joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e90ff
sub esp, 0x68
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4e90ea
mov ecx, dword [eax]
lea eax, [0x508800]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea edi, [esp + 0x38]
xor eax, eax
call fcn.0044a994
lea eax, [0x509680]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
lea ebp, [esp + 0x38]
mov dword [esp + 8], ebp
call dbg.runtime.mapiterinit
xor eax, eax
jmp 0x4e8fb3
lea eax, [esp + 0x38]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x28]
inc eax
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4e9000
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov ebx, dword [esp + 0x20]
cmp eax, ebx
jae 0x4e90f8
mov dword [esp + 0x28], eax
mov ebp, dword [esp + 0x34]
lea esi, [ebp + eax*8 + 4]
mov dword [esi], edx
lea edx, [ebp + eax*8]
mov esi, dword [0x5e13d0]
test esi, esi
jne 0x4e8ff2
mov dword [edx], ecx
jmp 0x4e8fa2
mov dword [esp], edx
mov dword [esp + 4], ecx
call dbg.runtime.writebarrierptr
jmp 0x4e8fa2
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call dbg.sort.StringSlice.Sort
lea eax, [0x4fa3c0]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call dbg.runtime.makeslice
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x30], edx
xor ebx, ebx
jmp 0x4e905d
lea ebx, [ecx + 1]
mov eax, edx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jge 0x4e90da
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x34]
lea ecx, [eax + ebx*8]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
lea ebp, [0x509680]
mov dword [esp], ebp
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call dbg.runtime.mapaccess1_faststr
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp ecx, edx
jae 0x4e90f1
mov ebx, dword [0x5e13d0]
mov ebp, dword [esp + 0x30]
lea esi, [ebp + ecx*4]
test ebx, ebx
jne 0x4e90bd
mov dword [ebp + ecx*4], eax
jmp 0x4e9052
mov dword [esp], esi
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x30]
jmp 0x4e9052
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
xor ecx, ecx
jmp 0x4e8f47
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.flag.sortFlags
Function at 0x10004340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10053238
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
and dword [esp + 0x14], 0xfffffe00
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], 1
call fcn.10012ac0
add esp, 8
test al, al
je 0x10004409
cmp byte [esp + 0x14], 7
jne 0x10004409
push str.value_bool
lea edx, [esp + 0x10]
push edx
mov ecx, 0x10057e2e
call fcn.1002e4e1
mov ecx, eax
call fcn.1002e8e4
test al, al
je 0x10004409
push str.value_bool
lea eax, [esp + 0x10]
push eax
mov ecx, 0x10057e2e
call fcn.1002e4e1
mov esi, eax
call fcn.1002db00
mov edx, dword [esp + 0x3c]
cmp eax, 1
sete cl
lea esi, [esp + 0xc]
mov byte [edx], cl
mov dword [esp + 0x30], 0xffffffff
call fcn.1002d89b
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.1002d89b
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x10004680
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100046ca
cmp dword [esp + 4], 4
jne 0x100046ca
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
Function at 0x10004cc0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10051458
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x68]
mov ebx, ecx
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x10004d12
push 0x10057f7c
mov edi, 7
call fcn.1000cca0
test eax, eax
jne 0x10004d19
xor al, al
jmp 0x10004ea0
cmp dword [ebp + 0x18], 8
jb 0x10004d2b
mov edi, dword [ebp + 4]
lea eax, [ebp + 4]
mov dword [esp + 0x18], eax
jmp 0x10004d32
lea edi, [ebp + 4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x10004d68
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x10057edc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jg 0x10004d68
sub esi, eax
push 0x10057edc
lea eax, [edi + esi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
add eax, 1
jne 0x10004d12
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
mov dword [esp + 0x14], eax
jb 0x10004d77
mov eax, dword [eax]
push eax
push str.SoftwareprojonepodlpinstallMgr_
push str._s_s
lea esi, [esp + 0x44]
call fcn.10026d81
add esp, 0xc
mov eax, 8
mov dword [esp + 0x60], 0
cmp dword [ebp + 0x18], eax
jb 0x10004da8
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx]
jmp 0x10004dac
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x3c]
cmp dword [esp + 0x50], eax
jae 0x10004dba
lea edi, [esp + 0x3c]
test esi, esi
je 0x10004dc7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10004dc9
xor eax, eax
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push str.filePath
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x80000002
call edi
mov ebp, 8
cmp dword [ebx + 0x18], ebp
jb 0x10004df6
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
jmp 0x10004dfa
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebp
jae 0x10004e08
lea ebx, [esp + 0x3c]
test esi, esi
je 0x10004e15
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10004e17
xor eax, eax
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0x10057f60
push ebx
push 0x80000002
call edi
lea edx, [esp + 0x1c]
push edx
call fcn.10025d9f
add esp, 4
cmp dword [eax + 0x18], ebp
jb 0x10004e43
mov esi, dword [eax + 4]
jmp 0x10004e46
lea esi, [eax + 4]
mov ebx, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebp
jae 0x10004e54
lea ebx, [esp + 0x3c]
test esi, esi
je 0x10004e61
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10004e63
xor eax, eax
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push str.timeStr
push ebx
push 0x80000002
call edi
cmp dword [esp + 0x34], ebp
jb 0x10004e8b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.1003a2e7
add esp, 4
cmp dword [esp + 0x50], ebp
jb 0x10004e9e
mov edx, dword [esp + 0x3c]
push edx
call fcn.1003a2e7
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10039e38
add esp, 0x50
ret 4
Function at 0x10004fb0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x10051a18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
xor esi, esi
push esi
push eax
lea ebx, [esp + 0x20]
call fcn.10035043
add esp, 8
mov dword [esp + 0x40], esi
mov eax, dword [esp + 0x1c]
mov ebx, 8
cmp dword [esp + 0x30], ebx
jae 0x10005011
lea eax, [esp + 0x1c]
push eax
push str.msiexec_command:_ls
mov ecx, str.procmgrDbg
call fcn.1002a7ce
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [esp + 0x14], esi
cmp dword [esp + 0x30], ebx
jae 0x10005036
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x14], 3
mov edi, eax
jl 0x100050bb
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x10005064
push 0x10057fcc
push eax
call ebx
test eax, eax
je 0x10005077
mov eax, dword [edi + 4]
cmp eax, esi
je 0x100050b6
push 0x10057fd4
push eax
call ebx
test eax, eax
jne 0x100050b6
mov eax, dword [edi + 8]
mov ecx, eax
lea ebx, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
cmp dx, si
jne 0x10005080
sub ecx, ebx
sar ecx, 1
push ecx
mov esi, ebp
call fcn.100023a0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x30], 8
jb 0x100050b2
mov edx, dword [esp + 0x1c]
push edx
call fcn.1003a2e7
add esp, 4
mov al, 1
jmp 0x100050d7
mov ebx, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x30], ebx
jb 0x100050d5
mov eax, dword [esp + 0x1c]
push eax
call fcn.1003a2e7
add esp, 4
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10039e38
add esp, 0x30
ret 8
Function at 0x10006500
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x100526e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
mov dword [esp + 0x14], vtable.RegHandleHolder.0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x10006567
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push eax
push eax
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0
test eax, eax
je 0x100065db
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 4]
cmp eax, 0x1000
jbe 0x100065c4
push eax
push str.procmgr_delete_cache__count:_d
call fcn.1002a35d
add esp, 8
push str.SoftwareprojonepodlpinstallMgr_
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], vtable.RegHandleHolder.0
test eax, eax
je 0x100065db
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
add esp, 0x18
ret
Function at 0x10006ce0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x1001c
call fcn.10045a60
