joyce8/EMBER2024-capa huggingface dataset:
Function at 0x657d70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
jne 0x657da5
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.00651030
cmp esi, 0xff
jae 0x657e9d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x657e9d
test eax, eax
jne 0x657db3
mov eax, dword [esp + 0xc]
test eax, eax
je 0x657db3
cmp eax, 0x106
jb 0x657e20
mov dword [esp + 0xc], 0x105
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x657e27
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00698fb7
add esp, 0xc
test eax, eax
jne 0x657db3
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657db3
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x657db3
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00657c30
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x657db3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658510
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38c
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
je 0x658702
cmp edx, ebx
je 0x658702
cmp dword [ebp + 8], 0xa
jl 0x658702
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.00651a50
jmp 0x658570
cmp ebx, 0xff
jae 0x6586f7
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xac]
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
inc ebx
cmp esi, 0x103
je 0x6586f7
test esi, esi
jne 0x6586eb
mov eax, dword [esp + 0x18]
test eax, eax
je 0x658570
movsx ecx, byte [esp + 0x98]
push ecx
call fcn.00698d57
add esp, 4
test eax, eax
je 0x658570
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
lea eax, [esp + 0xa4]
push eax
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658570
mov edx, dword [esp + 0x14]
test edx, edx
je 0x658570
mov ecx, 0x7d
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1a4]
push ecx
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x40]
push ecx
push edx
mov dword [esp + 0x28], 0x1f3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x6586eb
cmp dword [esp + 0x1c], 1
jne 0x658570
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658570
cmp eax, 0x1f4
jb 0x658694
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1a0]
call fcn.00657610
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x658570
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
jle 0x658570
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1a0]
sub esi, eax
lea ebx, [ebx]
cmp ecx, edi
jge 0x658570
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [ebp + 8]
inc ecx
inc eax
cmp ecx, edx
jl 0x6586d0
jmp 0x658570
cmp esi, 0x103
jne 0x658570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658710
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x104
jne 0x658749
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.00651760
jmp 0x658760
cmp esi, 0xff
jae 0x65886c
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xa4]
push edx
push esi
push ebx
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65886c
test eax, eax
jne 0x658760
mov eax, dword [esp + 0x18]
test eax, eax
je 0x658760
movsx eax, byte [esp + 0x90]
push eax
call fcn.00698d57
add esp, 4
test eax, eax
je 0x658760
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x9c]
push edx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658760
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658760
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65885c
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x65885c
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x1c]
push eax
call fcn.00658510
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
jmp 0x658760
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658760
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x659230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
cmp esi, ebx
mov ebp, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
je 0x65943b
cmp ebp, 0xa
jl 0x65943b
push edi
mov ecx, ebp
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00656860
cmp eax, 1
lea ecx, [esp + 0x94]
mov edx, 0x64
jne 0x65929e
call fcn.0064ce00
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064dc30
jmp 0x6592c2
call fcn.0064d1f0
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064da50
mov edx, 0x64
lea ecx, [esp + 0x1c0]
call fcn.0064df60
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064dd50
mov edx, 0x64
lea ecx, [esp + 0x15c]
call fcn.0064de70
lea ecx, [esp + 0x10]
push ecx
xor eax, eax
push 0x20019
mov dword [esp + 0x28], eax
push ebx
lea edx, [esp + 0xa0]
mov dword [esp + 0x30], eax
push edx
mov dword [esp + 0x38], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x40], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65942b
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x65942b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x40]
push ecx
mov ebx, 4
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x6593c9
cmp dword [esp + 0x14], ebx
jne 0x6593c9
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x6593c9
cmp dword [esp + 0x14], ebx
jne 0x6593c9
mov ecx, dword [esp + 0x1c]
push ecx
push 0x6ddb84
lea edx, [esp + 0x28]
push 0xd
push edx
call fcn.00698b54
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6593b3
sub eax, edx
push ebp
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00659110
call fcn.00656810
cmp eax, 1
je 0x6593e5
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x100]
call fcn.00659190
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x164]
call fcn.00659190
call fcn.00656860
cmp eax, 1
je 0x659413
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x1c8]
call fcn.00659190
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
pop edi
pop esi
pop ebp
mov eax, 0x338
pop ebx
add esp, 0x214
ret
pop esi
pop ebp
mov eax, 0x325
pop ebx
add esp, 0x214
ret
Function at 0x659540
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3f8
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov ebx, edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], 0x104
je 0x65978f
cmp ebx, 0xa
jl 0x65978f
mov ecx, ebx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064e3b0
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.0064ea80
mov edx, 0x64
lea ecx, [esp + 0x298]
call fcn.0064ec20
mov edx, 0x64
lea ecx, [esp + 0x1c8]
call fcn.0064ed40
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.0064dc30
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.0064de70
mov edx, 0x64
lea ecx, [esp + 0x230]
call fcn.0064eea0
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659782
mov eax, dword [esp + 0x14]
test eax, eax
je 0x659782
cmp ebp, 0xff
jae 0x65976d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x300]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x314]
push ecx
push ebp
push edx
mov dword [esp + 0x3c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc ebp
cmp eax, 0x103
je 0x65976d
test eax, eax
jne 0x659633
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x659633
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x30c]
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659633
mov eax, dword [esp + 0x18]
test eax, eax
je 0x659633
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65975d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x65975d
push ebx
push esi
lea edx, [esp + 0x2a0]
call fcn.00659190
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x1d0]
call fcn.00659190
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x98]
call fcn.00659190
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x168]
call fcn.00659190
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x238]
call fcn.00659190
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659633
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x659c90
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x104
jne 0x659cc5
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.00651a50
cmp esi, 0xff
jae 0x659d9b
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x659d9b
test eax, eax
jne 0x659cd3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659cd3
movsx eax, byte [esp + 0x88]
push eax
call fcn.00698d57
add esp, 4
test eax, eax
je 0x659cd3
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x94]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659cd3
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659cd3
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x14]
push eax
push edx
lea edx, [esp + 0x28]
call fcn.00659190
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659cd3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x659db0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
jne 0x659de0
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xff
jae 0x659e7d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x659e7d
test eax, eax
jne 0x659de0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659de0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659de0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659de0
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00659c90
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659de0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x659e90
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x104
jne 0x659ec5
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.00651a50
cmp esi, 0xff
jae 0x659fad
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x659fad
test eax, eax
jne 0x659ed3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659ed3
movsx eax, byte [esp + 0x88]
push eax
call fcn.00698d57
add esp, 4
test eax, eax
je 0x659ed3
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x94]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659ed3
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659ed3
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x14]
push edi
push eax
lea edx, [esp + 0x28]
call fcn.00659190
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edi
call fcn.00659db0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659ed3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x659fc0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
jne 0x659ff0
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xff
jae 0x65a08d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65a08d
test eax, eax
jne 0x659ff0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x659ff0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x659ff0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x659ff0
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00659e90
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659ff0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x65a0a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f0
push ebx
push ebp
push esi
push edi
mov ebp, edx
xor esi, esi
mov ebx, ecx
cmp ebx, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x104
je 0x65a23b
cmp ebp, 0xa
jl 0x65a23b
mov ecx, ebp
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.0064ef90
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.00651a50
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
lea ecx, [esp + 0x9c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65a22e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x65a22e
lea ebx, [ebx]
cmp esi, 0xff
jae 0x65a219
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0xf8]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10c]
push ecx
push esi
push edx
mov dword [esp + 0x3c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65a219
test eax, eax
jne 0x65a140
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x65a140
movsx eax, byte [esp + 0xf8]
push eax
call fcn.00698d57
add esp, 4
test eax, eax
je 0x65a140
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x104]
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65a140
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x65a140
push ebp
push ebx
lea edx, [esp + 0x30]
call fcn.00659190
mov ecx, dword [esp + 0x18]
push ebp
mov edx, ebx
call fcn.00659fc0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x65a140
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6608e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x66093c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6ba446
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x66092f
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x66093e
xor eax, eax
pop esi
leave
ret 4

Function at 0x663200
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x6781d0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x6982e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x7ee77c], esi
push edi
jne 0x698301
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x7ee778], esi
mov byte [0x7ee774], al
jne 0x698367
mov ecx, dword [0x7f062c]
test ecx, ecx
je 0x698348
mov eax, dword [0x7f0628]
sub eax, 4
cmp eax, ecx
jmp 0x698341
mov eax, dword [eax]
test eax, eax
je 0x698333
call eax
mov eax, dword [0x7f0628]
sub eax, 4
cmp eax, dword [0x7f062c]
mov dword [0x7f0628], eax
jae 0x69832b
mov eax, 0x6e92c8
mov esi, 0x6e92d4
cmp eax, esi
mov edi, eax
jae 0x698367
mov eax, dword [edi]
test eax, eax
je 0x698360
call eax
add edi, 4
cmp edi, esi
jb 0x698358
mov eax, 0x6e92d8
mov esi, 0x6e92e0
cmp eax, esi
mov edi, eax
jae 0x698386
mov eax, dword [edi]
test eax, eax
je 0x69837f
call eax
add edi, 4
cmp edi, esi
jb 0x698377
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x6983a0
push dword [ebp + 8]
mov dword [0x7ee77c], 1
call fcn.00698247
pop ebp
ret

Function at 0x69ca60
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x6fb3d0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x6fb3e8]
je 0x69ca97
inc eax
cmp eax, 0x13
jb 0x69ca88
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x6fb3e8]
jne 0x69cbba
mov eax, dword [0x7ee728]
cmp eax, 1
je 0x69cb95
cmp eax, edx
jne 0x69cac7
cmp dword [0x6fb0e4], 1
je 0x69cb95
cmp ecx, 0xfc
je 0x69cbba
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x69cafd
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.0069e970
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.0069b540
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x69cb31
mov eax, edi
push eax
call fcn.0069b540
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x6e377c
push edi
call fcn.00698a30
add esp, 0x10
push edi
call fcn.0069b540
push dword [esi + 0x6fb3ec]
mov ebx, eax
call fcn.0069b540
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.006977b0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0069e970
push edi
push ebx
call fcn.0069e980
push 0x6bcbd4
push ebx
call fcn.0069e980
push dword [esi + 0x6fb3ec]
push ebx
call fcn.0069e980
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.006a06cb
add esp, 0x2c
jmp 0x69cbba
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x6fb3ec]
push dword [esi]
call fcn.0069b540
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.0069b68c
add ebp, 0x90
leave
ret