joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44804c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00401cd0
mov edi, eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
call fcn.00406490
add esp, 8
test al, al
je 0x4050dc
lea ecx, [ebp + 8]
call fcn.00406470
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004154ca
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.00406280
test eax, eax
je 0x405123
call fcn.00406240
mov ecx, esi
mov edx, eax
call fcn.00406280
cmp eax, edx
jae 0x405123
call fcn.004061d0
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.004051f0
add esp, 4
mov byte [esi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004154ca
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push ebx
je 0x4051ce
mov ecx, esi
call fcn.00405bb0
mov ebx, dword [esi + 0x38]
lea eax, [ebp + 8]
push eax
call fcn.004051f0
add esp, 4
test ebx, ebx
jne 0x40515a
mov edx, dword [esi + 0x4c]
mov cl, al
call fcn.004044d0
test al, al
cmovne edi, dword [ebp + 8]
jmp 0x4051ce
mov byte [ebp - 0x25], al
mov ecx, ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call fcn.00405ad0
sub eax, 0
je 0x4051a2
sub eax, 1
je 0x4051a2
sub eax, 2
jne 0x4051ce
mov edx, dword [esi + 0x4c]
mov cl, byte [ebp - 0x25]
call fcn.004044d0
test al, al
cmovne edi, dword [ebp + 8]
jmp 0x4051ce
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x4051bf
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.004210a5
add esp, 0x10
cmp ebx, eax
jne 0x4051ce
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
jne 0x4051d0
mov eax, edi
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004154ca
mov esp, ebp
pop ebp
ret 4
Function at 0x405c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44804c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x405ced
cmp byte [ebx + 0x3d], 0
je 0x405ced
mov eax, dword [ebx]
push esi
push edi
mov esi, dword [eax + 0xc]
call fcn.00401cd0
mov edi, eax
mov ecx, ebx
push edi
call esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], edi
push eax
call fcn.00406490
add esp, 8
test al, al
jne 0x405cda
mov ecx, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.004065d0
sub eax, 0
je 0x405ca1
sub eax, 1
je 0x405ca5
sub eax, 2
jne 0x405cda
pop edi
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004154ca
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x405cc2
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.004210a5
add esp, 0x10
cmp esi, eax
jne 0x405cda
cmp byte [ebx + 0x3d], 0
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004154ca
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004154ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.004154ca
mov esp, ebp
pop ebp
ret

Function at 0x412e90
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x60
mov eax, dword [0x44804c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
mov ebx, dword [esp + 0x70]
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x70]
test esi, esi
jne 0x412eb8
push 0x57
jmp 0x412f4d
push 0x1c
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0
push eax
xorps xmm0, xmm0
push esi
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x412f53
push 0
push 0x40
lea eax, [esp + 0x30]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x412f53
mov eax, 0x5a4d
cmp word [esp + 0x28], ax
jne 0x412f48
mov eax, dword [esp + 0x64]
cmp eax, dword [esp + 0x18]
ja 0x412f48
cmp eax, 0x40
jb 0x412f48
push 0
push 0xf8
push ebx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x412f53
cmp dword [ebx], 0x4550
jne 0x412f48
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004154ca
add esp, 0x60
ret 0xc
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x68]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004154ca
add esp, 0x60
ret 0xc
Function at 0x4136a0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x44804c]
xor eax, esp
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x1d0]
push ebx
mov ebx, dword [esp + 0x1dc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1dc]
push 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1e8]
push 0x1000
mov dword [esp + 0x20], eax
lea eax, [ebx + 0x1b8]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x413914
push 0x40
lea eax, [esp + 0xa0]
mov dword [esp + 0x14], 0
push 0
push eax
call fcn.00416900
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add esp, 0xc
mov eax, 0x5a4d
mov dword [esp + 0xd8], 0x40
mov word [esp + 0x9c], ax
lea eax, [esp + 0x10]
push eax
push 0x40
lea eax, [esp + 0xa4]
push eax
push esi
push edi
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], 0x40
jne 0x413914
push 0xf8
lea eax, [esp + 0xe0]
add esi, 0x40
push 0
push eax
call fcn.00416900
add esp, 0xc
mov dword [esp + 0xdc], 0x4550
mov eax, 1
mov dword [esp + 0xf0], 0x200000e0
mov word [esp + 0xe2], ax
mov eax, 0x10b
mov word [esp + 0xf4], ax
lea eax, [esp + 0x10]
push eax
push 0xf8
lea eax, [esp + 0xe4]
push eax
push esi
push edi
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], 0xf8
jne 0x413914
lea eax, [ebx + 0x58]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], eax
add esi, 0xf8
lea eax, [esp + 0x10]
mov dword [esp + 0x58], 0
push eax
push 0x28
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x7465642e
push eax
xorps xmm0, xmm0
mov dword [esp + 0x44], 0x72756f
push esi
push edi
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
mov dword [esp + 0x54], 0x160
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], 0x28
jne 0x413914
lea eax, [ebx + 0x58]
mov dword [esp + 0x5c], 0x40
mov dword [esp + 0x68], eax
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movlpd qword [esp + 0x6c], xmm0
push eax
push 0x40
lea eax, [esp + 0x64]
movlpd qword [esp + 0x7c], xmm0
push eax
add esi, 0x28
movlpd qword [esp + 0x88], xmm0
push esi
push edi
movlpd qword [esp + 0x98], xmm0
movlpd qword [esp + 0xa0], xmm0
movlpd qword [esp + 0xa8], xmm0
mov dword [esp + 0x74], 0x727444
mov dword [esp + 0x78], 0x40
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], 0x40
jne 0x413914
lea eax, [ebx + 0x18]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
add esi, 0x40
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movups xmm0, xmmword [eax]
lea eax, [esp + 0x10]
push eax
push 0x18
lea eax, [esp + 0x24]
push eax
push esi
push edi
movups xmmword [esp + 0x38], xmm0
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], 0x18
jne 0x413914
lea eax, [esp + 0x10]
push eax
push ebx
push dword [esp + 0x20]
lea ecx, [esi + 0x18]
push ecx
push edi
call ebp
test eax, eax
je 0x413914
cmp dword [esp + 0x10], ebx
jne 0x413914
mov eax, 1
jmp 0x413916
xor eax, eax
mov ecx, dword [esp + 0x1d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004154ca
add esp, 0x1c8
ret 0x10
Function at 0x413940
Capabilities:
Resume thread
Terminate process

