joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006abd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x218], esi
test ebx, ebx
je 0x1006ada0
cmp dword [ebx], 2
jne 0x1006ada0
cmp dword [esi + 0x14], 8
jb 0x1006ac16
mov esi, dword [esi]
mov dword [ebp - 0x218], esi
cmp dword [ebx + 0x10], 0
je 0x1006ac30
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1006ac1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1006ac4b
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x1006ac1c
mov ecx, dword [ebx + 0x20]
mov eax, 0x532ae21d
push edi
mov edi, dword [ebx + 0x1c]
mov esi, 1
sub ecx, edi
mov dword [ebp - 0x210], 0
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1006ad8d
mov dword [ebp - 0x214], 0
nop dword [eax]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1008f5e0
mov eax, dword [ebp - 0x214]
add esp, 0xc
add eax, 4
add eax, edi
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006acd0
sub eax, edx
xor ecx, ecx
sar eax, 1
je 0x1006ad0e
lea ebx, [ecx + 0x5c]
nop word [eax + eax]
cmp word [ebp + ecx*2 - 0x20c], 0x2f
jne 0x1006ad03
mov word [ebp + ecx*2 - 0x20c], bx
inc ecx
cmp ecx, eax
jb 0x1006acf0
mov ebx, dword [ebp - 0x21c]
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebp - 0x214]
mov eax, dword [eax + edi]
test byte [eax + 0x26], 0x10
je 0x1006ad31
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x1006ad56
test esi, esi
je 0x1006ad54
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
push dword [ebp - 0x210]
call fcn.1006adc0
test eax, eax
je 0x1006ad54
mov esi, 1
jmp 0x1006ad56
xor esi, esi
mov ecx, dword [ebx + 0x20]
add edi, 0x314
inc dword [ebp - 0x210]
mov eax, 0x532ae21d
mov dword [ebp - 0x214], edi
mov edi, dword [ebx + 0x1c]
sub ecx, edi
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [ebp - 0x210], ecx
jb 0x1006ac90
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1006b290
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c049f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100f4384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.100683d7
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x1006b2e7
push 0x58
push 0
push esi
call fcn.1008f5e0
add esp, 0xc
mov ecx, esi
call fcn.1006a480
mov esi, eax
jmp 0x1006b2e9
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x1006b2fb
mov edi, dword [edi]
test edi, edi
je 0x1006b398
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1006b398
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1006b398
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x1006b398
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x1006b398
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x1006b398
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.1006a730
test eax, eax
je 0x1006b398
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1006b3ae
mov ecx, esi
call fcn.1006a5a0
push 0x58
push esi
call fcn.10068042
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006b890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x1006b98f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1006b98f
or eax, 0xffffffff
cmp esi, 8
jb 0x1006b967
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
sub edi, 1
jne 0x1006b8c0
pop edi
test esi, esi
je 0x1006b98a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100d1598]
sub esi, 1
jne 0x1006b970
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1006df60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xffff0000
push ebx
push esi
movzx eax, cx
mov esi, ecx
sub esi, eax
test eax, eax
push edi
mov edi, dword [ebp + 8]
cmove esi, ecx
cmp esi, edi
jbe 0x1006e01e
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x1006dfb4
mov esi, 0x4fff0000
jmp 0x1006e01a
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006e01e
cmp dword [ebp - 0x10], 0x10000
jne 0x1006e005
cmp dword [ebp - 0x14], 0x10000
jb 0x1006e005
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x1006e020
sub esi, 0x10000
jmp 0x1006e01a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov esi, ecx
movzx eax, si
sub esi, eax
test eax, eax
cmove esi, ecx
cmp esi, edi
ja 0x1006dfa0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100683c1
mov esp, ebp
pop ebp
ret

Function at 0x1006e040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
push edi
test eax, eax
je 0x1006e065
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1006e100
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop word [eax + eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x1006e094
mov esi, 0x80010000
jmp 0x1006e0fc
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006e100
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x1006e0e7
cmp ecx, 0x10000
jb 0x1006e0e7
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x1006e102
add esi, 0x10000
jmp 0x1006e0fc
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x1006e0fc
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x1006e080
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1006e120
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x1006e13c
mov ebx, 0x10000
lea edi, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x1006e14f
mov edi, 0xfff80000
mov eax, dword [0x100fa7c4]
mov ecx, dword [0x100fa7c0]
test eax, eax
jne 0x1006e169
test ecx, ecx
je 0x1006e17c
mov eax, ecx
mov dword [0x100fa7c4], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x1006e17c
cmp edx, ebx
jb 0x1006e17c
cmp edx, edi
jbe 0x1006e280
mov eax, ecx
mov dword [0x100fa7c4], eax
test ecx, ecx
je 0x1006e1aa
test eax, eax
je 0x1006e19e
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1006e19e
cmp ecx, ebx
jb 0x1006e19e
cmp ecx, edi
jbe 0x1006e280
mov eax, dword [eax + 4]
mov dword [0x100fa7c4], eax
test eax, eax
jne 0x1006e18b
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x1006e1d2
lea eax, [esi - 0x40000000]
push eax
push ebx
call fcn.1006df60
add esp, 8
test eax, eax
jne 0x1006e23c
cmp esi, 0x40000000
jae 0x1006e1e8
lea eax, [esi + 0x40000000]
push edi
push eax
call fcn.1006e040
add esp, 8
test eax, eax
jne 0x1006e23c
cmp esi, 0x40000000
jbe 0x1006e20a
lea eax, [esi - 0x40000000]
push esi
push eax
call fcn.1006e040
add esp, 8
test eax, eax
jne 0x1006e23c
cmp esi, 0x40000000
jae 0x1006e220
lea eax, [esi + 0x40000000]
push eax
push esi
call fcn.1006df60
add esp, 8
test eax, eax
jne 0x1006e23c
push esi
push ebx
call fcn.1006df60
add esp, 8
test eax, eax
jne 0x1006e23c
push edi
push esi
call fcn.1006e040
add esp, 8
test eax, eax
je 0x1006e2a8
mov dword [eax], 0x52727464
xor edx, edx
mov dword [eax + 8], 0
mov esi, 0x38b
mov ecx, dword [0x100fa7c0]
mov dword [eax + 4], ecx
lea ecx, [eax + 0xffa8]
mov dword [0x100fa7c4], eax
mov dword [0x100fa7c0], eax
nop dword [eax]
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
sub esi, 1
jne 0x1006e270
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x1006e2a8
cmp esi, edi
ja 0x1006e2a8
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.1008f5e0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1006e2e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ed178
push 0x10090d00
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100f4384]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
push 0x1c
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x1006e379
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1006e379
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x1006e379
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x1006e379
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1006e382
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1006e810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100fa7d0], 0
jne 0x1006e88e
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x100fa7d0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x1006e88e
push esi
mov esi, dword [0x100fa7c0]
mov dword [0x100fa7e0], eax
mov dword [0x100fa7dc], eax
mov dword [0x100fa7d4], eax
mov dword [0x100fa7d8], eax
test esi, esi
je 0x1006e87d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x1006e867
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1006ed50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100fa7d4]
test eax, eax
jne 0x1006edd2
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x1006ed71
xor eax, eax
pop edi
pop ebp
ret 4
push esi
push 8
call fcn.100683d7
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006ed87
lea edi, [eax + 8]
jmp 0x1006eda6
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1006edbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 8
push esi
call fcn.10068042
add esp, 8
pop esi
mov dword [0x100fa7d4], edi
mov eax, edi
mov dword [0x100fa7d8], 0
pop edi
pop ebp
ret 4
mov eax, dword [0x100fa7dc]
mov dword [esi + 4], edi
mov dword [esi], eax
xor eax, eax
mov dword [0x100fa7dc], esi
pop esi
pop edi
pop ebp
ret 4

Function at 0x1006f3c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x1006f3cf
pop ebp
jmp fcn.1006fcc0
xor eax, eax
pop ebp
ret 0xc
Function at 0x1006ffc0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c06e3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x10070065
cmp word [esi], di
je 0x10070065
test eax, eax
je 0x10070021
cmp word [eax], di
je 0x10070021
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x10070065
jmp 0x10070060
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1008f5e0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x10070065
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100700dc
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x100700c7
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x10070095
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x100700b6
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x100700fc
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x100700c7
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100700dc
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 0x30
call fcn.10044e65
int3

Function at 0x10070c50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10070c65
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10070c70
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x100715f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x100716b7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10071605
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10072db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0993
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100f43a4]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10072d00
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10072f91
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.1008f5e0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100d4234
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10072f91
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x10072e85
cmp eax, 2
jne 0x10072f91
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x10072ea6
test cl, 1
jne 0x10072f91
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x10072eac
jmp 0x10072f91
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10072f91
call fcn.10006280
mov ecx, eax
test ecx, ecx
je 0x10072fbc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100711f0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100d423c
push eax
call fcn.10073430
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.100715f0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x10072f75
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10072f16
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10072fd0
push dword [0x100f43ac]
lea eax, [ebp - 0x74]
push dword [0x100f43a8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10072f52
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10072f6e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10072f93
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10072f91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x10072f9e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100058e0
int3
Function at 0x10073130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c09c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f4384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100f43a4]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10072d00
test eax, eax
je 0x10073258
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10073203
cmp dword [esi], 0
je 0x100731f6
push 0x100d40e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100731c3
mov eax, 1
jmp 0x10073224
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100731fc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x10073224
cmp dword [esi + 4], 0
jne 0x10073203
mov eax, 1
jmp 0x10073224
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1007324e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10073236
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x1007325b
xor ebx, ebx
jmp 0x100732ff
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x100732ff
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x100732b8
mov ecx, dword [ebx]
test ecx, ecx
je 0x1007331e
push ecx
push eax
call fcn.100931ee
add esp, 8
test eax, eax
je 0x100732b8
mov edx, dword [edi]
test edx, edx
je 0x100732b8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10073290
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x100732c3
lea eax, [edx + 0xd]
jmp 0x100732f8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100732d0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100d4234
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1007330a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100058e0
int3
Function at 0x100749b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10074a21
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x100749ef
cmp eax, 2
jne 0x10074a0b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x10074a1b
test ecx, ecx
je 0x10074a16
test cl, 1
jne 0x10074a0b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x10074a1b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc