joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006b742
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x101d747e
call fcn.100970bf
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10064c94
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1006b7a4
call fcn.1006815a
cmp eax, 1
jne 0x1006b7a4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1006ae82
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.100675c6
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001f916
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001f916
mov eax, esi
call fcn.10097197
ret 0x14

Function at 0x1006b7d0
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x101d74a9
call fcn.100970bf
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10064c94
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1006b832
call fcn.1006815a
cmp eax, 1
jne 0x1006b832
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1006ae82
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.100675c6
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001f916
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001f916
mov eax, esi
call fcn.10097197
ret 8

Function at 0x1007992c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10079973
call fcn.10068d74
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10079973
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1007998f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.100794a4
mov esi, eax
test edi, edi
je 0x1007998d
test ebx, ebx
je 0x1007998d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1007d71e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101d87fe
call fcn.100970bf
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1007d743
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1007d789
lea ecx, [ebp - 0x10]
call fcn.100644cd
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10063bd5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001f916
mov eax, esi
call fcn.10097197
ret 8

Function at 0x10086dfd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x10086e21
cmp dword [edi + 0x54], 0
jne 0x10086e21
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10068d74
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.10086dbe
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100970b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10247460]
jne 0x100970ba
repz ret
jmp fcn.100a189c
Function at 0x100bf124
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100a11cd
and dword [ebp - 4], 0
cmp dword [0x1026d438], 0
mov ebx, eax
jne 0x100bf1d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100bf286
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1020dbec
push edi
call esi
test eax, eax
je 0x100bf286
push eax
call fcn.100a115b
mov dword [esp], 0x1020dbdc
push edi
mov dword [0x1026d438], eax
call esi
push eax
call fcn.100a115b
mov dword [esp], 0x1020dbc8
push edi
mov dword [0x1026d43c], eax
call esi
push eax
call fcn.100a115b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1026d440], eax
call esi
push eax
call fcn.100a115b
pop ecx
mov dword [0x1026d448], eax
test eax, eax
je 0x100bf1d5
push 0x1020db94
push edi
call esi
push eax
call fcn.100a115b
pop ecx
mov dword [0x1026d444], eax
mov eax, dword [0x1026d444]
cmp eax, ebx
je 0x100bf22d
cmp dword [0x1026d448], ebx
je 0x100bf22d
push eax
call fcn.100a11d6
push dword [0x1026d448]
mov esi, eax
call fcn.100a11d6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100bf22d
test edi, edi
je 0x100bf22d
call esi
test eax, eax
je 0x100bf224
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100bf224
test byte [ebp - 0xc], 1
jne 0x100bf22d
or dword [ebp + 0x10], 0x200000
jmp 0x100bf266
mov eax, dword [0x1026d43c]
cmp eax, ebx
je 0x100bf266
push eax
call fcn.100a11d6
pop ecx
test eax, eax
je 0x100bf266
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100bf266
mov eax, dword [0x1026d440]
cmp eax, ebx
je 0x100bf266
push eax
call fcn.100a11d6
pop ecx
test eax, eax
je 0x100bf266
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1026d438]
call fcn.100a11d6
pop ecx
test eax, eax
je 0x100bf286
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100bf288
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100caef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100caf3e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100caf3e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x100caf43
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x100caf29
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x100caf53
test esi, esi
jne 0x100caf71
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100caf6f
mov byte [eax + esi - 1], 0
jne 0x100caf78
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x100d0660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100d06b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x100d06b0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x100d06b5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x100d069b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x100d06c2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x100db910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100db951
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100db953
mov esi, edi
test esi, esi
je 0x100db9c8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100db9bd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x100db9bd
cmp dword [esp + 0x1c], eax
jbe 0x100db98e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100db9bd
cmp esi, edi
je 0x100db9af
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x100db9c8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x100db9e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x100dba45
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100dba45
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x100dba45
cmp dword [esp + 0x18], eax
jbe 0x100dba2b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x100dba49
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x100dbb20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x100dbb7f
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100dbb7f
cmp dword [esp + 0xc], 3
jne 0x100dbb7f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x100dbb7f
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x100dbb7f
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x100dbb90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov ecx, dword [esp + 0xc]
push ebp
push esi
test ecx, ecx
push edi
je 0x100dbbc7
lea edx, [esp + 0x10]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100dbbc9
mov esi, ebx
test esi, esi
je 0x100dbc52
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100dbc47
cmp dword [esp + 0x1c], 3
jne 0x100dbc47
mov edx, dword [esp + 0x18]
push edx
call fcn.10063b18
mov edi, eax
add esp, 4
test edi, edi
je 0x100dbc47
