joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e6c0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e86b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44e84c
mov dl, 1
mov eax, dword [0x4153dc]
call fcn.004034b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404288
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44e83b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043c600
test al, al
je 0x44e82e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44e87c
lea eax, [ebp - 0x254]
call fcn.00409174
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44e82e
xor eax, eax
push ebp
push 0x44e827
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44e8b4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44e810
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e810
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e82e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44e731
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00418f40
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e872
lea eax, [ebp - 0x260]
call fcn.00404288
ret

Function at 0x44f1b4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x55bb48]
cmp byte [eax + 0xa5], 0
jne 0x44f225
cmp dword [0x55bb60], 0
jne 0x44f1e6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44f170
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x55bb60], eax
cmp dword [0x55bb5c], 0
jne 0x44f201
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x55bb5c], eax
cmp dword [0x55bb64], 0
jne 0x44f225
push esp
push 0
push 0
push 0x44f114
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x55bb64], eax
pop edx
ret
Function at 0x44f8b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x55bb48]
cmp dword [eax + 0x30], 0
je 0x44f962
cmp dword [ebx + 0x94], 0
jne 0x44f95c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f848
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f95c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f922
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f95c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041733c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f931
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4504c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4504f5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404378
jmp 0x450502
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x451614
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x451655
mov eax, esi
call fcn.00437db8
test al, al
je 0x451655
mov eax, dword [ebx + 0x84]
call fcn.00437b58
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x451655
push 0
mov eax, dword [ebx + 0x84]
call fcn.00437b58
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45589c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4558ca
mov eax, ebx
call fcn.00456350
cmp dword [ebx + 0x40], 0
je 0x4558c3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45593b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45592d
cmp dword [ebx + 8], 0
je 0x4558ec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4558fe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45592d
cmp dword [ebx + 8], 0
je 0x4558df
cmp eax, 3
je 0x455911
dec eax
jne 0x4558df
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4558df
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4558df
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x455959
cmp dword [ebx + 0x14], 0xcc
je 0x455959
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00455964
pop ebx
ret
Function at 0x46645c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414808]
call fcn.00404bf8
xor eax, eax
push ebp
push 0x4665a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46d758], 0
jne 0x4664af
mov ecx, dword [0x55a79c]
mov dl, 1
mov eax, dword [0x407494]
call fcn.0040bbcc
call fcn.00403c80
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ed4
mov eax, ebx
call fcn.00404ac4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4665b0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405c38
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ad4
test eax, eax
jle 0x466547
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x466540
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404510
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004044f8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040832c
test eax, eax
jne 0x466540
mov ebx, 0x15
jmp 0x46654c
mov ebx, 0x10
jmp 0x46654c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46d758]
call fcn.004662d4
mov eax, dword [ebp - 8]
call fcn.004662d4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405c50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4665a7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042ac
lea eax, [ebp - 0x10]
mov edx, dword [0x414808]
call fcn.00404cc8
ret

Function at 0x467a44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404738
mov eax, dword [ebp - 8]
call fcn.00404738
xor eax, eax
push ebp
push 0x467af4
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
push esi
call sub.kernel32.dll_LoadLibraryW
test eax, eax
push esi
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x55bc24], eax
cmp dword [0x55bc24], 0
je 0x467ad9
mov eax, dword [ebp - 8]
call fcn.00404748
push eax
mov eax, dword [0x55bc24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55bc28], eax
mov eax, dword [0x55bc2c]
push eax
push 0x40
push 0x15751a34
push 0x55bc28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.nTDLL_ZwProtectVirtualMemory
mov edx, 0x55bc28
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.00467a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467afb
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042ac
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x404aa3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov dword [ebp - 4], 0x7f83677c
sub dword [ebp - 4], 0x1715
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mul dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x10], 0
jmp 0x404bc4
mov eax, ebx
add eax, esi
push eax
call fcn.0040423c
pop ecx
mov edx, eax
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
mov edx, eax
add edx, eax
mov dword [ebp - 4], edx
cmp byte [ebp - 5], 0
jne 0x404b09
mov byte [ebp - 6], 0
jmp 0x404b33
call 0x409b00
mov dword [ebp - 0x20], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 5]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 6], dl
mov al, byte [esi + ebx]
cmp al, 0x70
jb 0x404b4e
cmp al, 0x7f
ja 0x404b4e
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
movzx eax, byte [esi + ebx]
cmp eax, 0xe2
jne 0x404b69
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
mov eax, 0x3e96
mul dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
push 8
push 0x90
lea eax, [ebp - 0xe]
push eax
call 0x409adc
movzx eax, byte [ebp - 5]
push eax
mov eax, ebx
add eax, esi
push eax
lea eax, [ebp - 0xe]
movzx edx, byte [ebp - 6]
add eax, edx
push eax
call 0x409ad0
push 6
lea eax, [ebp - 0xe]
push eax
mov eax, ebx
add eax, esi
push eax
call 0x409ad0
add esp, 0x24
mov eax, dword [ebp - 4]
mov edx, eax
xor edx, eax
mov dword [ebp - 4], edx
add esi, 6
inc word [ebp - 0x10]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x404ae3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100031c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100031d6
pop dword [ebp - 0x40]
mov eax, 0xa5dbd31c
add eax, 0x6a245eba
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x87d4f791
sub dword [ebp - 0x50], 0x3982b246
mov dword [ebp - 0x4c], 0x4fb9bbc2
sub dword [ebp - 0x4c], 0x1d866f7d
mov dword [ebp - 0x48], 0xbf804d4d
sub dword [ebp - 0x48], 0x7334091f
mov dword [ebp - 0x44], 0x7104e43
add dword [ebp - 0x44], 0xf8efb1bd
lea eax, [ebp - 0x50]
push eax
mov eax, 0x42f5aafa
sub eax, 0x32f42a46
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xfddc3d48
sub dword [ebp - 0x50], 0x8969d3f2
mov dword [ebp - 0x4c], 0x3f28eb2c
add dword [ebp - 0x4c], 0x2437649
mov dword [ebp - 0x48], 0x1e8cbcc0
add dword [ebp - 0x48], 0x44e2afac
mov dword [ebp - 0x44], 0xa7afd60a
sub dword [ebp - 0x44], 0xa7afd60a
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39580
push 0
call eax
mov ecx, 0x4cb2f880
add ecx, 0xb34d4704
mov esi, eax
mov edi, 0xbb6c6baa
sub edi, 0xab69f9aa
add edi, dword [ebp - 0x40]
mov edx, 0x49aef519
add dword [ebp - 0x1c], eax
mov ebx, dword [edi]
mov dword [ebp - 0x34], 0x61bc8750
xor ebx, edx
sub dword [ebp - 0x2c], edx
mov dword [esi], ebx
mov dword [ebp - 8], 0xdaa981ad
add esi, 0xace1537f
add esi, 0x531eac85
add edi, 4
loop 0x100032ed
add eax, 0xf0e3
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3d8d6a04
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7c217fc3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100013b9
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100013c1
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 2
push 0
push dword [esp + 0x18]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 8

Function at 0x100013f2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x10001408
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteExpandString_wchar_t_const___wchar_t_const__
jmp 0x1000143b
mov eax, dword [ebp + 0xc]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1000140f
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x1000143f
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x1007603b
call fcn.100751fa
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x10001508
cmp dword [ebp - 0x10], 1
je 0x10001487
cmp dword [ebp - 0x10], 2
jne 0x10001508
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov ebx, eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax + 1]
push eax
push 0
push ebx
call sub.MSVCR90.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100014fc
cmp dword [ebp - 0x10], 1
je 0x100014d7
cmp dword [ebp - 0x10], 2
jne 0x100014fc
push ebx
lea ecx, [ebp + 8]
call dword [0x10096f84]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call dword [0x10096f88]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push ebx
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x1000150a
xor eax, eax
call fcn.100752d2
ret 8

Function at 0x10001512
Capabilities:
Set registry value

Disassembly:
push 4
push dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x100015a3
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 0xc
Function at 0x1000174e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x100e5038]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x18
mov eax, 0x10075fd9
call fcn.100751fa
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x40c]
mov esi, ecx
xor edi, edi
push 0x1009f454
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [0x10096f84]
xor eax, eax
mov dword [ebp - 4], edi
push 0x3fe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
mov dword [ebp - 0x1c], edi
push edi
push ebx
push dword [esi + 8]
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001800
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call sub.mfc90u.dll_CStringArray::SetSize
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jbe 0x10001856
cmp esi, edi
je 0x10001856
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001850
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_4]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ecx + 8]
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10001807
cmp dword [ebp - 0x10], edi
je 0x10001867
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x1000186e
xor edi, edi
inc edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.10074156
add ebp, 0x404
leave
ret 8
Function at 0x10001924
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov edi, ecx
push dword [edi + 8]
call esi
cmp dword [ebp - 4], 2
mov edx, dword [ebp + 0x10]
sete cl
mov byte [edx], cl
test eax, eax
jne 0x100019b4
cmp dword [ebp - 4], 1
je 0x1000196b
cmp dword [ebp - 4], 2
jne 0x100019b4
push dword [ebp - 8]
call sub.mfc90u.dll_new__
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100019a6
cmp dword [ebp - 4], 1
je 0x1000199a
cmp dword [ebp - 4], 2
jne 0x100019a6
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push dword [ebp + 0x10]
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x100019b6
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x100019bc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10075faf
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x100e5038]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
push 2
mov edi, 0x1000
push edi
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0x10
push edi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call sub.mfc90u.dll_CMemFile::CMemFile
xor ebx, ebx
push ebx
push edi
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xa0], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x3c]
mov byte [esp + 0x90], 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
lea ecx, [esp + 0x3c]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x14]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 3
xor esi, esi
cmp dword [esp + 0x10], esi
je 0x10001a8d
push dword [esp + 0x10]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
cmp ebx, esi
jne 0x10001a94
xor esi, esi
inc esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x90], 0
call fcn.10073668
or dword [esp + 0x90], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1007365c
mov eax, esi
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8