joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59df71
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x59dfa4
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x59df9f
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x59dfce
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005cfab0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x59e15c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x59e16a
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x59e229
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
sub edi, 1
jne 0x59e182
pop edi
test esi, esi
je 0x59e245
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619108]
inc edx
sub esi, 1
jne 0x59e22d
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x5ae865
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x188
mov eax, 0x60bade
call fcn.005b8c7a
mov dword [ebp - 0x194], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x188], ebx
call fcn.0057ea69
push eax
lea ecx, [ebp - 0x54]
call fcn.00582c92
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0057ea6f
mov ecx, eax
call fcn.00583377
test al, al
je 0x5ae944
push ebx
lea ecx, [ebp - 0x54]
call fcn.00582e91
push edi
push 0x80
push 3
push edi
push 1
push bind
lea ecx, [ebp - 0x54]
call fcn.00454360
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5ae8ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00582d5b
jmp 0x5aea19
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x5ae8d9
push esi
mov dword [ebp - 0x184], edi
call fcn.005b89cc
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x184]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x184], esi
je 0x5aea07
push edi
call fcn.005b89c7
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00582d5b
jmp 0x5aea17
call fcn.0057ea6f
push eax
lea ecx, [ebp - 0x54]
call fcn.00582e54
call fcn.0057ec23
test al, al
je 0x5ae962
call fcn.0057ea75
jmp 0x5ae976
push 2
push edi
lea ecx, [ebp - 0x54]
call fcn.00454360
push eax
call fcn.0059ba08
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x5ae8d9
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
push eax
push 1
push dword [ebp - 0x188]
push ebx
call fcn.0059b54c
add esp, 0x14
test eax, eax
jne 0x5ae8d9
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x5ae8d9
push esi
call fcn.005b89cc
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x190]
push ebx
call fcn.0059bd73
add esp, 0x18
test eax, eax
je 0x5ae9f7
cmp eax, 0x600
je 0x5ae9f7
push edi
call fcn.005b89c7
pop ecx
call fcn.0057ec23
test al, al
jne 0x5ae933
push ebx
call fcn.0059b3c4
jmp 0x5ae932
call fcn.0057ec23
test al, al
jne 0x5aea07
push ebx
call fcn.0059b3c4
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00582d5b
test edi, edi
jne 0x5aea8b
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push bind
push dword [ebp - 0x188]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5aea87
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x5aea87
push esi
mov dword [ebp - 0x18c], edi
call fcn.005b89cc
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x18c]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18c], esi
je 0x5aea83
push edi
call fcn.005b89c7
pop ecx
xor edi, edi
test edi, edi
jne 0x5aea8b
xor eax, eax
jmp 0x5aeaa3
mov ecx, dword [ebp - 0x194]
push esi
push edi
call fcn.005aeaab
push edi
mov esi, eax
call fcn.005b89c7
pop ecx
mov eax, esi
call fcn.005b8c35
ret 4
Function at 0x5b56fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x5b5728
cmp eax, edi
jge 0x5b571c
push esi
call fcn.005b1bf3
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x5b574b
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x5b5731
mov dword [esi + 8], edx
jmp 0x5b5760
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x5b5756
xor dl, dl
jmp 0x5b575b
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x5b574b
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x5b579a
push str.zlib_corrupt
call fcn.005b1b1e
add esp, 4
jmp 0x5b57da
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x5b57aa
push str.read_past_buffer
jmp 0x5b5790
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x5b57c4
push edi
push ecx
push esi
call fcn.005b8216