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x48]
test esi, esi
push edi
cmove esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [esp + 0x40]
test edi, edi
jne 0x413966
xorps xmm0, xmm0
lea edi, [esp + 8]
movups xmmword [esp + 8], xmm0
mov eax, dword [esp + 0x30]
push edi
push dword [esp + 0x40]
or eax, 4
push dword [esp + 0x40]
push dword [esp + 0x40]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call esi
test eax, eax
je 0x4139d6
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [edi]
call fcn.00413c80
test eax, eax
jne 0x4139e0
push esi
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [edi + 8]
call fcn.00413a20
test eax, eax
jne 0x4139e0
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 4]
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0x34
test byte [esp + 0x30], 4
jne 0x4139f0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [esp + 8]
cmp edi, eax
jne 0x413a07
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 4]
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 0x34
Function at 0x41615c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41619b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41619b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41619b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41619b
cmp dword [ecx + 0x74], 0xe
jbe 0x41619b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428e0a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428c80

Function at 0x435320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43534d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43534d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1b002c98
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1b0060e0]
jne 0x1b002ca2
repz ret
jmp fcn.1b00317a
Function at 0x1001f9a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
mov edi, 0x20019
push edi
xor ebx, ebx
push ebx
push 0x1002090
push 0x80000000
call esi
test eax, eax
je 0x1003c90
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call esi
test eax, eax
jne 0x1002084
push 4
pop esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push str.TempPageFile
push dword [ebp - 0x210]
mov dword [ebp - 0x218], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1003cb0
mov dword [ebp - 0x214], ebx
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x214], 1
je 0x1003cc1
push dword [ebp - 0x21c]
call fcn.01001c19
call fcn.010020ef
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100148d
leave
ret 4
cmp dword [ebp - 0x218], esi
jne 0x100203a
jmp 0x1002040
mov dword [ebp - 0x214], ebx
jmp 0x100204c
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1003d00
call fcn.01001573
jmp 0x1001fe5
cmp dword [ebp - 0x220], esi
je 0x100207a
jmp 0x100203a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x641
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push 1
push ebx
push 1
lea eax, [ebp - 0x20c]
push eax
push 0x1004758
call fcn.01002737
jmp 0x1002059

Function at 0x10020ef
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0xc], bl
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
pop eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push ebx
push ebx
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
jne 0x1002164
push esi
push 0x1002174
push ebx
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
jne 0x1003282
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100148d
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002163
Function at 0x1002425
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
mov edi, 0x20019
push edi
push 0
push 0x1002248
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002482
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 0x10]
call ebx
push dword [ebp + 0x10]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0x10014a0
push dword [ebp + 8]
call esi
test eax, eax
je 0x10031df
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 0x10]
call ebx
push dword [ebp + 0x10]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100249b

Function at 0x10024aa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, 0x10019bc
push edi
call fcn.010022e7
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x1002523
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
push dword [ebp + 8]
mov ebx, eax
call esi
add ebx, eax
lea ebx, [ebx + ebx + 4]
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1002521
push dword [ebp + 8]
shr ebx, 1
push ebx
push esi
call fcn.010021a9
push 0x1002528
push ebx
push esi
call fcn.01002340
mov eax, dword [ebp + 0xc]
push dword [eax]
push ebx
push esi
call fcn.01002340
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 8
Function at 0x1002932
Capabilities:
Get keyboard layout
Identify system language via api
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1003295
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0100148d
leave
ret
push ebx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, si
je 0x10033d0
push edi
push 5
pop ecx
push 7
mov esi, 0x1004740
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x2001f
push ebx
movsw word es:[edi], word [esi]
push ebx
push ebx
mov esi, 0x100347c
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
push 0x1003418
mov edi, 0x80000001
push edi
call esi
test eax, eax
jne 0x10033cf
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 1
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48]
mov dword [ebp - 0x58], 0x31
mov dword [ebp - 0x4c], 0x33
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 0x48]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10033e8
push edi
call esi
test eax, eax
jne 0x10033cf
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
mov esi, 0x10033d8
push esi
push dword [ebp - 0x44]
mov dword [ebp - 0x50], 6
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x10033a4
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100339b
cmp dx, bx
je 0x1003397
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100339b
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1003375
xor eax, eax
jmp 0x10033a0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10033c6
push 4
lea eax, [ebp - 0x58]
push eax
push 1
push ebx
push esi
push dword [ebp - 0x44]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x10033c6
push ebx
push ebx
push ebx
push 0x5b
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push dword [ebp - 0x44]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop edi
pop esi
pop ebx
jmp 0x1002957
Function at 0x100296b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x1006080], esi
je 0x10029d5
lea eax, [ebp - 8]
push eax
push 1
push esi
push 0x10029f8
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029cf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x10029e0
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1003498
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [0x1006080], esi
mov eax, dword [0x10064a4]
pop esi
leave
ret
cmp dword [ebp - 4], esi
setne al
mov dword [0x10064a4], eax
jmp 0x10029c6
Function at 0x1002be9
Capabilities:
Terminate process

Disassembly:
test al, al
jne 0x100155e
mov al, byte [esi]
test al, al
jne 0x100462b
test byte [ebp - 0x3c], 1
je 0x1001569
movzx eax, word [ebp - 0x38]
push eax
push esi
push 0
push 0x1000000
call fcn.0100123b
mov dword [0x100609c], eax
cmp dword [0x1006090], 0
jne 0x1004684
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov dword [0x10064e4], esi
jmp 0x1002c76
cmp dword [ebp - 0x1c], 0
je 0x1001518
jmp 0x1002cc7
push 0xa
pop eax
jmp 0x100152c
call fcn.01002b19
push 0x58
push 0x1002d08
call fcn.01002ac7
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10060ac
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x10045dc
xor esi, esi
inc esi
mov eax, dword [0x10060a8]
cmp eax, esi
je 0x10045fa
mov eax, dword [0x10060a8]
test eax, eax
jne 0x1001553
mov dword [0x10060a8], esi
push 0x1002d00
push 0x1002cf4
call fcn.01002ba8
pop ecx
pop ecx
test eax, eax
jne 0x10046a8
mov eax, dword [0x10060a8]
cmp eax, esi
jne 0x1002c9a
push 0x1002cf0
push 0x1002ce8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10060a8], 2
test ebx, ebx
jne 0x1002ca6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10064b8], 0
jne 0x1004607
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x1001514
cmp al, 0x22
je 0x100463c
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
jne 0x100464c
inc esi
jmp 0x1002cba
cmp eax, esi
jne 0x10045ea
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1002c3d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002c28
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002c76
push 0x10064b8
call fcn.010050b0
pop ecx
test eax, eax
je 0x1002cb3
push 0
push 2
push 0
call dword [0x10064b8]
jmp 0x1002cb3
cmp al, 0x20
ja 0x1001522
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001518
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x1002ccf
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1002ce2
cmp dword [0x10064e4], 0
jne 0x1004693
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100609c]
jmp 0x10046b4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01003164
ret