joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
imul eax, edx, 0x15
push esi
mov esi, dword [ebp + 8]
push edi
mov di, cx
mov dword [ebp - 0x54], 0x304d304b
add eax, esi
mov dword [ebp - 0x50], 0x3051304f
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x4c], 0x30553053
mov dword [ebp - 0x48], 0x30593057
mov dword [ebp - 0x44], 0x305d305b
lea eax, [ecx + eax*2]
mov dword [ebp - 0x40], 0x3061305f
mov dword [ebp - 0x3c], 0x30663064
mov dword [ebp - 0x38], 0x306f3068
mov dword [ebp - 0x34], 0x30753072
mov dword [ebp - 0x30], 0x307b3078
mov dword [ebp - 0x2c], 0x30ab0000
mov dword [ebp - 0x28], 0x30af30ad
mov dword [ebp - 0x24], 0x30b330b1
mov dword [ebp - 0x20], 0x30b730b5
mov dword [ebp - 0x1c], 0x30bb30b9
mov dword [ebp - 0x18], 0x30bf30bd
mov dword [ebp - 0x14], 0x30c430c1
mov dword [ebp - 0x10], 0x30c830c6
mov dword [ebp - 0xc], 0x30d230cf
mov dword [ebp - 8], 0x30d830d5
mov dword [ebp - 4], 0x30db
movzx ecx, word [eax]
test cx, cx
je 0x100336da
mov edx, ecx
cmp di, dx
je 0x100336da
movzx ecx, word [eax + 2]
add eax, 2
inc esi
mov edx, ecx
test cx, cx
jne 0x100336c6
xor eax, eax
cmp esi, 0x14
pop edi
setl al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037370
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, edx
mov eax, 0x55555556
imul esi
mov eax, esi
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
push edi
mov edi, ecx
lea ecx, [ebx + ebx*2]
sub eax, ecx
lea ecx, [esi + 2]
mov dword [ebp - 4], eax
mov eax, 0x55555556
imul ecx
mov eax, 0x38e38e39
mov esi, edx
shr esi, 0x1f
add esi, edx
shl esi, 2
lea ecx, [esi + 0x47]
imul ecx
mov eax, dword [ebp + 8]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
mov eax, dword [eax]
add ecx, edx
mov dword [ebp - 8], ecx
test eax, eax
jne 0x100373ef
lea eax, [ecx + esi]
xor ecx, ecx
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x100374dc
xor esi, esi
test ebx, ebx
jle 0x10037461
movzx ecx, byte [edi]
add esi, 4
shr ecx, 2
dec ebx
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [edi]
movzx ecx, byte [edi + 1]
and edx, 3
shr ecx, 4
add edx, edx
movzx ecx, byte [ecx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx edx, byte [edi + 1]
movzx ecx, byte [edi + 2]
and edx, 0xf
shr ecx, 6
movzx ecx, byte [ecx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edi + 2]
add edi, 3
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
cmp esi, 0x48
jne 0x1003745d
xor esi, esi
mov byte [eax], 0xa
inc eax
test ebx, ebx
jg 0x100373f5
mov ecx, dword [ebp - 4]
dec ecx
je 0x100374ab
dec ecx
jne 0x100374d9
movzx ecx, byte [edi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx edx, byte [edi]
movzx ecx, byte [edi + 1]
and edx, 3
shr ecx, 4
add edx, edx
movzx ecx, byte [ecx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx ecx, byte [edi + 1]
and ecx, 0xf
movzx ecx, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
jmp 0x100374d3
movzx ecx, byte [edi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx ecx, byte [edi]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
add eax, 4
add esi, 4
mov byte [eax], 0
imul eax, dword [ebp - 8], 0x49
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100374f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov eax, 0x55555556
imul esi
mov eax, esi
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
push edi
mov edi, ecx
lea ecx, [ebx + ebx*2]
sub eax, ecx
lea ecx, [esi + 2]
mov dword [ebp - 4], eax
mov eax, 0x55555556
imul ecx
mov eax, dword [ebp + 8]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, dword [eax]
test eax, eax
jne 0x10037565
xor ecx, ecx
lea eax, [esi*4 + 1]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x10037565
pop edi
lea eax, [esi*4 + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
test ebx, ebx
jle 0x100375d4
lea esi, [ebx*4]
movzx ecx, byte [edi]
dec ebx
shr ecx, 2
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], cx
movzx edx, byte [edi]
movzx ecx, byte [edi + 1]
and edx, 3
shr ecx, 4
add edx, edx
movsx ecx, byte [ecx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], cx
movzx edx, byte [edi + 1]
movzx ecx, byte [edi + 2]
and edx, 0xf
shr ecx, 6
movsx ecx, byte [ecx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 4], cx
movzx ecx, byte [edi + 2]
add edi, 3
and ecx, 0x3f
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 6], cx
add eax, 8
test ebx, ebx
jg 0x10037572
mov ecx, dword [ebp - 4]
dec ecx
je 0x10037626
dec ecx
jne 0x10037657
movzx ecx, byte [edi]
shr ecx, 2
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], cx
movzx edx, byte [edi]
movzx ecx, byte [edi + 1]
and edx, 3
shr ecx, 4
add edx, edx
movsx ecx, byte [ecx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], cx
movzx ecx, byte [edi + 1]
and ecx, 0xf
movsx ecx, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 4], cx
mov ecx, 0x3d
mov word [eax + 6], cx
jmp 0x10037651
movzx ecx, byte [edi]
shr ecx, 2
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], cx
movzx ecx, byte [edi]
and ecx, 3
shl ecx, 4
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], cx
mov dword [eax + 4], 0x3d003d
add eax, 8
add esi, 4
xor ecx, ecx
pop edi
mov word [eax], cx
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003cbc0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edi
lea edi, [ebp - 0x18]
movdqu xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x1c], edi
