joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a0d6348
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
cmp dword [0x7a20a03c], esi
mov edi, ecx
push 1
mov dword [ebp - 0x14], edi
push esi
je 0x7a104b0d
push dword [0x7a20a5c4]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x7a0d647d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x7a104b23
push esi
push 0x7a0f3978
mov ecx, edi
call fcn.7a0d6726
cmp dword [ebp - 0x10], esi
jbe 0x7a0d644d
push ebx
mov ebx, 0x104
mov edi, 0x103
cmp dword [ebp - 0xc], edi
je 0x7a0d6449
cmp dword [0x7a20a03c], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x208
je 0x7a104b34
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x7a0d6449
cmp eax, esi
jne 0x7a0d643e
cmp dword [0x7a20a03c], esi
je 0x7a104b60
mov ecx, dword [ebp - 0x14]
push esi
lea eax, [ebp - 0x334]
push eax
call fcn.7a0d6726
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x7a0d63ca
mov edi, dword [ebp - 0x14]
pop ebx
cmp dword [edi], esi
je 0x7a0d6474
cmp dword [ebp + 8], esi
je 0x7a0d646d
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.7a09a413
mov ecx, dword [edi + 0xc]
push eax
call fcn.7a0d6bec
mov dword [edi + 0x14], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 4
push dword [0x7a20cda4]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x7a0d637e
mov eax, dword [edi + 4]
shl eax, 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
jmp 0x7a0d63ae
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x7a0d6417
xor eax, eax
push ebx
mov ecx, 0x82
lea edi, [ebp - 0x334]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x334]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
jmp 0x7a0d642e
Function at 0x7a0d71cf
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x7a0dea5f
mov eax, 0x94
call fcn.7a0dfae3
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x7a0dea94
mov ecx, dword [esi + 0x10]
mov dword [0x7a20b1bc], ecx
mov eax, dword [esi + 4]
mov dword [0x7a20b1c8], eax
mov edx, dword [esi + 8]
mov dword [0x7a20b1cc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x7a20b1c0], esi
jne 0x7a112cfc
shl eax, 8
add eax, edx
push 0
mov dword [0x7a20b1c4], eax
call fcn.7a0dfafc
test eax, eax
pop ecx
je 0x7a0dea94
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x7a20b54c], eax
call fcn.7a0dfb51
mov dword [0x7a20b1b8], eax
call fcn.7a0df2ef
test eax, eax
jl 0x7a112d0d
call fcn.7a0dfc75
test eax, eax
jl 0x7a0dea9b
call fcn.7a0df86a
test eax, eax
jl 0x7a0dea9b
call fcn.7a0df470
test eax, eax
jne 0x7a0dea9b
inc dword [0x7a20a6c0]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x7a0d7299
cmp dword [0x7a20a6c0], eax
jle 0x7a0dea94
dec dword [0x7a20a6c0]
cmp dword [0x7a20a85c], eax
jne 0x7a0dea85
call fcn.7a0df243
call fcn.7a0deaa5
call fcn.7a0de70c
jmp 0x7a0d7299
xor eax, eax
jmp 0x7a0d729c
call fcn.7a0deaa5
jmp 0x7a112d0d
or esi, 0x8000
mov dword [0x7a20b1c0], esi
jmp 0x7a0d7230
call fcn.7a0de70c
jmp 0x7a0dea94
Function at 0x7a0dfb51
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7a20b2e8]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x7a0dfbfb
call edi
mov esi, eax
cmp esi, ebx
je 0x7a112f8b
mov dword [0x7a20b2e8], 1
cmp esi, ebx
je 0x7a112fac
cmp word [esi], bx
mov eax, esi
je 0x7a0dfba4
add eax, ebp
cmp word [eax], bx
jne 0x7a0dfb96
add eax, ebp
cmp word [eax], bx
jne 0x7a0dfb96
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x7a0dfbeb
push ebp
call fcn.7a0dfc06
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7a0dfbeb
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x7a112fb9