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100dbc3e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp esi, ebx
mov dword [ecx], edx
je 0x100dbc34
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push edi
call fcn.10063b47
add esp, 4
cmp esi, ebx
je 0x100dbc52
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x100dbc60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x100dbcd4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100dbcd4
cmp dword [esp + 0x10], 3
jne 0x100dbcd4
mov edx, dword [esp + 0x18]
push edx
call fcn.10063b18
mov edi, eax
add esp, 4
test edi, edi
je 0x100dbcd4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100dbccb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.10063b47
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x100dbce0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x101da74f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1020dc58]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x100dbd4b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100dbd4d
mov esi, edi
test esi, esi
je 0x100dbe17
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100dbe0c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x100dbd8f
cmp eax, 2
je 0x100dbd8f
cmp eax, 6
je 0x100dbd8f
cmp eax, 7
jne 0x100dbe0c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.10063b18
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x100dbdf2
lea ecx, [esp + 0x14]
call fcn.100ccaa0
cmp esi, dword [esp + 0x14]
je 0x100dbde7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10063b47
add esp, 4
jmp 0x100dbe29
call fcn.10063b47
add esp, 4
lea ecx, [esp + 0x10]
push 0x1026d4c8
call fcn.100ccaa0
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x100dbe17
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100dbe29
push eax
lea ecx, [esp + 0x14]
call fcn.100ccaa0
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.100cbe20
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.100cc820
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x100dca30
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x100dca5c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100dca5c
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x100dcb10
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100dcb49
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.100977b6
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x100dcb49
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x100dcb80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101da818
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x100dcbd6
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100dcbd9
mov esi, dword [ebp + 8]
test esi, esi
je 0x100dcccc
call fcn.100f29f0
test eax, eax
je 0x100dcc29
mov edi, dword [ebp + 0x18]
push edi
call fcn.100977b6
mov ecx, dword [ebp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100dccc0
cmp esi, dword [ebp + 8]
je 0x100dcc1f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100dccce
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100dcc68
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.1009dca0
mov edi, esp
test edi, edi
je 0x100dcc68
mov edx, dword [ebp + 0x10]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x100dcc6a
xor edi, edi
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push eax
call fcn.100c6d30
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100dccb1
cmp esi, dword [ebp + 8]
je 0x100dcc9b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100c7490
mov eax, 1
jmp 0x100dccce
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.100c7490
cmp esi, dword [ebp + 8]
je 0x100dcccc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dd590
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x14]
push esi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
call fcn.100d21b0
cmp ebp, ebx
je 0x100dd66c
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push ebx
lea ecx, [esp + 0x28]
push eax
push ecx
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100dd66c
cmp dword [esp + 0x10], ebx
jbe 0x100dd66c
mov eax, dword [esp + 0xc]
cmp eax, 0x104
jae 0x100dd5f6
mov eax, 0x104
mov dword [esp + 0xc], eax
lea edx, [eax + eax + 2]
push edx
call fcn.10063b18
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100dd66c
cmp dword [esp + 0x10], ebx
jbe 0x100dd655
push edi
mov eax, dword [esp + 0x10]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
inc eax
push eax
push esi
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100dd64b
mov ecx, dword [esp + 0x1c]
push esi
mov edx, dword [ecx + 4]
push edx
call fcn.100d2660
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jb 0x100dd610
pop edi
push esi
call fcn.10063b47
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x100ddd10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push ebx
test edx, edx
push esi
mov ebx, ecx
je 0x100ddd46
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
or eax, 0x20019
push esi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x100ddd48
mov esi, dword [ebx]
test esi, esi
je 0x100dddd3
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x14]
xor edi, edi
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x100ddd78.2
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.0x100ddd78.2
jmp dword [eax*4 + 0x100ddddc]
mov edi, 1
jmp case.0x100ddd78.2
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 4
sete al
mov edi, eax
jmp case.0x100ddd78.2
mov eax, dword [esp + 0x10]
cmp eax, 1
je case.0x100ddd78.0
cmp eax, 2
je case.0x100ddd78.0
cmp eax, 6
je case.0x100ddd78.0
cmp eax, 7
je case.0x100ddd78.0
xor edi, edi
jmp case.0x100ddd78.2
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 3
sete cl
mov edi, ecx
cmp esi, dword [ebx]
je 0x100dddcb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x100ddfc0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x100de055
push ebx
push edi
mov edi, dword [esi + 0x20]
mov ebx, 4
test edi, edi
je 0x100de00f
call fcn.100f2a80
test eax, eax
je 0x100de00f
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100ddffc
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x100ddffc
mov ebx, dword [ecx + 0x64]
lea eax, [edi - 0x2000]
cmp ebx, eax
jbe 0x100de008
add edi, ebx
mov ebx, 0x10004
jmp 0x100de011
xor edi, edi
lea ecx, [esi + 4]
push ecx
push ebx
push esi
push 0x100de210
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 8], eax
test eax, eax
pop ebx
je 0x100de055
mov ecx, dword [esi + 0x24]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x100de044
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100de080
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x100de094
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100de0e0
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x14]
push eax
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret