joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100091a9
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x644
mov eax, dword [0x1002a4d0]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov esi, 0x206
mov word [esp + 0x30], ax
push esi
push eax
lea eax, [esp + 0x3a]
push eax
call fcn.1000dc70
add esp, 0xc
lea eax, [esp + 0x30]
mov edi, 0x104
push edi
push eax
push dword [0x1002d348]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
push esi
push eax
mov word [esp + 0x240], ax
lea eax, [esp + 0x242]
push eax
call fcn.1000dc70
add esp, 0xc
lea eax, [esp + 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x57
pop eax
push 0x69
mov word [0x1002d350], ax
lea edi, [esp + 0x444]
pop eax
push 0x6e
mov word [0x1002d352], ax
mov esi, str.Fmnc_m__FTHE_505G3486_16E3_532C_CG0C_2_9E89CGB2C4_
pop eax
push 0x53
pop ecx
push 0x41
mov word [0x1002d354], ax
pop eax
push 0x50
mov word [0x1002d358], ax
pop eax
push 0x76
mov word [0x1002d35a], ax
pop eax
push 0x63
mov word [0x1002d35e], ax
pop eax
push 0x19
mov word [0x1002d356], cx
mov word [0x1002d35c], cx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov word [0x1002d360], ax
xor eax, eax
push 0x1a2
push eax
mov word [0x1002d362], ax
lea eax, [esp + 0x4ae]
push eax
movsw word es:[edi], word [esi]
call fcn.1000dc70
xor esi, esi
add esp, 0xc
xor ecx, ecx
inc esi
mov ax, word [esp + ecx + 0x440]
xor ax, si
mov word [ecx + 0x1002d760], ax
add ecx, 2
cmp ecx, 0x64
jl 0x100092c2
call fcn.10005bfe
xor eax, eax
mov dword [esp + 0x18], 0x736e692d
mov byte [esp + 0x20], al
mov byte [esp + 0x2e], al
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x24], 0x6c6c6174
mov dword [esp + 0x18], 0x6470752d
mov dword [esp + 0x1c], 0x657461
mov dword [esp + 0x2c], 0x696e752d
mov dword [esp + 0x30], 0x6174736e
mov word [esp + 0x34], 0x6c6c
call fcn.1001fe01
pop ecx
pop ecx
test eax, eax
jne 0x10009337
xor ecx, ecx
jmp 0x10009362
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.1001fe01
pop ecx
pop ecx
test eax, eax
jne 0x1000934f
call fcn.1000669d
jmp 0x10009367
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001fe01
pop ecx
pop ecx
test eax, eax
jne 0x10009367
mov ecx, esi
call 0x10006868
mov ecx, dword [esp + 0x64c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100099f1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405376
Capabilities:
Encode data using xor

Disassembly:
cmp word [ebp + 0x47], 0
je 0x405186
ret
mov edx, dword [ebp - 0x38]
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
mov ebx, edi
add byte [ebp - 0x48], bh
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp]
add bl, al
nop
push ebp
mov ebp, esp
int1
add ah, al
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
add byte [eax], al
mov ecx, 0xfee800a8
add al, byte [eax]
add byte [ebx - 0x7d743bab], cl
jl 0x4051bb
add byte [eax], al
call 0x92900046
add al, bl
test ebx, ebx
je 0x40535c
mov edx, dword [ebx + 0x38]
mov eax, dword [0x3198]
call 0x8cdc46
mov eax, dword [eax]
add dh, dh
je 0xdd535c
mov eax, dword [ebp - 0x3c]
call fcn.00406dda
add byte [0xc7faa8], dl
mov esp, 0x733ee800
push ebp
add byte [ebx - 0x38ffffeb], cl
