joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10122ed
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x2000
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x101231d
mov eax, 0x8007000e
jmp 0x1012486
push eax
mov ecx, ebx
call fcn.010121f4
test eax, eax
jge 0x1012330
mov edi, eax
jmp 0x1012476
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.0101206a
test eax, eax
jne 0x101234a
mov edi, 0x80020009
jmp 0x1012476
push edi
call esi
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0xc], esi
jne 0x1012361
mov edi, 0x8007000e
jmp 0x1012476
mov ecx, ebx
call fcn.010121cb
push esi
mov ecx, ebx
call fcn.010121f4
test eax, eax
jl 0x101246c
movzx eax, word [ebp - 2]
sub eax, 8
je 0x1012451
sub eax, 9
je 0x10123b4
dec eax
dec eax
jne 0x101245d
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.01011b61
jmp 0x101245d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
je 0x10123cc
mov edi, 0x80004005
jmp 0x101246e
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.01017ee0
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 4], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
je 0x10123c2
cmp dword [ebp - 8], edi
jle 0x1012438
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.010120f4
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x1012402
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101245d
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.01011b84
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.010121f4
test eax, eax
jge 0x1012484
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x1012486
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1012e2e
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x1012e51
mov eax, 0x80004003
jmp 0x1012f03
cmp dword [ebp + 8], ebx
jne 0x1012e60
mov eax, 0x80070057
jmp 0x1012f03
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1012e98
cmp eax, ebx
jle 0x1012f02
and eax, 0xffff
or eax, 0x80070000
jmp 0x1012f02
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x1012eb2
mov eax, 0x8007000e
jmp 0x1012f02
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x1012ef2
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
jne 0x1012ef7
call fcn.01011087
push dword [esi]
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
mov dword [esi], ebx
pop ecx
mov ebx, edi
jmp 0x1012ef7
mov ebx, 0x8007000e
push dword [ebp + 0xc]
call fcn.01017c44
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x101310f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101f388]
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x1013137
mov esi, 0x54f
jmp 0x1013284
lea ecx, [ebp - 0xc]
push ecx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x1002de4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 4]
push eax
push ebx
jne 0x101319f
mov edi, 0x1002d70
push edi
mov dword [ebp - 4], ebx
call sub.mstlsapi.dll_LsCsp_RetrieveSecret
mov esi, eax
cmp esi, ebx
je 0x1013173
cmp esi, 2
jne 0x1013280
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10131c7
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.mstlsapi.dll_LsCsp_RetrieveSecret
mov esi, eax
cmp esi, ebx
jne 0x1013284
xor edi, edi
inc edi
jmp 0x10131e8
push 2
call sub.mstlsapi.dll_LsCsp_GetServerData
mov esi, eax
cmp esi, 2
je 0x10131b5
cmp esi, ebx
jne 0x1013284
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10131d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101327e
lea ecx, [ebp - 4]
push ecx
push eax
push 2
call sub.mstlsapi.dll_LsCsp_GetServerData
mov esi, eax
cmp esi, ebx
jne 0x1013284
push 0x101f368
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0101bc07
mov esi, eax
cmp esi, ebx
jne 0x1013284
call fcn.01016916
test eax, eax
jne 0x1013280
cmp edi, ebx
jne 0x1013280
push dword [0x101f380]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [0x101f380]
push 4
push 1
push dword [0x101f388]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
jne 0x1013284
mov eax, dword [0x101f384]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x101325d
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
test eax, eax
jne 0x1013257
call edi
mov esi, eax
mov dword [0x101f384], ebx
push 8
push 0xffffffffffffffff
push ebx
push 0x10110f6
push dword [0x101f380]
push 0x101f384
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1013280
call edi
mov esi, eax
cmp esi, ebx
je 0x1013296
push dword [0x101f368]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [0x101f368], ebx
cmp dword [ebp - 8], ebx
je 0x10132a4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
jle 0x10132b4
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10135dc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x101c868
call fcn.01017df8
sub esp, 0x218
mov eax, dword [0x101f128]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.01011931
cmp eax, esi
jne 0x1013685
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101363c
lea eax, [ebp - 0x210]
push eax
call fcn.010135dc
cmp eax, esi
jne 0x1013684
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x101362c
call fcn.010118be
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.010118be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101793c
leave
ret 4
Function at 0x1014ecb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x1014f1d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1014f08
call esi
mov esi, eax
jmp 0x1014fe3
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1014fe3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1014f3e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x1014f63