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x7a112fcc
jmp 0x7a0dfb87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x7a112fa2
mov eax, ebp
mov dword [0x7a20b2e8], eax
jmp 0x7a0dfbfb
mov eax, dword [0x7a20b2e8]
jmp 0x7a0dfbfb
call edi
mov esi, eax
cmp esi, ebx
je 0x7a112fd4
jmp 0x7a0dfb8f
push dword [esp + 0x10]
call fcn.7a0d72a4
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x7a0dfbe7
cmp eax, ebp
je 0x7a112fdb
cmp eax, ebx
je 0x7a112fdb
xor eax, eax
jmp 0x7a0dfbf4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x7a112fd4
cmp byte [ebp], bl
je 0x7a112ff6
inc eax
cmp byte [eax], bl
jne 0x7a112fec
inc eax
cmp byte [eax], bl
jne 0x7a112fec
sub eax, ebp
inc eax
mov esi, eax
push esi
call fcn.7a0dfc06
cmp eax, ebx
pop ecx
je 0x7a11301c
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x7a0dfbf2
Function at 0x7a0e0146
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb58
push edi
xor edi, edi
cmp dword [0x7a20a7f0], edi
mov dword [ebp - 4], 1
jne 0x7a0e0264
cmp dword [0x7a20a03c], edi
push ebx
push esi
push 0x104
je 0x7a0ff6b0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
cmp esi, edi
jbe 0x7a0e01b7
lea eax, [esi - 1]
cmp eax, edi
jl 0x7a0e01a4
cmp word [ebp + eax*2 - 0x424], 0x5c
je 0x7a0e026a
dec eax
jns 0x7a0e0192
cmp esi, edi
jbe 0x7a0e01b7
cmp word [ebp + esi*2 - 0x426], 0x5c
je 0x7a0ff6e8
mov word [ebp + esi*2 - 0x424], di
lea edi, [esi + 8]
lea eax, [edi + edi]
push eax
lea ebx, [esi + 7]
call fcn.7a09152c
push edi
mov dword [0x7a20a7f0], eax
call fcn.7a09152c
mov dword [0x7a20a7ec], eax
lea eax, [ebx + ebx]
push eax
call fcn.7a09152c
push ebx
mov dword [0x7a20a7e8], eax
call fcn.7a09152c
mov ecx, dword [0x7a20a7f0]
xor edi, edi
cmp ecx, edi
mov dword [0x7a20a7e4], eax
je 0x7a0e0271
cmp dword [0x7a20a7ec], edi
je 0x7a0e0271
cmp dword [0x7a20a7e8], edi
je 0x7a0e0271
cmp eax, edi
je 0x7a0e0271
lea eax, [ebp - 0x424]
push eax
push ecx
call fcn.7a097a68
lea eax, [ebp - 0x424]
push eax
push dword [0x7a20a7e8]
call fcn.7a097a68
cmp dword [0x7a20a03c], edi
je 0x7a0ff6ee
push 0x7a0f3374
push dword [0x7a20a7f0]
call fcn.7a0e011b
push 0x7a0f3384
push dword [0x7a20a7e8]
call fcn.7a0e011b
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret
mov esi, eax
jmp 0x7a0e01a4
mov dword [ebp - 4], edi
jmp 0x7a0e0262
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x738]
call fcn.7a12f7fc
push dword [ebp - 0x734]
lea eax, [ebp - 0x424]
push eax
call fcn.7a097a68
jmp 0x7a0e01a4
dec esi
jmp 0x7a0e01b7
push dword [0x7a20a7f0]
lea ecx, [ebp - 0x21c]
call fcn.7a0afae6
push dword [0x7a20a7e8]
lea ecx, [ebp - 0x110]
call fcn.7a0afae6
xor eax, eax
mov ecx, 0x104
cmp eax, ecx
jae 0x7a0ff732
mov edx, dword [ebp - 0x218]
mov bl, byte [eax + 0x7a11a4c8]
add edx, eax
inc eax
cmp eax, 8
mov byte [edx + esi], bl
jb 0x7a0ff712
xor eax, eax
cmp eax, ecx
jae 0x7a0ff74f
mov edx, dword [ebp - 0x10c]
mov bl, byte [eax + 0x7a11a4d0]
add edx, eax
inc eax
cmp eax, 7
mov byte [edx + esi], bl
jb 0x7a0ff734
push dword [ebp - 0x218]
lea ecx, [ebp - 0x948]
call fcn.7a12f7fc
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xb58]
call fcn.7a12f7fc
push dword [ebp - 0x944]
push dword [0x7a20a7f0]
call fcn.7a097a68
push dword [ebp - 0xb54]
push dword [0x7a20a7e8]
call fcn.7a097a68
mov esi, dword [ebp - 0x218]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7a0ff79e
mov edi, dword [0x7a20a7ec]
sub eax, ecx
lea ecx, [eax + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x10c]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7a0ff7c9
mov edi, dword [0x7a20a7e4]
sub eax, ecx
