joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100869ef
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x10]
test esi, esi
je 0x10086bab
mov ax, word [edi + 2]
xor ecx, ecx
mov word [ebp - 0x20], ax
add esi, 0xa
mov al, byte [edi + 4]
mov bh, cl
mov byte [ebp - 0x1e], al
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], ax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], bh
jmp 0x10086a5c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call fcn.10084f98
test eax, eax
js 0x10086b38
lea eax, [ebp - 0x20]
mov ecx, edi
je 0x10086b12
push dword [ebp - 8]
push eax
call fcn.10087279
mov esi, eax
push dword [edi + 0x14]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea ecx, [ebp - 0x20]
call fcn.10086486
mov bl, al
test bl, bl
jne 0x10086a30
mov esi, dword [ebp - 8]
mov dword [edi + 0x14], esi
xor edx, edx
test bh, bh
jne 0x10086aa1
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
and dword [ebp - 0x14], edx
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], eax
call fcn.10085766
mov edx, eax
mov ax, word [edi + 6]
lea ecx, [ebp - 0x34]
and dword [ebp - 0x28], 0
mov word [ebp - 0x34], ax
mov al, byte [edi + 8]
mov byte [ebp - 0x32], al
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
call fcn.10085766
mov ebx, dword [edi + 0x18]
add eax, edx
mov dword [ebp - 0xc], eax
mov edx, ebx
mov eax, dword [edi + 0x14]
sub edx, eax
cmp eax, ebx
sbb ecx, ecx
and ecx, edx
mov edx, dword [ebp - 0xc]
cmp ecx, edx
jb 0x10086bab
sub ebx, edx
lea ecx, [edx + esi]
sub ebx, esi
sub eax, esi
je 0x10086b65
test ecx, ecx
je 0x10086b55
test esi, esi
je 0x10086b55
cmp ebx, eax
jb 0x10086b48
push eax
push esi
push ecx
call fcn.10064ee0
add esp, 0xc
jmp 0x10086b65
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
push eax
call fcn.10085393
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x10086b31
mov al, 1
jmp 0x10086bad
mov bh, 1
mov byte [ebp - 1], bh
jmp 0x10086b3b
mov dword [ebp - 8], esi
test bl, bl
jne 0x10086a7a
jmp 0x10086a77
call fcn.1004ba59
mov dword [eax], 0x22
jmp 0x10086b60
call fcn.1004ba59
mov dword [eax], 0x16
call fcn.10047723
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0xc]
cmp byte [ebp - 1], 0
mov dword [edi + 0x14], eax
jne 0x10086b83
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.10087b76
jmp 0x10086b96
cmp byte [ebp - 0x1e], 0
je 0x10086b96
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
inc eax
push eax
call fcn.10087823
push dword [edi + 0x14]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10087b76
mov byte [edi + 0x20], 1
jmp 0x10086b2d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10087662
Capabilities:
Check if file exists

Disassembly:
push 0x210
mov eax, 0x1010cb1f
call fcn.10062c32
mov ebx, dword [ebp + 8]
xor edi, edi
push ecx
push ecx
push ecx
mov edx, 0x104
mov dword [ebx], edi
lea ecx, [ebp - 0x218]
mov dword [ebx + 4], edi
call fcn.10087374
push 0x10030a50
lea ecx, [ebp - 0x218]
call fcn.1008730e
lea eax, [ebp - 0x218]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x100876d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100876c6
xor eax, eax
jmp 0x10087724
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.10086fa2
jmp 0x10087724
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x21c], edi
mov ecx, esi
call fcn.100858e3
mov edi, eax
test edi, edi
jns 0x10087707
push edi
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.10086fbc
mov dword [ebp - 4], 2
jmp 0x1008771c
mov eax, dword [ebp - 0x21c]
cdq
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 4], 8
xor edi, edi
push esi
call fcn.10084f6d
mov eax, edi
call fcn.10062bca
ret 8

Function at 0x10089a7f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x10089ac7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push 0x20119
push edi
push 0x1002e258
push 0x80000002
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10089acd
cmp dword [ebp - 0x14], edi
je 0x10089ac7
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
leave
ret
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
jb 0x10089adf
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10089ab9
cmp dword [ebp - 4], edi
push ebx
setne bl
cmp dword [ebp - 0x14], edi
je 0x10089b0c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
jmp 0x10089ac9

Function at 0x1008b257
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x1008b29c
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1008b26f
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x80004005
call fcn.1008b1ab
int3
Function at 0x1008dc9f
Capabilities:
Get thread local storage value

Disassembly:
push 0x9c
mov eax, 0x1010d68c
call fcn.10062c32
mov dword [ebp - 0x5c], ecx
cmp dword [ecx], 0
mov ebx, dword [ebp + 8]
je 0x1008de79
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.1008da0a
test al, al
je 0x1008de79
mov eax, 0x1001ddfc
lea edi, [ebp - 0x34]
mov esi, eax
lea ecx, [ebp - 0x4c]
mov edx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
lea edi, [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x50], al
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], eax
call fcn.10080187
mov edi, dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
and dword [ebp - 4], 0
mov ecx, edi
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1008e64f
test al, al
je 0x1008de71
push ecx
lea esi, [edi + 0x10]
push esi
lea ecx, [ebp - 0x68]
call fcn.1006b5df
lea ecx, [edi + 0x90]
lea edx, [ebp - 0x34]
call fcn.1008d0e9
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0x10002784
mov bl, al
call fcn.1006d7a9
test bl, bl
jne 0x1008de71
cmp dword [ebp - 0x58], 3
jne 0x1008dd9b
lea eax, [ebp - 0xa8]
mov ecx, edi
push eax
call fcn.1008d79b
test al, al
jne 0x1008ddbe
push ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.1006b5df
push 9
add edi, 0x6c
mov dword [ebp - 0x68], 0x10002784
pop ecx
lea esi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x68]
call fcn.1006d7a9
mov edi, dword [ebp - 0x5c]
cmp dword [ebp - 0x58], 1
jne 0x1008ddbe
lea eax, [ebp - 0xa8]
mov ecx, edi
push eax
call fcn.1008d993
test al, al
jne 0x1008ddbe
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.1008e991
push dword [ebp - 0x50]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
push dword [ebp - 0x80]
call fcn.1008db02
test al, al
je 0x1008de71
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.1008e467
test al, al
jne 0x1008de36
push dword [ebp - 0x80]
lea eax, [ebp - 0x54]
mov ecx, edi
push eax
call fcn.1008d90f
mov byte [ebp - 4], 1
cmp dword [ebp - 0x54], 0
je 0x1008de18
lea eax, [ebp - 0x54]
mov ecx, edi
push eax
call fcn.1008e2ff
test al, al
jne 0x1008de26
lea eax, [ebp - 0x54]
mov ecx, edi
push eax
call fcn.1008f011
mov ecx, dword [ebp - 0x50]
test ecx, ecx
je 0x1008de71
call fcn.10070fb6
jmp 0x1008de71
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x50]
test ecx, ecx
je 0x1008de36
call fcn.10070fb6
cmp dword [edi + 0xb8], 0xffffffff
je 0x1008de71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 2
push dword [edi + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 3
jne 0x1008de6a
push 2
pop edx
lea ecx, [ebp - 0x34]
call fcn.10092e4d
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x4c]
call fcn.1006af06
call fcn.10062bca
ret 4
Function at 0x1008dff8
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push 0x58
mov eax, 0x1010d709
call fcn.10062c32
mov edi, ecx
xor ebx, ebx
push ebx
call fcn.1008e9d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0xb4], eax
cmp eax, 0xffffffff
je 0x1008e027
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0xb8], eax
cmp eax, 0xffffffff
je 0x1008e040
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
lea ecx, [ebp - 0x2c]
call fcn.1007eabb
push eax
lea ecx, [ebp - 0x44]
call fcn.1006e794
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.1006af06
lea ebx, [edi + 0x90]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea ecx, [edi + 0x100]
lea eax, [ebp - 0x64]
push eax
call fcn.100e162b
mov edx, eax
and dword [ebp - 0x4c], 0
lea eax, [edi + 0xa0]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x5c], 0x1008f4c0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], esi
mov ecx, dword [edx]
mov dword [ebp - 0x4c], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x48], eax
and dword [edx], 0
and dword [edx + 4], 0
mov byte [ebp - 4], 2
call fcn.100e166c
fld dword [0x1003fc54]
push ecx
lea ecx, [ebp - 0x5c]
mov edx, dword [eax + 4]
fstp dword [esp]
call fcn.1008c0f7
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x1008e0d7
call fcn.10070fb6
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x1008e0e7
call fcn.10070fb6
mov ecx, ebx
call fcn.100731d1
test al, al
jne 0x1008e0f9
mov ecx, edi
call fcn.1008e13d
cmp byte [edi + 0x33], 0
jne 0x1008e123
call fcn.1006c64f
lea ecx, [edi + 0xa0]
push ecx
push ebx
mov ecx, eax
call fcn.1008a2d4
xor eax, eax
and edx, 0x80
or eax, edx
je 0x1008e123
mov byte [edi + 0x33], 1
lea ecx, [ebp - 0x44]
mov byte [edi + 0x31], 1
call fcn.1006af06
call fcn.10062bca
ret 4

Function at 0x10093018
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.1006c5b6
mov edi, dword [eax + 0xb4]
cmp edi, 0xffffffff
je 0x1009307d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
je 0x10093076
mov ecx, dword [edx + 4]
call fcn.10092e92
mov ebx, eax
cmp ebx, 1
jne 0x1009306b
mov edi, dword [ebp - 4]
lea esi, [edx + 8]
push 9
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x1009307f
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009c46c
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x28
push 0x101214a8
call fcn.100622e0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
test esi, esi
je 0x1009c501
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1009c501
cmp dword [esi], ebx
jne 0x1009c499
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1009c50a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
and dword [ebp - 0x1c], eax
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test byte [ebp - 0x24], 0x33
je 0x1009c4cc
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1009c501
push ebx
push esi
call fcn.1009c522
test byte [ebp - 0x1c], 0x33
je 0x1009c48e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1009c48e
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100a0276
Capabilities:
Print debug messages

Disassembly:
push 0x98
mov eax, 0x1010eb00
call fcn.10062c32
mov edi, edx
mov eax, ecx
mov dword [ebp - 0xa4], eax
mov ebx, dword [ebp + 8]
call fcn.100731d1
test al, al
je 0x100a048f
test ebx, ebx
je 0x100a048f
cmp dword [ebx], 0
je 0x100a048f
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.100967af
mov esi, dword [ebp - 0x14]
cmp byte [esi + 0xd], 0
jne 0x100a02d1
lea eax, [esi + 0x10]
push eax
push edi
call fcn.10096a84
test al, al
je 0x100a02d7
mov esi, dword [0x1013d80c]
cmp esi, dword [0x1013d80c]
je 0x100a02fb
push dword [ebx]
mov esi, dword [esi + 0x20]
mov ecx, esi
push dword [ebp - 0xa4]
call dword [0x1013f49c]
call esi
mov dword [ebx], eax
jmp 0x100a048f
xor esi, esi
mov ecx, 0x1001de0c
mov edx, esi
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx + edx*4]
jne 0x100a031e
inc edx
cmp edx, 4
jne 0x100a0304
mov ecx, dword [ebx]
call fcn.1009ffc0
jmp 0x100a048f
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x28], ax
push 1
mov edx, edi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x70]
call fcn.100886d9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x30], esi
push 0x1002e188
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x40], ax
call fcn.1006af70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x48], esi
push 0x10031580
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x58], ax
call fcn.1006af70
mov byte [ebp - 4], 3
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
jb 0x100a0386
mov eax, dword [ebp - 0x70]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x58]
push eax
call fcn.10071d31
push eax
lea ecx, [ebp - 0x88]
call fcn.1006e794
push ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x88]
call fcn.100809ac
lea ecx, [ebp - 0x88]
call fcn.1006af06
lea ecx, [ebp - 0x58]
call fcn.1006af06
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.1006af06
lea eax, [ebp - 0x70]
mov edx, 0x100315c8
push eax
lea ecx, [ebp - 0xa0]
call fcn.1008beb0
push 0x100315b8
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10071d02
push eax
lea ecx, [ebp - 0x58]
call fcn.1006e794
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
jb 0x100a0412
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x58]
push eax
call fcn.10071d31
push eax
lea ecx, [ebp - 0x88]
call fcn.1006e794
push 0x100315bc
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.10071d02
push eax
lea ecx, [ebp - 0x40]
call fcn.1006e794
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
jb 0x100a0452
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
call fcn.1006af06
lea ecx, [ebp - 0x88]
call fcn.1006af06
lea ecx, [ebp - 0x58]
call fcn.1006af06
lea ecx, [ebp - 0xa0]
call fcn.1006af06
lea ecx, [ebp - 0x70]
call fcn.1006af06
lea ecx, [ebp - 0x28]
call fcn.1006af06
call fcn.10062bca
ret 4
Function at 0x100a8ccf
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x1013c2b8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov dword [esp + 0xc], esi
mov ebx, edx
mov dword [esp + 0xc], esi
and dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
neg eax
lea edi, [esp + 0x10]
push 9
sbb eax, eax
and dword [esp + 0x10], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esp + 0x10], 0
jne 0x100a8d38
cmp dword [esp + 0xc], 0
je 0x100a8d75
push 0x1013c6dc
mov edx, ebx
lea ecx, [esp + 0x38]
call fcn.100b0415
lea ecx, [esp + 0x34]
call fcn.100b06ad
test al, al
je 0x100a8d6c
lea eax, [esp + 0x34]
mov ecx, esi
push eax
call fcn.1006e794
lea ecx, [esp + 0x34]
call fcn.1006af06
jmp 0x100a8d83
lea ecx, [esp + 0x34]
call fcn.1006af06
push 0x1013c6f4
mov edx, ebx
mov ecx, esi
call fcn.100b0415
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006190b
mov esp, ebp
pop ebp
ret

Function at 0x100a9144
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 8
mov edi, dword [ecx + 0x10]
jb 0x100a9159
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
add edi, edi
je 0x100a9175
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x100a9164
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x100aadfd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x890
mov eax, 0x1010fa85
call fcn.10062c32
mov edi, edx
mov dword [ebp - 0x88c], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x890], eax
mov eax, edi
mov dword [ebp - 0x888], 7
mov dword [ebp - 0x884], 1
jb 0x100aae3b
mov eax, dword [edi]
lea edx, [ebp - 0x884]
xor esi, esi
push edx
push esi
lea edx, [ebp - 0x888]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, 2
je 0x100aaf50
cmp dword [ebp - 0x888], 7
jne 0x100aaf50
test ebx, ebx
jne 0x100aaf5a
mov eax, dword [ebp - 0x884]
lea ecx, [ebp - 0x89c]
add eax, 2
push eax
mov dword [ebp - 0x884], eax
call fcn.100ab1fd
mov dword [ebp - 4], 3
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x100aaea1
mov eax, dword [edi]
lea ecx, [ebp - 0x884]
push ecx
push dword [ebp - 0x89c]
lea ecx, [ebp - 0x888]
push ecx
push esi
push eax
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x100aaefd
push 0x10032be8
lea ecx, [ebp - 0x58]
call fcn.1006ab4f
push edi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.1007d1c0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.1006ac90
push ecx
push ecx
push esi
push esi
lea eax, [ebp - 0x40]
jmp 0x100aaf88
mov eax, dword [ebp - 0x89c]
mov edi, dword [ebp - 0x890]
push eax
lea ecx, [ebp - 0x28]
call fcn.1006ab4f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
mov ecx, edi
call fcn.10076195
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], 3
add esi, eax
call fcn.1006af06
mov ecx, dword [ebp - 0x89c]
lea eax, [ecx + esi*2]
cmp byte [eax], 0
jne 0x100aaf09
lea ecx, [ebp - 0x89c]
call fcn.10074e3b
mov al, 1
jmp 0x100aaf52
xor al, al
call fcn.10062bca
ret 4
push 0x10032b20
lea ecx, [ebp - 0x40]
call fcn.1006ab4f
push edi
mov edx, eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x58]
call fcn.1007d1c0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.1006ac90
push ecx
push ecx
push esi
push esi
lea eax, [ebp - 0x58]
push eax
push esi
push ebx
push 0x21
lea ecx, [ebp - 0x880]
call fcn.100a737c
push 0x1011cc58
lea eax, [ebp - 0x880]
push eax
call fcn.100658b4
int3
Function at 0x100aaffc
Capabilities:
Set registry value

Disassembly:
push 0x878
mov eax, 0x1010fb00
call fcn.10062c32
mov dword [ebp - 0x874], edx
mov dword [ebp - 0x878], ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x86c], 1
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov ebx, dword [ebp - 0x86c]
cmp esi, edi
setne al
test al, al
je 0x100ab054
push esi
lea ecx, [ebp - 0x28]
call fcn.1006e7cf
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
inc eax
add ebx, eax
call fcn.1006af06
add esi, 0x18
jmp 0x100ab02f
lea eax, [ebx + ebx]
push eax
lea ecx, [ebp - 0x884]
mov dword [ebp - 0x870], eax
call fcn.100ab1fd
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x86c], 0
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov ebx, dword [ebp - 0x86c]
cmp esi, edi
setne al
test al, al
je 0x100ab0c8
push esi
lea ecx, [ebp - 0x28]
call fcn.1006e7cf
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x884]
inc ecx
push ecx
lea ecx, [ebp - 0x28]
lea edx, [edx + ebx]
call fcn.100ab3f4
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
lea ebx, [ebx + eax*2]
add ebx, 2
call fcn.1006af06
add esi, 0x18
jmp 0x100ab082
mov edx, dword [ebp - 0x884]
mov ecx, 0x1013c724
push 2
lea edx, [edx + ebx]
call fcn.100ab3f4
push dword [ebp - 0x870]
mov edi, dword [ebp - 0x874]
xor ebx, ebx
push dword [ebp - 0x884]
push 7
push ebx
push edi
push dword [ebp - 0x878]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x100ab11a
lea ecx, [ebp - 0x884]
call fcn.10074e3b
call fcn.10062bca
ret 8
push 0x10032aa0
lea ecx, [ebp - 0x28]
call fcn.1006ab4f
push edi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.10074fff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.1006ac90
push ecx
push ecx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push ebx
push esi
push 0x22
lea ecx, [ebp - 0x868]
call fcn.100a737c
push 0x1011cc58
lea eax, [ebp - 0x868]
push eax
call fcn.100658b4
int3

Function at 0x100ab171
Capabilities:
Set registry value

Disassembly:
push 0x85c
mov eax, 0x1010fb45
call fcn.10062c32
mov esi, edx
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push eax
push dword [ebp + 8]
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x100ab1a5
call fcn.10062bca
ret 0xc
push 0x10032a30
lea ecx, [ebp - 0x28]
call fcn.1006ab4f
push esi
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.10074fff
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1006ac90
push ecx
push ecx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
push ebx
push edi
push 0x22
lea ecx, [ebp - 0x868]
call fcn.100a737c
push 0x1011cc58
lea eax, [ebp - 0x868]
push eax
call fcn.100658b4
int3