mov dword [eax], vtable.CHncATLInternetSession.0
mov dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x24]
push ecx
mov dword [ebp - 4], 0
push edx
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 0xc]
push esi
mov dword [edi + 4], eax
mov edi, dword [ebp - 0x2c]
push edi
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, dword [ebp - 0x24]
mov dword [esi + 8], eax
test eax, eax
je 0x1003cc65
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push ecx
push eax
call fcn.1003d190
lea ecx, [ebp - 0x20]
call fcn.10010900
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1003ce00
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x1009b6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
movzx eax, ax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2c]
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
push ecx
lea eax, [esi + 4]
mov dword [esp + 0x54], 0
push 0x100
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x204], ecx
test eax, eax
je 0x1003cef0
push ecx
neg edi
sbb edi, edi
and edi, 0x8000000
push edi
push 1
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0x2c]
push dword [eax + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi], eax
test eax, eax
je 0x1003cee4
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.1003d190
jmp 0x1003cef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x20c], eax
lea ecx, [esp + 0x24]
call fcn.10010900
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1003cfb0
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov edx, dword [esi]
test edx, edx
jne 0x1003cfe6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
test ecx, 0x10000000
jne 0x1003cfd1
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], 0
cmp eax, 1
jne 0x1003d014
mov eax, dword [esi + 0x204]
push eax
push ecx
push ebx
push edi
push edx
call dword [sym.imp.WININET.dll_FtpPutFileW]
test eax, eax
jne 0x1003d06d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x418], eax
cmp eax, 0x2ee3
jne 0x1003d069
push 0x104
add esi, 0x210
mov dword [ebp - 8], 0
push 0
push esi
mov dword [ebp - 0xc], 0x104
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetGetLastResponseInfoW]
xor esi, esi
jmp 0x1003d072
mov esi, 1
lea ecx, [ebp - 0x1c]
call fcn.10010900
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003db90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x1003dbc5
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x1003dbbf
js 0x1003dbb1
jle 0x1003dbb1
movzx esi, si
or esi, 0x80070000
call fcn.10046710
mov dword [eax], esi
mov dword [eax + 4], 0
or eax, 0xffffffff
pop esi
pop ebp
ret
push ecx
push dword [ebp + 8]
push 1
push edx
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
pop ebp
ret

Function at 0x1003dbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x1003dc15
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x1003dc0f
js 0x1003dc01
jle 0x1003dc01
movzx esi, si
or esi, 0x80070000
call fcn.10046710
mov dword [eax], esi
mov dword [eax + 4], 0
or eax, 0xffffffff
pop esi
pop ebp
ret
push ecx
push dword [ebp + 8]
push 1
push edx
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x100405a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
je 0x100405d6
push 0x20019
push eax
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetSectionKey_unsigned_short_int_const___unsigned_long_int_
mov edi, eax
jmp 0x1004061d
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
movdqa xmmword [esp + 0x30], xmm0
lea edx, [esp + 0x38]
mov dword [esp + 0x34], edx
lea eax, [ecx + 0x10]
lea edx, [esp + 0x18]
mov dword [esp + 0x30], 0
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x30]
call fcn.10010900
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x10040636
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
mov dword [esp + 0x1c], 4
movdqa xmmword [esp + 0x20], xmm0
lea eax, [esp + 0x28]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x50]
mov dword [esp + 0x28], 0
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.10010900
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4c]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100406a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x1009b7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
test edx, edx
je 0x100406fe
push 0x20019
push edx
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetSectionKey_unsigned_short_int_const___unsigned_long_int_
mov edi, eax
jmp 0x10040745
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
movdqa xmmword [esp + 0x44], xmm0
lea edx, [esp + 0x4c]
mov dword [esp + 0x48], edx
lea eax, [ecx + 0x10]
lea edx, [esp + 0x20]
mov dword [esp + 0x44], 0
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x44]
call fcn.10010900
mov edi, dword [esp + 0x20]
test edi, edi
je 0x100407a4
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x48]
mov dword [esp + 0x2c], 0
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.10010900
test esi, esi
jne 0x1004079d
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0x1c]
add eax, eax
cmp ecx, eax
jbe 0x100407ab
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax], cx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10040881
test ecx, ecx
je 0x1004086c
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
lea eax, [ecx + 1]
mov dword [esp + 0x70], 0
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1009427d
mov ecx, dword [esp + 0x20]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push 0
push esi
call sub.MSVCR120.dll_memset
mov eax, dword [esp + 0x24]
add esp, 0x10
push dword [eax + 0x420]
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x4c]
push eax
push 0
push dword [esp + 0x2c]
push edi
call sym.HncFoundation.dll_HncRegQueryValueEx
push esi
test eax, eax
je 0x10040849
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
call fcn.10010900
xor eax, eax
jmp 0x10040881
push dword [ebp + 0x14]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.10010900
jmp 0x10040875
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax], cx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100408a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x1009b7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
test eax, eax
je 0x100408f8
push 0x20019
push eax
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetSectionKey_unsigned_short_int_const___unsigned_long_int_
jmp 0x1004093f
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
movdqa xmmword [esp + 0x44], xmm0
lea edx, [esp + 0x4c]
mov dword [esp + 0x48], edx
lea eax, [ecx + 0x10]
lea edx, [esp + 0x1c]
mov dword [esp + 0x44], 0
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x44]
call fcn.10010900
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
test eax, eax
je 0x10040990
xorps xmm0, xmm0
lea ecx, [esp + 0x2c]
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
lea ecx, [esp + 0x48]
mov dword [esp + 0x2c], 0
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.10010900
test esi, esi
je 0x10040997
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10040a83
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10040a5f
xorps xmm0, xmm0
lea ecx, [esp + 0x2c]
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 0
xor ecx, ecx
mov dword [esp + 0x70], 0
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1009427d
mov ecx, dword [esp + 0x18]
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
push dword [ecx + 0x420]
lea ecx, [esp + 0x24]
push ecx
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push dword [esp + 0x2c]
push esi
call sym.HncFoundation.dll_HncRegQueryValueEx
push dword [esp + 0x10]
test eax, eax
je 0x10040a40
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x10040a27
mov edi, dword [edi]
xor eax, eax
push esi
mov word [edi], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
call fcn.10010900
xor eax, eax
jmp 0x10040a83
mov ecx, edi
call fcn.1002a900
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
lea ecx, [esp + 0x24]
call fcn.10010900
jmp 0x10040a77
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x10040a6e
mov edi, dword [edi]
mov esi, dword [esp + 0xc]
xor eax, eax
mov word [edi], ax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
push edi
test eax, eax
je 0x10040d3d
test edx, edx
je 0x10040c8d
push 0x20019
push edx
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetSectionKey_unsigned_short_int_const___unsigned_long_int_
mov edi, eax
jmp 0x10040cd4
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movdqa xmmword [esp + 0x30], xmm0
lea edx, [esp + 0x38]
mov dword [esp + 0x34], edx
lea eax, [ecx + 0x10]
lea edx, [esp + 0x24]
mov dword [esp + 0x30], 0
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x30]
call fcn.10010900
mov edi, dword [esp + 0x24]
test edi, edi
je 0x10040d3d
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
movdqa xmmword [esp + 0x40], xmm0
lea eax, [esp + 0x48]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x48], 0
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.10010900
test esi, esi
jne 0x10040d36
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10040d90
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov edx, dword [eax]
cmp ecx, edx
jbe 0x10040d52
mov dword [eax], ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], edx
push dword [eax + 0x420]
lea eax, [esp + 0x2c]
push eax
push esi
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x34]
push edi
call sym.HncFoundation.dll_HncRegQueryValueEx
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10040d3d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
jmp 0x10040da1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push edi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x5c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10040e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x34], eax
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
mov dword [esp + 4], edx
lea edx, [esp + 0x20]
movdqa xmmword [esp + 0x18], xmm0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
test eax, eax
je 0x10040ea8
push eax
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetSectionKey_unsigned_short_int_const__
jmp 0x10040ead
call sym.HncFoundation.dll_protected:_struct_HKEY______thiscall_CHncRegistry::GetRegistryKey_void_
mov edi, eax
test edi, edi
jne 0x10040eb7
xor esi, esi
jmp 0x10040f1f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10040ec0
sub eax, edx
lea ecx, [esp + 0x18]
sar eax, 1
xorps xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [esp + 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.10010900
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0xc], eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.10010900
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100944ae
mov esp, ebp
pop ebp
ret 0xc