lea ecx, [eax + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x7a0e0262
Function at 0x7a0e0bf7
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb8
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 0x70]
mov dword [0x7a20a11c], eax
mov eax, dword [ebp + 0x58]
mov dword [0x7a20b784], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x7a0e0c4f
xor eax, eax
cmp dword [ebp - 0x30], 2
sete al
mov dword [0x7a20a118], eax
mov eax, dword [ebp - 0x3c]
mov dword [0x7a20b780], eax
mov eax, dword [ebp - 0x38]
mov dword [0x7a20b77c], eax
call fcn.7a0e0c5e
mov dword [0x7a20a114], eax
add ebp, 0x78
leave
ret
Function at 0x7a0e3861
Capabilities:
Query or enumerate registry value

Disassembly:
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7a0e3765
push ebp
mov ebp, esp
sub esp, 0x424
push esi
push edi
lea eax, [ebp - 4]
push eax
push 9
xor edi, edi
push edi
push 0x7a0f3460
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7a0e3765
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x7a0e3769
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x7a0e3769
imul eax, eax, 0x210
push eax
call fcn.7a09152c
cmp eax, edi
mov dword [esi + 0xc], eax
je 0x7a0e3769
mov dword [ebp - 8], edi
push ebx
mov eax, 0x104
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
jne 0x7a0e375b
inc dword [ebp - 8]
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, edi
jl 0x7a0e392b
cmp word [ebp + eax*2 - 0x21c], 0x2c
je 0x7a0e39b0
dec eax
jns 0x7a0e3919
mov eax, dword [0x7a20a65c]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x21c]
push eax
call fcn.7a099c6a
cmp eax, edi
je 0x7a0e38d7
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x210
mov dword [ecx + edx + 0x20c], eax
xor eax, eax
cmp dword [ebp - 0xc], edi
jbe 0x7a0e3983
mov cx, word [ebp + eax*2 - 0x424]
cmp cx, 0x2c
je 0x7a0e3983
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
imul edx, edx, 0x108
add edx, eax
inc eax
mov word [ebx + edx*2], cx
cmp eax, dword [ebp - 0xc]
jb 0x7a0e395d
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x108
add ecx, eax
mov word [edx + ecx*2], di
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
imul ecx, ecx, 0x210
mov dword [ecx + edx + 0x208], eax
inc dword [esi + 0x10]
jmp 0x7a0e38d7
mov word [ebp + eax*2 - 0x21c], di
jmp 0x7a0e392b
Function at 0x7a0e3c57
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push 8
mov esi, ecx
call fcn.7a09152c
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 4], eax
je 0x7a0e3d17
push edi
mov dword [eax], ebx
mov eax, dword [esi + 4]
push 0x45
mov dword [eax + 4], ebx
xor edi, edi
xor eax, eax
pop ecx
mov word [ebp + eax - 0x22c], cx
inc edi
lea eax, [edi + edi]
xor ecx, ecx
mov cx, word [eax + 0x7a0f3450]
cmp cx, bx
jne 0x7a0e3c88
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
jbe 0x7a0e3cc1
xor edx, edx
push 0xa
pop ecx
div ecx
add edx, 0x30
mov word [ebp + ebx*2 - 0x24], dx
inc ebx
cmp ebx, 5
jl 0x7a0e3ca8
dec ebx
js 0x7a0e3cd4
mov ax, word [ebp + ebx*2 - 0x24]
mov word [ebp + edi*2 - 0x22c], ax
inc edi
jmp 0x7a0e3cc1
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 9
push eax
mov word [ebp + edi*2 - 0x22c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x22c]
push eax
push 0x80000001
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x7a105027
cmp dword [ebp - 4], 0
pop edi
jne 0x7a105104
pop esi
pop ebx
leave
ret
mov eax, 0x104
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x22c]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x18], eax
jne 0x7a1050f2
cmp dword [ebp - 0xc], edi
je 0x7a105099
