1
jne 0x1004a0eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1004a0fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1004e040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092881
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.10009450
mov ecx, eax
test ecx, ecx
je 0x1004e1d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004e195
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004e187
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004e195
add eax, 0x10
push 0x100bba88
push eax
mov dword [ebp - 0x20], eax
call fcn.1003cc13
mov esi, eax
add esp, 8
test esi, esi
je 0x1004e195
push dword [ebp - 0x20]
push 0
push esi
call fcn.100644e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004e14a
push esi
call fcn.1003c9a4
add esp, 4
jmp 0x1004e195
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004e150
sub ecx, edx
sar ecx, 1
je 0x1004e17e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004e166
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.10010c70
push esi
call fcn.1003c9a4
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1004e195
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004e1b4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10008910
int3
Function at 0x1004e1e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1004e204
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1004e266
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x1004e266
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1004e281
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c985
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1005013c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10081c4e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1008190e