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1014f51
call esi
jmp 0x1014fd8
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1014fda
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x1014fa2
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.01017ee0
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov byte [eax + ebx], 0
mov edi, esp
test edi, edi
jne 0x1014faa
xor eax, eax
jmp 0x1014fcc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.01017ee0
mov eax, esp
push esi
push edi
push eax
call fcn.01010ff4
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push eax
call fcn.0101410e
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10153d4
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x101c96c
call fcn.01017df8
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 0x1003618
push dword [ebp + 8]
call fcn.0101116e
add esp, 0x10
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x101542e
push eax
push 0x10035d0
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
jmp 0x101558a
push edi
push esi
push 1
push 0x64
push ebx
call fcn.010150af
mov edi, 0x20006
push edi
push 0x10035c0
push 0x80000000
lea ecx, [ebp - 0x18]
call fcn.01011931
mov esi, eax
test esi, esi
je 0x1015475
push esi
push 0x1003580
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
test esi, esi
jg 0x1015494
mov dword [ebp - 0x10], esi
jmp 0x1015589
push edi
push 0x1003530
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.01011931
mov esi, eax
test esi, esi
je 0x10154a2
push esi
push 0x10034b0
jmp 0x101545e
and esi, 0xffff
or esi, 0x80070000
jmp 0x101546d
mov esi, 0x1003494
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 8]
je 0x101555c
push 0x1003464
push edi
call fcn.0101116e
pop ecx
pop ecx
push esi
lea eax, [ebx + 0x286]
push eax
lea ecx, [ebp - 0x14]
call fcn.01011b84
push 0x1003440
push 0x100342c
lea ecx, [ebp - 0x14]
call fcn.01011b84
push edi
mov ecx, ebx
call fcn.010113e1
test eax, eax
mov ecx, ebx
push edi
je 0x1015503
call fcn.0101149f
jmp 0x1015508
call fcn.010115cd
test eax, eax
jne 0x1015527
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10033c8
push edi
call fcn.0101116e
mov dword [ebp - 0x10], 0x8007054f
jmp 0x1015580
push 0x1003380
push edi
call fcn.0101116e
pop ecx
pop ecx
push edi
mov ecx, ebx
call fcn.010113e1
test eax, eax
jne 0x1015554
push 0x1003328
push edi
call fcn.0101116e
pop ecx
pop ecx
mov dword [ebp - 0x10], 0x8007054f
push edi
mov ecx, ebx
call fcn.01011325
cmp dword [ebp - 0x10], 0
jl 0x1015583
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0101445d
test eax, eax
mov dword [ebp - 0x10], eax
jge 0x1015583
push eax
push 0x10032a0
push edi
call fcn.0101116e
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
push dword [ebp - 0x10]
push 0x1003240
push dword [ebp + 8]
call fcn.0101116e
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.010118be
lea ecx, [ebp - 0x14]
call fcn.010118be
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x101606e
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
cmp edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
je 0x101611d
cmp ebx, eax
je 0x101611d
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push 0x40
mov dword [ebx], eax
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x10160f5
push eax
push edi
call fcn.01016011
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x101612a
lea eax, [ebp - 8]
push eax
push 0
push 1
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
call edi
test eax, eax
je 0x10160f5
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call esi
test eax, eax
mov dword [ebx], eax
je 0x10160f5
lea ecx, [ebp - 8]
push ecx
push eax
push 1
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1016100
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
jmp 0x1016124
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
cmp word [eax + ecx*2 - 2], 0xa
jne 0x1016137
lea eax, [eax + ecx*2 - 4]
cmp word [eax], 0xd
jne 0x1016137
and word [eax], 0
jmp 0x1016124
mov dword [ebp + 0xc], 0x57
cmp dword [ebp + 0xc], 0
je 0x1016137
mov ebx, dword [ebx]
test ebx, ebx
je 0x1016137
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x1016149
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0xc]
leave
ret 8
Function at 0x101697b
Capabilities:
Add user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push 3
push esi
push 0
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
test edi, edi
jne 0x10169ea
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x18]
mov edx, dword [ecx]
test dl, 0x12
je 0x10169d7
and edx, 0x10
test dl, 2
mov dword [ecx], edx
je 0x10169b8
and edx, 0xfffffffd
mov dword [ecx], edx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x24], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push 3
push esi
push 0
mov dword [eax], esi
call sub.NETAPI32.dll_NetUserSetInfo
mov edi, eax
mov eax, dword [ebp + 0x20]
push dword [ebp + 8]
mov dword [eax], 1
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1016a30
cmp edi, 0x8ad
jne 0x1016a30
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x20], eax
xor eax, eax
lea ecx, [ebp - 0x24]
inc eax
push ecx
push eax
push 0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0x10040
call sub.NETAPI32.dll_NetUserAdd
mov edi, eax
mov eax, dword [ebp + 0x20]
and dword [eax], 0
mov eax, edi
pop edi
pop esi
leave
ret 0x1c
Function at 0x1016c4a
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
jne 0x1016c6b
push 0x57
pop eax
jmp 0x1016d66
