joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4701b5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x470252
push ebx
push esi
call fcn.00470171
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0046d258
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4701ff
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x470251
push edi
push eax
call fcn.00469ccc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x47021f
call fcn.00464105
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x470250
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0046d258
add esp, 0x20
test eax, eax
jne 0x47023e
push edi
call fcn.00464105
jmp 0x470246
push ebx
call fcn.00464105
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x470255
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x470266
pop esi
ret
push ebx
push edi
push esi
call fcn.00470171
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00469ccc
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x47028e
push ebx
push esi
push edi
call fcn.00429790
add esp, 0xc
push 0
call fcn.00464105
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x470b6f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00470501

Function at 0x47dcb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47dcdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47dcdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1f717b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1f717ba
pushal
call 0x1f717c0
pop ebp
sub ebp, 0x10
sub ebp, 0x1b717b0
jmp 0x1f717d6
mov eax, 0x1b717b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0x519a283e
xor byte [eax], dl
inc eax
dec ecx
jne 0x1f717ed
jmp 0x1f71800
mov ch, 0xf3
mov ch, 0xb7
add bh, byte [esi]
mov edi, 0x3e3ec6ff
cmp eax, 0x3e3a86f3
test byte ds:[esi], dl
leave
fdivr qword [0x32bfb5f6]
cmp eax, 0x5ab36efb
sbb al, dl
mov bh, 0x3a
sbb dl, byte [esi - 0x1e]
jmp 0xf14d56a0
Function at 0x41dc09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x41dc18
pop dword [ebp - 0x4c]
mov eax, 0x41dc18
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x39dbc
push 0
mov eax, 0x320f13bf
sub eax, 0x31ccc29f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5a71db9d
add ecx, 0xa58e622e
xor edx, edx
add edx, eax
mov ebx, 0xea6d1182
sub ebx, 0xea29e382
add ebx, dword [ebp - 0x4c]
mov edi, 0xaedcd150
sub edi, 0x83c946d0
add dword [ebp - 0x34], 0xcbf331c4
mov esi, dword [ebx]
add dword [ebp - 0x10], ebx
add esi, edi
xor dword [ebp - 8], ebx
mov dword [edx], esi
sub dword [ebp - 0x18], ebx
add edx, 0x402dd033
add edx, 0xbfd22fd1
add ebx, 0xb118c8a
sub ebx, 0xb118c86
loop 0x41dc74
add eax, 0xe9ff
mov ebx, eax
add eax, 5
mov ecx, 0x1176e445
add ecx, 0xeec91bbb
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4078f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4078ff
pop dword [ebp - 0xc]
mov eax, 0x4078ff
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xe66262d4
add dword [ebp - 0x1c], 0x67efe277
mov dword [ebp - 0x18], 0xbf2afc9c
sub dword [ebp - 0x18], 0x8cf7b057
mov dword [ebp - 0x14], 0x23a40a12
add dword [ebp - 0x14], 0x28a83a1c
mov dword [ebp - 0x10], 0xe50e075a
sub dword [ebp - 0x10], 0xe50e075a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x5a9b6445
add eax, 0xa5a6cc2f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5933f1f4
sub dword [ebp - 0x1c], 0xe4c1889e
mov dword [ebp - 0x18], 0x61d0c058
sub dword [ebp - 0x18], 0x20645ee3
mov dword [ebp - 0x14], 0x8c5e030f
add dword [ebp - 0x14], 0xd711695d
mov dword [ebp - 0x10], 0xb65264b5
sub dword [ebp - 0x10], 0xb65264b5
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c23a
push 0
call eax
mov ecx, 0x85f31a4c
sub ecx, 0x85f2d87b
mov ebx, eax
mov esi, 0xa1b18438
sub esi, 0xa16e4038
add esi, dword [ebp - 0xc]
mov edx, 0xc852af71
sub dword [ebp - 4], edx
mov edi, dword [esi]
add dword [ebp - 4], 0x5a595fae
xor edi, edx
xor dword [ebp - 8], 0x3e32de07
mov dword [ebx], edi
add dword [ebp - 8], 0x548937b1
add ebx, 4
add esi, 0x1ca5e118
add esi, 0xe35a1eec
loop 0x407a11
add eax, 0xfa17
mov ebx, eax
add eax, 0xba7c5365
sub eax, 0xba7c5360
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0xaea058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aea1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaea07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaea06a
add dl, dl
jne 0xaea089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaea0dc
xor eax, eax
add dl, dl
jne 0xaea096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaea17d
add dl, dl
jne 0xaea0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaea0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaea0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaea0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaea0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaea075
mov eax, 1
add dl, dl
jne 0xaea0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaea0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaea0e1
sub eax, ebx
mov ebx, 1
jne 0xaea128
mov ecx, 1
add dl, dl
jne 0xaea10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaea119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaea105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaea075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaea13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaea14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaea136
cmp eax, 0x7d00
jae 0xaea16d
cmp eax, 0x500
jb 0xaea168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaea075
cmp eax, 0x7f
ja 0xaea170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaea075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaea19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaea075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100a04a
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1027b08
call fcn.0100a334
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x102ca9c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1009e5d
cmp eax, esi
jne 0x1009e50
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1009e60
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1009e37
xor esi, esi
inc esi
mov eax, dword [0x102ca98]
cmp eax, esi
jne 0x1009e73
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1009eae
mov eax, dword [0x102ca98]
test eax, eax
jne 0x1009ea8
mov dword [0x102ca98], esi
push 0x10013b0
push 0x10013a4
call fcn.01009db4
pop ecx
pop ecx
test eax, eax
je 0x1009eae
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1009f78
mov dword [0x102c64c], esi
mov eax, dword [0x102ca98]
cmp eax, esi
jne 0x1009ed2
push 0x10013a0
push 0x10012ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x102ca98], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1009edf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x102caa0], ebx
je 0x1009f00
push 0x102caa0
call fcn.0100a2a9
pop ecx
test eax, eax
je 0x1009f00
push ebx
push 2
push ebx
call dword [0x102caa0]
push dword [0x102c634]
push dword [0x102c638]
push dword [0x102c630]
call fcn.01009b04
add esp, 0xc
mov dword [0x102c648], eax
cmp dword [0x102c63c], ebx
jne 0x1009f5e
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x102c64c], ebx
jne 0x1009f6c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x102c648]
call fcn.0100a379
ret
call fcn.0100a527
jmp 0x1009e15
Function at 0x100a7b1
Capabilities:
Link many functions at runtime

Disassembly:
push 0x14
mov eax, 0x10258cc
call fcn.0100a086
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x10], 0x1001c58
cmp ebx, edi
je 0x100a7fe
mov esi, ebx
mov dword [ebp - 0x10], ebx
cmp word [ebx], di
je 0x100a7f6
push 7
push 0x1002b30
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
inc esi
inc esi
mov dword [ebp - 0x10], esi
test eax, eax
je 0x100a7f6
cmp word [esi], di
jne 0x100a7d7
cmp word [esi], di
jne 0x100a7fe
mov dword [ebp - 0x10], ebx
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x100a828
test byte [eax + 0x1c], 0x80
je 0x100a828
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push 0x1002a4c
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6d3
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x100a83c
mov ecx, dword [eax]
push 0x4033c3ab
push eax
call dword [ecx + 0x28]
pop ecx
pop ecx
push 0x1002b20
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x100a905
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002b10
push ebx
call esi
push 0x1002af8
push ebx
mov dword [ebp - 0x14], eax
call esi
push 0x1002ae4
push ebx
mov dword [ebp + 0x18], eax
call esi
push 0x1002ad4
push ebx
mov dword [ebp - 0x18], eax
call esi
push 0x1002abc
push ebx
mov dword [ebp - 0x1c], eax
call esi
mov esi, eax
cmp dword [ebp - 0x14], edi
je 0x100a905
cmp dword [ebp - 0x18], edi
je 0x100a905
cmp dword [ebp + 0x18], edi
je 0x100a905
cmp dword [ebp - 0x1c], edi
je 0x100a905
cmp esi, edi
je 0x100a905
lea eax, [ebp + 8]
push eax
push edi
push edi
push 0x1002aa4
mov dword [ebp + 8], edi
call dword [ebp - 0x14]
test eax, eax
jne 0x100a905
push edi
push edi
push edi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp + 8]
call dword [ebp - 0x18]
push dword [ebp - 0x10]
push 0x1002a90
push edi
push dword [ebp + 8]
call dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0x1002a78
push 1
push dword [ebp + 8]
call dword [ebp + 0x18]
push edi
push 0x80
push 2
push dword [ebp + 8]
call dword [ebp - 0x1c]
push dword [ebp + 8]
call esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, edi
je 0x100a919
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0100a172
ret 0x14
Function at 0x100c6d3
Capabilities:
Check os version
Delete registry key
Get common file path

Disassembly:
push 0x334
mov eax, 0x1025917
call fcn.0100a0f9
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100c714
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100c806
cmp dword [ebp - 0x334], 5
ja 0x100c741
jne 0x100c734
cmp dword [ebp - 0x330], 2
ja 0x100c741
jne 0x100c734
cmp word [ebp - 0x224], 1
jae 0x100c741
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x100c806
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100c709
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100c763
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebp + eax*2 - 0x21e]
lea eax, [ebp - 0x21c]
jne 0x100c78b
push 0x10036a4
jmp 0x100c790
push 0x1003688
push esi
push eax
call fcn.0100b5f5
cmp eax, edi
jge 0x100c7b2
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x100c806
and eax, 0xffff
jmp 0x100c806
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x340], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x100c709
push 0x1003678
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
jne 0x100c7ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100c7fb
push edi
push 0x100
push dword [ebp - 0x33c]
push ebx
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
call fcn.0100a18b
ret 8
Function at 0x100deeb
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x18
mov eax, 0x1025a44
call fcn.0100a086
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, edi
jne 0x100df21
push edi
push 0x54f
push 0x10039b8
push 0xc55
push 0x10032f8
call fcn.0100a7b1
xor eax, eax
jmp 0x100e040
mov esi, dword [ebp + 0xc]
cmp esi, edi
jne 0x100df3a
push ebx
push 0x54f
push 0x10039ac
push 0xc56
jmp 0x100df10
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x100df3f
sub eax, ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
sar eax, 1
push 4
push eax
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x100df96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xd
jne 0x100df84
mov eax, 0x803380b7
mov ecx, dword [ebx]
push esi
push 0x4033c3a9
push eax
push ebx
call dword [ecx + 0x1c]
add esp, 0x10
jmp 0x100df1a
push edi
lea eax, [ebp - 0xd]
push eax
push 8
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
cmp eax, edi
je 0x100dfaf
mov dword [eax], edi
mov dword [eax + 4], edi
mov esi, eax
jmp 0x100dfb1
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], edi
cmp esi, edi
jne 0x100dfc7
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
jmp 0x100df1a
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
push edi
lea eax, [ebp - 0xe]
push eax
push dword [ebp - 0x14]
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
lea ebx, [esi + 4]
push eax
mov ecx, ebx
call fcn.0101569e
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x100e000
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
mov ecx, esi
call fcn.0100cf32
jmp 0x100df1a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 4
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x100e03e
mov ebx, dword [ebp + 8]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1003984
push 0x4033c360
push ebx
call dword [edi + 0x28]
add esp, 0x10
jmp 0x100dff2
mov eax, esi
call fcn.0100a172
ret 8
Function at 0x100e614
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x100e645
test dword [eax + 0x1c], 0x1000
je 0x100e645
push ecx
push 0x1003b6c
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 9
push dword [ebp - 4]
push 0x59
push dword [ebp + 8]
call esi
mov ebx, 0x54f
mov edi, 0x1003b90
test eax, eax
jne 0x100e679
push dword [ebp + 0xc]
push ebx
push 0x1003b84
push 0x55
push edi
call fcn.0100a7b1
mov eax, dword [ebp - 4]
push 9
add eax, 0x12
push eax
push 0x5a
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100e69e
push dword [ebp + 0xc]
push ebx
push 0x1003b7c
push 0x59
push edi
call fcn.0100a7b1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10101b1
Capabilities:
Start http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
inc eax
push esi
mov word [ebp - 4], ax
xor eax, eax
push eax
push 2
mov word [ebp - 2], ax
push dword [ebp - 4]
mov esi, ecx
and dword [esi], 0
call dword [sym.imp.HTTPAPI.dll_HttpInitialize]
mov dword [esi], eax
test eax, eax
je 0x1010206
mov ecx, dword [0x102b00c]
cmp ecx, 0x102b00c
je 0x1010206
test dword [ecx + 0x1c], 0x400000
je 0x1010206
push eax
push 0x10040b8
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01019984
mov eax, esi
pop esi
leave
ret
Function at 0x1010d13
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x1010d43
push dword [ebp + 8]
push 0x54f
push 0x10042b0
push 0x341
push 0x1004118
call fcn.0100a7b1
xor eax, eax
jmp 0x1010e61
cmp dword [ebp + 0x18], edi
jne 0x1010d5c
push dword [ebp + 8]
push 0x54f
push 0x10042a8
push 0x342
jmp 0x1010d32
push ebx
mov ebx, dword [ebp + 0x1c]
cmp ebx, edi
jne 0x1010d87
push dword [ebp + 8]
push 0x54f
push 0x10042a0
push 0x343
push 0x1004118
call fcn.0100a7b1
xor eax, eax
jmp 0x1010e60
push esi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
mov eax, 0x103
cmp esi, eax
jne 0x1010db0
push eax
jmp 0x1010e52
cmp esi, edi
je 0x1010df9
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1010ddc
test dword [eax + 0x1c], 0x400000
je 0x1010ddc
push esi
push 0x10040b8
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1010e51
mov ecx, dword [eax]
push esi
push 0x1004284
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
jmp 0x1010e51
push 0x1004280
push dword [ebp + 0x18]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebx], eax
cmp eax, edi
jne 0x1010e5c
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1010e36
test dword [eax + 0x1c], 0x400000
je 0x1010e36
push 0x10040b8
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100904c
mov eax, dword [ebp + 8]
mov esi, 0x80338005
cmp eax, edi
je 0x1010e51
mov ecx, dword [eax]
push 0x4033c44a
push esi
push eax
call dword [ecx + 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1010e5f
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x101126f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x101129f
push dword [ebp + 8]
push 0x54f
push 0x1004330
push 0x8f0
push 0x1004118
call fcn.0100a7b1
xor eax, eax
jmp 0x10113a2
cmp dword [ebp + 0x18], esi
jne 0x10112b8
push dword [ebp + 8]
push 0x54f
push 0x1004324
push 0x8f1
jmp 0x101128e
cmp dword [ebp + 0x1c], esi
jne 0x10112d1
push dword [ebp + 8]
push 0x54f
push 0x1004318
push 0x8f2
jmp 0x101128e
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
mov eax, 0x103
cmp edi, eax
jne 0x10112fa
push eax
jmp 0x1011394
cmp edi, esi
je 0x1011335
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011326
test dword [eax + 0x1c], 0x400000
je 0x1011326
push edi
push 0x10040b8
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1011393
push edi
push 0x1004284
jmp 0x1011385
push dword [ebp + 0x1c]
push 0x20119
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x101139e
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011378
test dword [eax + 0x1c], 0x400000
je 0x1011378
push edi
push 0x10040b8
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019984
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1011393
push edi
push 0x1003eb0
mov ecx, dword [eax]
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10113a1
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1011931
Capabilities:
Query or enumerate registry key

Disassembly:
push 8
mov eax, 0x1025c7e
call fcn.0100a086
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
jne 0x101196a
push esi
push 0x54f
push 0x1004478
push 0x377
push 0x1004118
call fcn.0100a7b1
xor eax, eax
call fcn.0100a172
ret 0xc
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011991
test dword [eax + 0x1c], 0x200000
je 0x1011991
push 0x10040b8
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100904c
push 2
pop edx
xor ecx, ecx
mov eax, 0x100
mov dword [ebp - 0x14], eax
mul edx
seto cl
push esi
neg ecx
or eax, ecx
lea ecx, [ebp + 0x13]
push ecx
push eax
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
push eax
lea ecx, [ebp - 0x10]
call fcn.0100c374
mov dword [ebp - 4], esi
cmp dword [ebp - 0x10], esi
jne 0x10119d9
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0100c51b
jmp 0x1011960
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, 0x103
cmp eax, ecx
jne 0x10119fc
push ecx
jmp 0x10119c5
cmp eax, esi
je 0x1011a1a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0100c51b
mov eax, esi
jmp 0x1011962
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
xor eax, eax
inc eax
mov dword [ebp - 0x10], esi
mov dword [edi + 0xc], eax
mov esi, eax
jmp 0x1011a07