push 0x7a1ec5d8
lea eax, [ebp - 0x434]
push eax
call fcn.7a09640c
test eax, eax
jne 0x7a105099
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.7a13ab75
cmp eax, edi
je 0x7a1050f2
mov ecx, dword [esi + 4]
mov dword [ecx], eax
jmp 0x7a1050f2
mov eax, dword [0x7a20a65c]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x434]
push eax
call fcn.7a099c6a
mov ebx, eax
cmp ebx, edi
je 0x7a1050f2
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.7a13ab75
mov edi, eax
test edi, edi
je 0x7a1050f2
push 0xc
call fcn.7a09152c
test eax, eax
je 0x7a1050f2
mov dword [eax], ebx
mov dword [eax + 4], edi
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x7a1050e9
mov dword [ecx + 4], eax
and dword [eax + 8], edx
jmp 0x7a1050f2
mov dword [eax + 8], edx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 8]
cmp dword [ebp - 0x18], 0
je 0x7a105027
jmp 0x7a0e3d0c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7a0e3d17
Function at 0x7a0e3fe0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor esi, esi
cmp dword [0x7a20a6a8], esi
jne 0x7a0e3ffa
mov ax, word [0x7a20a874]
pop esi
leave
ret
push 0x400
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
cmp dword [0x7a20a03c], esi
mov dword [0x7a20a874], eax
je 0x7a0e402a
push 0x14
lea ecx, [ebp - 0x34]
push ecx
push 0x1014
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
je 0x7a10d08e
movzx eax, word [ebp - 0x34]
sub eax, 0x31
jne 0x7a10d0e4
mov dword [0x7a20a878], 1
mov dword [0x7a20a6a8], esi
jmp 0x7a0e3ff1
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push 0x7a11a5ec
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7a0e4033
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x7a11a5e0
push dword [ebp - 8]
mov word [ebp - 0x34], si
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x7a10d0d6
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7a0e4033
dec eax
je 0x7a10d0f2
mov dword [0x7a20a878], esi
jmp 0x7a0e404a
mov dword [0x7a20a878], 2
jmp 0x7a0e404a

Function at 0x7a0e5430
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [0x7a20a888], ecx
mov dword [0x7a20a87c], edi
call ebx
mov dword [0x7a20a88c], eax
jmp 0x7a0e545f
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
xor edi, edi
cmp dword [0x7a20a67c], edi
mov dword [0x7a20a87c], edi
je 0x7a0e5463
call ebx
sub eax, dword [0x7a20a88c]
cmp eax, 0x7530
sbb eax, eax
inc eax
mov dword [esp + 8], eax
jne 0x7a0e5468
pop edi
pop ebx
pop ecx
ret
call fcn.7a0e5b24
cmp dword [0x7a20a6a4], edi
je 0x7a10d939
cmp dword [0x7a20a87c], edi
je 0x7a0e5427
mov eax, dword [0x7a20a67c]
xor ecx, ecx
cmp eax, edi
je 0x7a0e541b
mov edx, dword [eax + 0x40]
cmp edx, ecx
ja 0x7a0e5493
mov eax, dword [eax + 0x4c]
jmp 0x7a0e5483
mov ecx, edx
jmp 0x7a0e548e
push esi
push 0x20000
push 0x7a214040
mov esi, 0x7a1f50a0
push esi
push 0x80000002
call fcn.7a16c9f5
push 0x40000
push 0x7a21403c
push esi
push 0x80000001
call fcn.7a16c9f5
pop esi
jmp 0x7a0e5474

Function at 0x7a12a6d9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 8]
je 0x7a12a70b
push esi
mov esi, dword [ebp + 0x10]
xor edx, edx
mov dl, byte [eax]
shr esi, 8
xor edx, dword [ebp + 0x10]
and edx, 0xff
mov edx, dword [edx*4 + 0x7a1ebf50]
xor edx, esi
inc eax
dec ecx
mov dword [ebp + 0x10], edx
jne 0x7a12a6e7
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x7a134908
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push 9
pop edx
mov dword [ebp + 8], ecx
lea ecx, [eax + 2]
mov ax, word [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x7a134920
pop ebp
ret 4

Function at 0x7a13af21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
push edi
push 8
mov ebx, ecx
call fcn.7a09152c
xor edi, edi
cmp eax, edi
mov dword [ebx + 4], eax
je 0x7a13b0e0
mov dword [eax], edi
mov eax, dword [ebx + 4]
push esi
mov dword [eax + 4], edi
xor esi, esi
mov al, 0x45
mov byte [ebp + esi - 0x120], al
mov al, byte [esi + 0x7a1ec539]
inc esi
test al, al
jne 0x7a13af4f
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
jbe 0x7a13af8d
xor edx, edx
push 0xa
pop ecx
div ecx
add dl, 0x30
mov byte [ebp + edi - 0x10], dl
inc edi
cmp edi, 5
jl 0x7a13af67
jmp 0x7a13af8d
mov al, byte [ebp + edi - 0x10]
mov byte [ebp + esi - 0x120], al
inc esi
dec edi
jns 0x7a13af81
and byte [ebp + esi - 0x120], 0
lea ecx, [ebp - 4]
push ecx
xor eax, eax
push 9
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x120]
push eax
push 0x80000001
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7a13b0d0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x120]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 8]
mov esi, 0x104
push dword [ebp - 4]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x7a13b0c3
push esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.7a12b44b
test eax, eax
je 0x7a13afc8
push esi
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.7a12b44b
test eax, eax
je 0x7a13afc8
cmp dword [ebp - 0x14], edi
je 0x7a13b06a
push 0x7a1ec5d8
lea eax, [ebp - 0x42c]
push eax
call fcn.7a09640c
test eax, eax
jne 0x7a13b06a
lea eax, [ebp - 0x634]
push eax
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.7a13ab75
cmp eax, edi
je 0x7a13b0c3
mov ecx, dword [ebx + 4]
mov dword [ecx], eax
jmp 0x7a13b0c3
mov eax, dword [0x7a20a65c]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x42c]
push eax
call fcn.7a099c6a
mov edi, eax
test edi, edi
je 0x7a13b0c3
lea eax, [ebp - 0x634]
push eax
mov ecx, ebx
call fcn.7a13ab75
mov esi, eax
test esi, esi
je 0x7a13b0c3
push 0xc
call fcn.7a09152c
test eax, eax
je 0x7a13b0c3
mov dword [eax], edi
mov dword [eax + 4], esi
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x7a13b0ba
mov dword [ecx + 4], eax
and dword [eax + 8], edx
jmp 0x7a13b0c3
mov dword [eax + 8], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 8]
cmp dword [ebp - 0x10], 0
je 0x7a13afc8
cmp dword [ebp - 4], 0
pop esi
je 0x7a13b0e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x7a13b0ef
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
mov esi, dword [0x7a20a5c8]
xor eax, eax
inc eax
xor ebx, ebx
add esi, 0x20
cmp dword [esi], 0xbfbfbfbf
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
jne 0x7a13b158
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
push dword [0x7a20cda4]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7a13b158
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x7a13b15e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 4]
add esi, 8
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], esi
jbe 0x7a13b1df
push edi
mov eax, 0x104
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x7a13b1db
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], eax
jae 0x7a13b1db
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, eax
lea edi, [ebp - 0x12c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x7a13b1db
add dword [ebp - 0x14], eax
add dword [ebp - 0xc], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jb 0x7a13b170
jmp 0x7a13b1de
mov dword [ebp - 4], ebx
pop edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x7a13b158
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], eax
jne 0x7a13b158
xor eax, eax
inc eax
jmp 0x7a13b15a