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x10018], eax
mov eax, dword [esp + 0x10020]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, edi
je 0x10006de6
cmp esi, 0xffffffff
je 0x10006dca
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10006dc3
cmp dword [esp + 0x14], edi
jg 0x10006d58
jl 0x10006dc3
cmp dword [esp + 0x10], 0x200000
jb 0x10006dc3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x10000
lea edx, [esp + 0x2c]
push edx
push esi
mov dword [esp + 0x20], edi
call ebx
test eax, eax
je 0x10006dc3
lea esp, [esp]
cmp dword [esp + 0xc], 0x10000
jne 0x10006dc3
lea eax, [esp + 0x20]
push eax
mov eax, 0x10000
call fcn.1002ab93
add esp, 4
test eax, eax
jne 0x10006df1
add edi, dword [esp + 0xc]
cmp edi, 0x200000
ja 0x10006dc3
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x10000
lea edx, [esp + 0x2c]
push edx
push esi
call ebx
test eax, eax
jne 0x10006d80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x10024]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10039e38
add esp, 0x1001c
ret 4
cmp esi, 0xffffffff
je 0x10006dca
cmp esi, edi
je 0x10006dca
jmp 0x10006dc3
lea ecx, [esp + 0x1c]
call fcn.10002ce0
mov eax, 1
jmp 0x10006dcc

Function at 0x1000d9a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
push ebx
lea eax, [esp + 0xb]
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
push esi
mov byte [esp + 0x13], bl
call fcn.10004340
add esp, 8
test edi, edi
je 0x1000d9c4
mov eax, edi
jmp 0x1000d9e5
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.10002dd0
add esp, 8
cmp dword [eax + 0x18], 8
mov ebx, 1
jb 0x1000d9e2
mov eax, dword [eax + 4]
jmp 0x1000d9e5
add eax, 4
xor edx, edx
cmp byte [esp + 0xb], dl
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
setne dl
push eax
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x24], edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test bl, 1
je 0x1000da25
cmp dword [esp + 0x28], 8
jb 0x1000da25
mov edx, dword [esp + 0x14]
push edx
call fcn.1003a2e7
add esp, 4
pop ebx
add esp, 0x28
ret
Function at 0x1000e200
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x10050958
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x28]
push edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 4]
add esi, 8
push ecx
mov ecx, esi
call fcn.10010c10
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [eax], eax
mov esi, dword [esi + 0x18]
push str.Softwareprojonepodlpprocmgrcache
push 0x80000002
mov dword [esi + 8], esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1000e290
Capabilities:
Create thread

Disassembly:
mov eax, 0x1010
call fcn.10045a60
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x1008], eax
push esi
mov esi, ecx
mov byte [esi + 5], 1
call fcn.1000e200
push 0x1000ffa0
call fcn.10016b00
cmp byte [esi + 4], 0
jne 0x1000e330
push str.ProcUpdateThread
push 0x2b
push str..procaudit.cpp
push str._s._d:_s
lea eax, [esp + 0x18]
push 0x800
push eax
mov byte [esi + 4], 1
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10010250
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000e329
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
push str.thread__d_created:__s
call fcn.1002a0a1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x100c]
pop esi
xor ecx, esp
mov al, 1
call fcn.10039e38
add esp, 0x1010
ret

Function at 0x1000e350
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [ebx + 0x18], 8
push edi
lea edi, [ebx + 4]
jb 0x1000e372
mov eax, dword [edi]
jmp 0x1000e374
mov eax, edi
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
call fcn.10013120
pop esi
test eax, eax
je 0x1000e3a0
xor al, al
pop edi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.10039e38
add esp, 0x104
ret
push 0x80
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebx + 0x18], 8
jb 0x1000e3b8
mov edi, dword [edi]
test edi, edi
je 0x1000e3e3
cmp word [esp + 4], 0
je 0x1000e3e3
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
neg eax
sbb eax, eax
inc eax
jmp 0x1000e3e5
xor eax, eax
xor ecx, ecx
cmp eax, 1
sete cl
mov al, cl
mov ecx, dword [esp + 0x104]
pop edi
xor ecx, esp
call fcn.10039e38
add esp, 0x104
ret
Function at 0x1000e7a0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x100508f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x30], cx
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
call fcn.10001e40
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x2c]
mov edi, 8
cmp dword [esp + 0x40], edi
jae 0x1000e812
lea eax, [esp + 0x2c]
push eax
push str.Softwareprojonepodlpprocmgr_
push str._lscache_ls
lea esi, [esp + 0x18]
call fcn.10026d81
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x24], edi
jae 0x1000e837
lea eax, [esp + 0x10]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x24], edi
jb 0x1000e856
mov edx, dword [esp + 0x10]
push edx
call fcn.1003a2e7
add esp, 4
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
cmp dword [esp + 0x40], edi
jb 0x1000e880
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.1003a2e7
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10039e38
add esp, 0x48
ret 4
Function at 0x1000eee0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
xor ebp, ebp
push edi
lea ebx, [esp + 0x14]
mov edi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.1000ee40
test al, al
jne 0x1000ef1a
push 0x10058ce0
call fcn.1002a35d
jmp 0x1000f08e
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
push str.bootStart
push str.Softwareprojonepodlpprocmgr_
mov ebx, 8
push 0x80000002
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x4c], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esp + 0x1c], ebp
je 0x1000f015
mov esi, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x38]
mov word [esp + 0x38], dx
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov word [esp + 0x4e], ax
mov word [esp + 0x2c], ax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
call esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
call esi
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x4c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.10025cc9
cmp edx, 0xffffffff
jl 0x1000f003
jg 0x1000eff6
cmp eax, 0xfffff448
jb 0x1000f003
cmp edx, ebp
jl 0x1000f015
jg 0x1000f003
cmp eax, 0xbb8
jbe 0x1000f015
push 0x10058d0c
call fcn.1002a4bb
add esp, 4
call fcn.1000ebc0
mov ecx, edi
call fcn.1000e200
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
lea edx, [esp + 0x18]
push edx
push 3
push str.bootStart
push str.Softwareprojonepodlpprocmgr_
push 0x80000002
call edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
call fcn.1000f0b0
cmp dword [eax + 0x18], ebx
jb 0x1000f053
mov esi, dword [eax + 4]
jmp 0x1000f056
lea esi, [eax + 4]
cmp esi, ebp
je 0x1000f063
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x1000f065
xor eax, eax
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push str.bootStartStr
push str.Softwareprojonepodlpprocmgr_
push 0x80000002
call edi
cmp dword [esp + 0x50], ebx
jb 0x1000f091
mov edx, dword [esp + 0x3c]
push edx
call fcn.1003a2e7
add esp, 4
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10039e38
add esp, 0x4c
ret
Function at 0x1000f7f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x10050868
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov edx, dword [eax + 0xd0]
mov esi, dword [eax + 0xcc]
xor ebp, ebp
xor ecx, ecx
or edx, ebp
xor edi, edi
mov ebp, 8
or ecx, esi
mov dword [esp + 0x10], edi
cmp dword [eax + 0x54], ebp
jb 0x1000f84e
mov esi, dword [eax + 0x40]
jmp 0x1000f851
lea esi, [eax + 0x40]
mov eax, dword [eax + 0x1c]
push edx
push ecx
push esi
push eax
push str._d__ls__lld
lea esi, [esp + 0x28]
call fcn.10026d81
add esp, 0x14
mov dword [esp + 0x3c], edi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x1000f87b
lea esi, [esp + 0x18]
mov edx, dword [esp + 0x28]
add edx, edx
xor ecx, ecx
cmp edx, edi
mov eax, 0xff11abcd
jle 0x1000f8ad
lea esp, [esp]
movzx edi, byte [esi + ecx]
movzx ebp, al
xor edi, ebp
shr eax, 8
xor eax, dword [edi*4 + 0x10067798]
inc ecx
cmp ecx, edx
jl 0x1000f890
mov ebp, 8
not eax
push eax
push str._08x
mov esi, ebx
call fcn.10026d81
add esp, 8
cmp dword [esp + 0x2c], ebp
jb 0x1000f8d2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1003a2e7
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10039e38
add esp, 0x30
ret 4