add esp, 0xc
test eax, eax
je 0x5b57da
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005cfab0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x5ba170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5e92b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005e9137

Function at 0x5ef4fa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ef1ba
Function at 0x10163c3
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov ebx, 0x100
cmp eax, esi
je 0x10163ff
test dword [eax + 0x1c], ebx
je 0x10163ff
cmp byte [eax + 0x19], 4
jb 0x10163ff
push 0x10025c0
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 1
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1016451
mov eax, dword [0x1077004]
cmp eax, esi
je 0x101644b
test dword [eax + 0x1c], ebx
je 0x101644b
cmp byte [eax + 0x19], 2
jb 0x101644b
push 8
push 0x10028c4
push 0x10025c0
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
and dword [ebp - 8], 0
jmp 0x10164a7
add edi, 0xd8
mov ecx, edi
call fcn.01016074
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jle 0x101649e
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
lea esi, [eax + 1]
movzx eax, word [ecx]
xor ebx, ebx
xor edx, edx
cmp esi, dword [ebp - 4]
sete bl
cmp ax, 0x2d
je 0x1016488
cmp ax, 0x2f
jne 0x101648d
xor edx, edx
inc edx
inc ecx
inc ecx
mov eax, dword [edi]
push ebx
push edx
push ecx
mov ecx, edi
call dword [eax + 0x18]
mov eax, esi
cmp eax, dword [ebp - 4]
jl 0x1016466
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x101ac0f
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1077004]
mov esi, 0x1077004
cmp eax, esi
je 0x101ac4c
test dword [eax + 0x1c], 0x100
je 0x101ac4c
cmp byte [eax + 0x19], 4
jb 0x101ac4c
push 0x10049dc
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
mov eax, dword [0x1077004]
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x101acbf
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x101acbf
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push edi
call fcn.0102139e
test eax, eax
jne 0x101ac9b
test edi, edi
je 0x101ac9b
mov eax, dword [0x1077004]
cmp eax, esi
je 0x101aceb
test dword [eax + 0x1c], 0x100
je 0x101aceb
cmp byte [eax + 0x19], 2
jb 0x101aceb
push 8
push 0x1004a30
push 0x10049dc
push 0x16
jmp 0x101ace0
mov ecx, edi
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x101aca0
sub ecx, esi
sar ecx, 1
inc ecx
mov dword [ebx], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 4], 1
jmp 0x101aceb
cmp eax, esi
je 0x101aceb
test dword [eax + 0x1c], 0x100
je 0x101aceb
cmp byte [eax + 0x19], 2
jb 0x101aceb
push 0x57
push 0x10049ec
push 0x10049dc
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x101b4f9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
xor ebx, ebx
mov word [ebp - 0x2a4], ax
lea eax, [ebp - 0x2a2]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x12
pop ecx
mov esi, 0x1004f38
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x13
pop ecx
mov esi, 0x1004ee8
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, 0x104
push edi
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x50]
push eax
call esi
test eax, eax
je 0x101b583
push edi
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x9c]
push eax
call esi
test eax, eax
je 0x101b583
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret
Function at 0x101d86c
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x106ea98
call fcn.0101dda4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1079fc4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101d627
cmp eax, esi
jne 0x101d61a
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x101d62a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101d601
xor esi, esi
inc esi
mov eax, dword [0x1079fc0]
cmp eax, esi
jne 0x101d63d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101d66c
mov eax, dword [0x1079fc0]
test eax, eax
jne 0x101d666
mov dword [0x1079fc0], esi
push 0x1001fc4
push 0x1001fb8
call fcn.0101d563
pop ecx
pop ecx
test eax, eax
je 0x101d66c
jmp 0x101d790
mov dword [0x10789c4], esi
mov eax, dword [0x1079fc0]
cmp eax, esi
jne 0x101d690
push 0x1001fb4
push 0x1001f74
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1079fc0], 2
cmp dword [ebp - 0x20], ebx
jne 0x101d69d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1079fd0], ebx
je 0x101d6be
push 0x1079fd0
call fcn.0101dd19
pop ecx
test eax, eax
je 0x101d6be
push ebx
push 2
push ebx
call dword [0x1079fd0]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x101d790
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x101d728
cmp cx, bx
je 0x101d6e3
cmp dword [ebp - 0x1c], ebx
jne 0x101d728
movzx ecx, word [eax]
cmp cx, bx
je 0x101d6f8
cmp cx, 0x20
ja 0x101d6f8
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x101d6e3
test byte [ebp - 0x40], 1
je 0x101d704
movzx ecx, word [ebp - 0x3c]
jmp 0x101d707
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10789c0], eax
cmp dword [0x10789b4], ebx
jne 0x101d76d
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x101d739
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x101d6cd
cmp dword [0x10789c4], ebx
jne 0x101d77b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10789c0]
jmp 0x101d79c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0101dde9
ret
call fcn.0101dee9
jmp 0x101d5c4
Function at 0x101e1f9
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x120], 0
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x1077004]
mov esi, 0x1077004
push 2
mov edi, 0x10052b8
pop ebx
cmp eax, esi
je 0x101e25d
test byte [eax + 0x1c], bl
je 0x101e25d
cmp byte [eax + 0x19], 5
jb 0x101e25d
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x101e2ac
mov eax, dword [0x1077004]
cmp eax, esi
je 0x101e2a5
test byte [eax + 0x1c], bl
je 0x101e2a5
cmp byte [eax + 0x19], bl
jb 0x101e2a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1077004]
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
xor eax, eax
jmp 0x101e359
cmp dword [ebp - 0x110], ebx
je 0x101e2d8
mov eax, dword [0x1077004]
cmp eax, esi
je 0x101e2a5
test byte [eax + 0x1c], bl
je 0x101e2a5
cmp byte [eax + 0x19], 3
jb 0x101e2a5
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
jmp 0x101e2a5
cmp dword [ebp - 0x11c], 5
jae 0x101e2fa
mov eax, dword [0x1077004]
cmp eax, esi
je 0x101e2a5
test byte [eax + 0x1c], bl
je 0x101e2a5
cmp byte [eax + 0x19], 3
jb 0x101e2a5
push edi
push 0xe
jmp 0x101e2cb
mov eax, dword [ebp - 8]
test al, 0x40
je 0x101e313
xor eax, eax
cmp byte [ebp - 6], 1
setne al
dec eax
and eax, 0xffffffe0
add eax, 0x40
jmp 0x101e359
test eax, 0x200
je 0x101e31f
xor eax, eax
inc eax
jmp 0x101e359
test bl, al
je 0x101e327
push 8
jmp 0x101e358
test al, al
jns 0x101e32f
push 0x10
jmp 0x101e358
test eax, 0x400
je 0x101e33d
mov eax, 0x80
jmp 0x101e359
cmp byte [ebp - 6], 1
jne 0x101e347
mov eax, ebx
jmp 0x101e359
cmp byte [ebp - 6], 3
je 0x101e356
cmp byte [ebp - 6], bl
jne 0x101e2a5
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret

Function at 0x101e36d
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
sbb eax, eax
and eax, 0xfffffff4
add eax, 0x58
ret
Function at 0x101fc2e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 4
pop ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x101fc4f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101fcc7
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 2
jne 0x101fc9e
mov eax, dword [ebp + 0x14]
push ebx
push esi
push ebx
push 0
push dword [ebp + 0xc]
mov dword [esi], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x101fca7
push esi
push dword [ebp + 0xc]
push 0x1005850
call fcn.01021bf1
add esp, 0xc
push esi
jmp 0x101fcbe
test edi, edi
jne 0x101fcac
cmp dword [ebp + 0x10], ebx
jne 0x101fcac
xor eax, eax
inc eax
jmp 0x101fcc6
push edi
push dword [ebp + 0xc]
push 0x1005808
call fcn.01021bf1
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101fcfd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x101fd3b
push esi
push dword [ebp + 0xc]
push 0x1005850
call fcn.01021bf1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101fd3e
xor eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x101fd48
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
jne 0x101fd77
cmp dword [ebp + 0x14], 0
je 0x101fd75
mov eax, dword [ebp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fd61
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
jmp 0x101fd77
xor eax, eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x101fda5
push eax
push dword [ebp + 0x10]
push 0x1005850
call fcn.01021bf1
add esp, 0xc
xor eax, eax
jmp 0x101fda8
xor eax, eax
inc eax
pop ebp
ret 0x14
Function at 0x101fdd1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
neg esi
sbb esi, esi
and esi, 6
add esi, 0x20019
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
call fcn.0101fb88
mov ebx, eax
mov dword [ebp + 8], ebx
cmp ebx, edi
je 0x101feed
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
je 0x101fe3d
push eax
push 0x1005910
jmp 0x101fed5
push dword [ebp + 0x18]
push dword [ebp - 0x14]
push edi
push ebx
call dword [ebp + 0x14]
test eax, eax
je 0x101fee4
add dword [ebp + 0xc], 4
cmp dword [ebp + 0xc], 0x7ffffffe
ja 0x101fee4
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax + 2]
push eax
call fcn.0101e8e4
mov dword [ebp - 4], eax
cmp eax, edi
je 0x101fee4
push dword [ebp + 0xc]
push eax
push edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x101fec2
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0101fb88
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x101feb6
push dword [ebp + 0x18]
push dword [ebp - 8]
push dword [ebp - 4]
push eax
call dword [ebp + 0x14]
push dword [ebp - 0xc]
test eax, eax
je 0x101fede
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
cmp eax, edi
je 0x101fe83
cmp eax, 0x103
je 0x101fee4
push eax
push 0x10058d8
call fcn.01021bf1
pop ecx
pop ecx
jmp 0x101fee4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call fcn.0101e9ef
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x101ff04
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x210], esi
mov eax, dword [0x1077004]
mov ebx, 0x1077004
cmp eax, ebx
je 0x101ff62
test byte [eax + 0x1c], 2
je 0x101ff62
cmp byte [eax + 0x19], 5
jb 0x101ff62
push 0x1005730
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
lea eax, [ebp - 0x210]
push eax
push 0x3001f
push esi
push dword [ebp - 0x21c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x101ffb0
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x101ffaa
test byte [eax + 0x1c], 2
je 0x101ffaa
cmp byte [eax + 0x19], 2
jb 0x101ffaa
push edi
push 0x1005730
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
push edi
jmp 0x102009e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101ffd2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.0101ff04
test eax, eax
je 0x10200a4
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
call edi
mov dword [ebp - 0x214], eax
cmp eax, esi
je 0x101ffb8
cmp eax, 0x103
jne 0x102005f
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp edi, esi
je 0x102005a
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x101ffaa
test byte [eax + 0x1c], 2
je 0x101ffaa
cmp byte [eax + 0x19], 2
jb 0x101ffaa
push edi
push 0x1005730
push 0xd
jmp 0x101ff9f
xor eax, eax
inc eax
jmp 0x10200a6
mov eax, dword [0x1077004]
cmp eax, ebx
je 0x102008c
test byte [eax + 0x1c], 2
je 0x102008c
cmp byte [eax + 0x19], 2
jb 0x102008c
push dword [ebp - 0x214]
push 0x1005730
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 8
Function at 0x10200bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], 4
mov dword [ebp - 8], esi
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x10200fe
test byte [eax + 0x1c], 2
je 0x10200fe
cmp byte [eax + 0x19], 5
jb 0x10200fe
push 0x1005730
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x1020147
mov eax, dword [0x1077004]
cmp eax, edi
je 0x10201be
test byte [eax + 0x1c], 2
je 0x10201be
cmp byte [eax + 0x19], 2
jb 0x10201be
push ebx
push 0x1005730
push 0xf
jmp 0x10201b3
cmp dword [ebp - 4], 4
je 0x102017b
mov eax, dword [0x1077004]
cmp eax, edi
je 0x1020174
test byte [eax + 0x1c], 2
je 0x1020174
cmp byte [eax + 0x19], 2
jb 0x1020174
push 0x1005730
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
mov ebx, 0x3f1
jmp 0x10201be
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x10201be
mov eax, dword [0x1077004]
cmp eax, edi
je 0x10201be
test byte [eax + 0x1c], 2
je 0x10201be
cmp byte [eax + 0x19], 2
jb 0x10201be
push ebx
push 0x1005730
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc