joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414af0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435018
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x44a214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00417b1e
mov edi, eax
add esp, 4
test edi, edi
je 0x414b93
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004118fc
add esp, 4
mov dword [edi + 4], eax
jmp 0x414b95
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00401e60
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x414bf5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x414bf5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x414c19
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x414c3b
cmp byte [ebp + 0xc], 0
je 0x414c28
push esi
call fcn.00412274
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x414c47
mov esi, str.ios_base::badbit_set
jmp 0x414c57
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00409410
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00402c00
push 0x446bb4
lea eax, [ebp - 0x30]
push eax
call fcn.00418e8c
int3
Function at 0x4160a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x44a214]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x44c268
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x416180
movzx ecx, word [esi + eax]
test cx, cx
je 0x416180
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x416162
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418008
mov esp, ebp
pop ebp
ret

Function at 0x416980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x44a214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x44c4f8
mov dword [ebp - 0x5c], 0x680043
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x6e0065
push edi
mov dword [ebp - 0x54], 0x640067
mov edx, 0x2c
mov dword [ebp - 0x50], 0x200075
sub esi, eax
mov dword [ebp - 0x4c], 0x690041
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x6e0061
mov dword [ebp - 0x40], 0x200067
mov dword [ebp - 0x3c], 0x66004f
mov dword [ebp - 0x38], 0x690066
mov dword [ebp - 0x34], 0x650063
mov dword [ebp - 0x30], 0x540020
mov dword [ebp - 0x2c], 0x630065
mov dword [ebp - 0x28], 0x6e0068
mov dword [ebp - 0x24], 0x6c006f
mov dword [ebp - 0x20], 0x67006f
mov dword [ebp - 0x1c], 0x200079
mov dword [ebp - 0x18], 0x6f0043
mov dword [ebp - 0x14], 0x2c002e
mov dword [ebp - 0x10], 0x4c0020
mov dword [ebp - 0xc], 0x640074
mov dword [ebp - 8], 0x2e
nop dword [eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x416a5e
movzx ecx, word [esi + eax]
test cx, cx
je 0x416a5e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x416a40
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418008
mov esp, ebp
pop ebp
ret
Function at 0x42ce91
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042cb51

Function at 0x417f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f80
mov eax, 1
add ebx, ebx
jne 0x417fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f98
jne 0x417fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f98
xor ecx, ecx
sub eax, 3
jb 0x417fc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41803a
mov ebp, eax
add ebx, ebx
jne 0x417fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418004
inc ecx
add ebx, ebx
jne 0x417ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fe5
jne 0x418001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fe5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418015
jmp 0x417f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418024
add edi, ecx
jmp 0x417f86
pop esi
mov edi, esi
mov ecx, 0x315
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418042
cmp byte [edi], 4
jne 0x418042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418047
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4180bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418074
mov ecx, edi
jns 0x4180a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x4180b9
mov dword [ebx], eax
add ebx, 4
jmp 0x418091
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180f3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4f238d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f2203

Function at 0x53fdf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
or ebp, 0xffffffff
jmp 0x53fe12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53fe19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe08
mov eax, 1
add ebx, ebx
jne 0x53fe2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53fe3c
jne 0x53fe4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe4c
dec eax
add ebx, ebx
jne 0x53fe48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53fe20
xor ecx, ecx
sub eax, 3
jb 0x53fe64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53fed6
sar eax, 1
mov ebp, eax
jmp 0x53fe6f
add ebx, ebx
jne 0x53fe6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x53fe7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x53fea0
inc ecx
add ebx, ebx
jne 0x53fe8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53fe81
jne 0x53fe9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53fe81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53fec0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53feb1
jmp 0x53fe0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53fec0
add edi, ecx
jmp 0x53fe0e
pop esi
mov edi, esi
mov ecx, 0x39e0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53fede
cmp byte [edi], 0x28
jne 0x53fede
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x53fee3
lea edi, [esi + 0x13c000]
mov eax, dword [edi]
or eax, eax
je 0x53ff5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1410b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1411f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53ff10
mov ecx, edi
jns 0x53ff3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1411f8]
or eax, eax
je 0x53ff55
mov dword [ebx], eax
add ebx, 4
jmp 0x53ff2d
call dword [esi + 0x1411fc]
popal
jmp 0x422c92
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x50d731a3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x54375e23
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100013d0
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalSSLUSR_LOGIN
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100013f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10001404
mov eax, 1
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x10001840
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalSSLUSR_LOGIN
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10001864
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1000186b
xor eax, eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x100165b0], 5
sbb eax, eax
neg eax
ret

Function at 0x10001970
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x100165b0]
cmp eax, 5
jge 0x100019c2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, 5
push edi
mov edi, dword [sym.imp.MSVCRT.dll__beginthreadex]
sub esi, eax
lea eax, [eax*4 + 0x1001659c]
push eax
push 0
push 0
push 0x10001880
push 0
push 0
call edi
add esp, 0x18
test eax, eax
je 0x100019b4
inc dword [0x100165b0]
push eax
call ebx
mov eax, dword [0x100165b0]
dec esi
jne 0x10001990
pop edi
pop esi
pop ebx
push eax
push str.CreateThreads:_count___d
call fcn.10004980
add esp, 8
mov eax, 1
ret
Function at 0x10004980
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40c
push esi
push edi
mov ecx, 0x102
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x10015194
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x418]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x13]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x41c]
mov byte [esp + 0x12], 0x20
push ecx
push edx
push 0x3ff
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x40c
ret

Function at 0x10004a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x70
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
mov dword [esp + 8], 0x63
push eax
push 1
push 0
push str.SOFTWARESangforSSL
push SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x10004a83
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.Language
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], 0
lea eax, [esp + 0xc]
push 0x1001661c
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x10004ab8
lea ecx, [esp + 0xc]
push str.zh_CN
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
mov eax, str.zh_CN
je 0x10004ace
jmp 0x10004ac9
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x804
mov eax, str.zh_CN
je 0x10004ace
mov eax, str.en_US
push 0x63
push eax
push 0x100165b8
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov eax, 0x100165b8
add esp, 0x70
ret
Function at 0x10004c60
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
push edi
mov edi, dword [esp + 0xa0]
test edi, edi
je 0x10004ce3
push 0x1001661c
push edi
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x10004ce3
push str.zh_CN
push edi
xor esi, esi
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x10004ca0
mov esi, 1
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10004cec
mov dword [esp + 0xc], 5
neg esi
sbb esi, esi
and esi, 0x3fb
add esi, 0x409
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
pop edi
pop esi
add esp, 0x94
ret
cmp dword [esp + 0xc], 6
jb 0x10004ccc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetThreadUILanguage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10004ce3
neg esi
sbb esi, esi
and esi, 0x3fb
add esi, 0x409
push esi
call eax
pop edi
pop esi
add esp, 0x94
ret

Function at 0x10005060
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.dbghelp.dll_SymGetModuleBase]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000508b
mov eax, dword [ebp - 0x20]
jmp 0x1000515b
push 0x1c
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x10005158
push 0x104
lea edx, [ebp - 0x330]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x22c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x104
lea edx, [ebp - 0x128]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x100151f8
lea edx, [ebp - 0x128]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
lea eax, [ebp - 0x330]
and edx, eax
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.dbghelp.dll_SymLoadModule]
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100067c0
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x10016708
push esi
test eax, eax
jne 0x100067e3
push str.CLSID1465DEB2_3910_4187_967A_2CB6E8690201
push SysReAllocString
mov esi, 0x80070057
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, esi
pop esi
ret
mov esi, dword [0x10016718]
cmp dword [esi], 0
je 0x10006836
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100067fb
call eax
test eax, eax
jne 0x10006820
push 0
call dword [esi + 4]
cmp dword [0x10016708], 0x84
jne 0x10006820
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1000682e
push 0
call eax
mov ecx, dword [esi]
push eax
push ecx
call fcn.1000aba0
cmp dword [0x10016708], 0x64
jne 0x1000682e
add esi, 0x1c
jmp 0x10006831
add esi, 0x24
cmp dword [esi], 0
jne 0x100067ee
push 0
push 0x10016708
call fcn.1000ad90
push str.CLSID1465DEB2_3910_4187_967A_2CB6E8690201
push SysReAllocString
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, esi
pop esi
ret
Function at 0x10006860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100103b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.CLSID1465DEB2_3910_4187_967A_2CB6E8690201Implemented_Categories7DD95802_9882_11CF_9FA9_00AA006C42C4
push SysReAllocString
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
jne 0x100069bb
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, esi
je 0x100068c1
push ecx
call ebx
mov ecx, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], ecx
jne 0x100069bf
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
push ecx
push 0x20019
push esi
push str.CLSID1465DEB2_3910_4187_967A_2CB6E8690201Implemented_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
push SysReAllocString
call edi
cmp eax, esi
jne 0x100069bb
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, esi
je 0x10006901
push ecx
call ebx
mov ecx, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], ecx
jne 0x100069bf
lea edx, [esp + 0x10]
mov dword [esp + 0x10], esi
push edx
push 0x20019
push esi
push str.CLSIDFFD2FD1F_C991_4A2F_8557_CDB11E690201Implemented_Categories7DD95802_9882_11CF_9FA9_00AA006C42C4
push SysReAllocString
call edi
cmp eax, esi
jne 0x100069bb
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, esi
je 0x10006941
push ecx
call ebx
mov ecx, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], ecx
jne 0x100069bf
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push 0x20019
push esi
push str.CLSIDFFD2FD1F_C991_4A2F_8557_CDB11E690201Implemented_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
push SysReAllocString
call edi
cmp eax, esi
jne 0x100069bb
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, esi
je 0x10006979
push ecx
call ebx
mov ecx, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], ecx
jne 0x100069bf
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
push ecx
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsFFD2FD1F_C991_4A2F_8557_CDB11E690201
push reloc.OLEAUT32.dll_SysReAllocString
call edi
cmp eax, esi
jne 0x100069bb
lea ecx, [esp + 0xc]
call fcn.10008a60
mov ecx, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], ecx
je 0x100069da
jmp 0x100069bf
mov ecx, dword [esp + 0xc]
cmp ecx, esi
je 0x100069c6
push ecx
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp ecx, esi
je 0x100069e1
push ecx
call ebx
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1000a3b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x100105ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x1000a428
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x1000a418
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x1000a43a
jmp 0x1000a42c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x1000a4d5
push ecx
jmp 0x1000a4cf
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x1000a4a0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.1000a3b0
mov ebx, eax
cmp ebx, edi
jne 0x1000a4f1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x1000a462
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1000a4b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1000a4d5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1000a500
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000a4d7