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1016d66
push edi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x1016d3d
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x1016d3d
cmp dword [ebp + 0xc], esi
jle 0x1016d3d
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call edi
mov ebx, eax
cmp ebx, esi
jne 0x1016ced
mov dword [ebp + 8], 0xe
jmp 0x1016d3d
cmp dword [ebp + 0xc], esi
jl 0x1016d31
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
mov ecx, eax
push esi
xor eax, eax
push esi
mov edi, ebx
rep stosw word es:[edi], ax
dec dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x1016d31
push dword [ebp + 0x14]
push ebx
push dword [ebp - 4]
call dword [ebp + 0x10]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x1016ced
cmp dword [ebp + 8], 0x103
jne 0x1016d3d
mov dword [ebp + 8], esi
cmp dword [ebp - 4], esi
je 0x1016d4b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1016d5b
push dword [ebp - 0x10]
call edi
cmp ebx, esi
je 0x1016d62
push ebx
call edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1016d71
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jne 0x1016d92
push 0x57
pop eax
jmp 0x1016eb2
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1016eb2
push edi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x1016e3c
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call edi
mov ebx, eax
cmp ebx, esi
je 0x1016e3c
cmp dword [ebp - 0x14], esi
jbe 0x1016e3c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x1016e3c
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x18], eax
mov ecx, eax
push esi
xor eax, eax
push esi
rep stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1016e3c
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01016d71
cmp eax, esi
je 0x1016e04
xor edi, edi
cmp ebx, esi
je 0x1016e7a
cmp edi, esi
jne 0x1016e7a
mov eax, dword [ebp - 0x10]
push esi
push esi
mov dword [ebp - 0x1c], eax
mov ecx, eax
push esi
xor eax, eax
push esi
mov edi, ebx
rep stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, esi
jne 0x1016e7a
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1016e42
cmp dword [ebp - 4], esi
je 0x1016e88
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp ebx, esi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp + 8], eax
je 0x1016ea4
push ebx
call edi
cmp dword [ebp - 8], esi
je 0x1016eae
push dword [ebp - 8]
call edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10172c3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x1017341
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
push dword [ebp - 4]
mov dword [ebp + 8], edi
call esi
mov ebx, eax
cmp ebx, edi
jne 0x1017337
push 4
pop eax
cmp dword [ebp + 8], eax
jne 0x1017334
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
mov ebx, eax
jmp 0x1017337
push 2
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x1017a54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc edx
inc edx
push eax
inc ecx
push ecx
dec edx
dec edx
push edx
inc ecx
push ebx
inc ecx
push esp
inc ecx
push ebp
push esi
mov eax, edi
push eax
mov eax, ecx
inc eax
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0xe
mov eax, 0x9a
mov ecx, 0xe
mov edx, 0x92492493
push ecx
mov ecx, eax
imul edx
add edx, ecx
sar edx, 3
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x14], eax
mov eax, 0x37
mov ecx, dword [ebp - 0x14]
cdq
idiv ecx
mov dword [ebp - 0x28], eax
mov eax, 0x70
mov ecx, 0xe
mov edx, 0x92492493
push ecx
mov ecx, eax
imul edx
add edx, ecx
sar edx, 3
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
sub eax, 5
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xf5b98107
mov dword [ebp - 0x54], 0x3c84
mov eax, 0x444
mul dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c], 0x73b6
add dword [ebp - 0x3c], 0x1b73
mov dword [ebp - 0x20], 0x15b2
dec dword [ebp - 0x18]
add dword [ebp - 0x3c], 0x302d7
add dword [ebp - 0xc], 0x202f
mov eax, dword [ebp - 0x14]
sub eax, 0xb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x28]
sub edx, 0xc
sub eax, edx
mov dword [ebp - 8], eax
mov eax, 0x2a
mov ecx, dword [ebp - 0x10]
cdq
idiv ecx
mov edi, eax
add edi, dword [ebp - 0x20]
cmp dword [ebp - 8], edi
jbe 0x1017bbf
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [edx + eax]
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7c], eax
mov eax, 0x42
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x14]
cdq
idiv ecx
mov dword [ebp - 0x88], eax
mov ecx, eax
mov eax, dword [ebp - 0x7c]
xor edx, edx
div ecx
mov dword [ebp - 0x8c], eax
mov edi, eax
add edi, dword [ebp - 0x18]
mov edx, edi
and edx, 0xff
mov edi, dword [ebp - 0x84]
xor edi, edx
mov edx, edi
mov byte [ebp - 1], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp - 1]
mov byte [edx + eax], cl
dec dword [ebp - 8]
jmp 0x1017b40
mov dword [ebp - 0x2c], 0x102473f
mov dword [ebp - 0x24], 0x10b0000
inc dword [ebp - 0x1c]
mov eax, 0x1e
mov ecx, dword [ebp - 0x28]
cdq
idiv ecx
cmp dword [ebp - 0x1c], eax
jbe 0x1017b2c
mov dword [ebp - 0x30], 0x104c53f
mov dword [ebp - 0x34], 0x11c3000
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x28]
mov esi, eax
sub esi, 0xd
jmp 0x1017c12
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + esi]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 1]
mov byte [eax + esi], dl
inc esi
cmp esi, 0x27da8
jb 0x1017bff
mov dword [ebp - 0x58], 0x10000000
mov dword [ebp - 0x5c], 0x105d2fb
mov dword [ebp - 0x38], 0x1059d3f
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov ebx, eax
sub ebx, 0x13
cmp ebx, 0xd2e0
je 0x1017c51
invalid
inc ebp