add byte [ebx + 0xa76602], cl
invalid
mov edx, dword [ebp - 0x38]
mov dword fs:[eax + eax - 0x75000000], eax
in eax, 0x8b
jge 0x40536b
add byte [ebp - 0x44], dh
mov ebx, dword [ebp - 0x40]
push ss
add byte [eax - 0x74aa6f70], dl
in al, dx
add dword [eax], 0
add byte [eax], al
push ebx
push esi
push edi
mov dword [ebp + 0x59], eax
add byte [eax], cl
mov edx, 0x26e800a8
add al, ch
push cs
add byte [eax], al
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x46]
call 0x900046
add byte [eax], al
test ebx, ebx
je 0x40c734
mov edx, dword [ebx + 0x38]
mov eax, dword [0xfd98]
call 0x8cdc46
xchg byte [eax], al
test esi, esi
je 0x405534
add byte [ebp - 0x3c], al
call 0xd26dda
mov edx, dword [0xc7faa8]
mov eax, dword [eax]
add byte [esi + 0x71], ah
push ebp
add byte [ebx - 0x3805ff27], cl
add byte [ebx + 0xba6602], cl
add al, ch
cmp eax, 0xfb00554b
add byte [ebp - 0x28], al
or al, 0
lea eax, [ebp - 4]
add byte [eax], al
sar bh, 1
call dword [eax - 0x75]
hlt
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
mov esp, ebp
mov esi, dword [esi - 0x438a7500]
mov ebx, dword [ebp - 0x40]
pop ebp
add byte [eax], al
nop
nop
call 0x9f84ba
ret
xchg ebx, eax
invalid
push ebx
mov ch, 0x16
cdq
adc esp, dword [esi + edi*4 + 0x2a]
fisubr dword [eax - 0x2d]
pop eax
imul edi, dword [ebx + edx*4 - 0x2e], 0x934def8e
shl dword [ebp + 0x6d1d4fc2], cl
cld
jns 0x40c714
push 0x99cd7993
pop ebx
cwde
cdq
add byte [edi], ch
wait
push ds
stosd dword es:[edi], eax
sahf
invalid
Function at 0x4a55da
Capabilities:
Encode data using xor

Disassembly:
push 0x103c27a2
xchg edi, eax
pop esi
fdiv dword [eax + 0x36]
fist dword [edi]
and ebx, dword [0x4d4ec45c]
cmp eax, 0x77a7c1de
mov al, 0x9d
push es
int 0x12
mov eax, 0xb1117da2
or dl, byte [ebx - 0x5507f4e8]
clc
adc ebx, edx
nop
mov cl, 0xc7
mov bl, 0xc0
mov edx, 0x16aa1f3b
cmp ebx, dword [edi]
stosb byte es:[edi], al
push ss
sub eax, 0x966eb12e
add al, dl
loope 0x4a561d
imul ebx, dword [eax - 0x7c816bb0], 0x6fbe5b76
outsd dx, dword [esi]
or al, byte [esi - 0x3c4cee6e]
jns 0x4a5568
inc edx
xchg ebp, eax
invalid
lahf
stosb byte es:[edi], al
mov esi, 0x78ddb818
wait
fnstsw word [eax - 0x65]
sub al, 0xdb
loopne 0x4a5598
ja 0x4a556f
sbb eax, 0xb36a5c18
jecxz 0x4a55df
dec ecx
std
ja 0x4a55ae
lea esp, [eax - 0x28ae60fd]
movsd dword es:[edi], dword [esi]
add dh, byte [edi - 0x3e914a7e]
mov esi, esi
or esi, 0xffffffc0
fbld tbyte [ecx + 0x54bbc862]
lcall 0xedf1, 0x9aff4657
sbb ch, ah
inc edi
mov esp, 0x1cfefb4c
push 0x11e94ed7
jecxz 0x4a5659
dec esi
jmp 0x55823934
push ebp
cwde
lodsb al, byte [esi]
and byte [esi - 0x16], ch
shr byte [edi + 0x12b3791d], 1
lds ebx, [edx]
out dx, eax
sub al, 0xe0
and dword [edi - 0x5ad1c1f0], esp
loop 0x4a563b
invalid
and dword [eax], 0xffffff98
pop esi
add ah, dh
xor dword [esp + esi*8 + 0x641ae297], edi
js 0x4a56cc
sbb dword [ebx - 0x3d], 0xffffffea
mov al, 0x74
cmp eax, 0xb113346
shl byte [ebp + 0x66], 1
out dx, eax
pop edi
and dword [edx + eax*8], edx
cmpsb byte [esi], byte es:[edi]
mov bh, 0x37
js 0x4a565c
je 0x4a56bc
push ss
mov ebp, ebp
out dx, al
pop esi
pushfd
sti
hlt
mov ebp, 0x232518eb
bound ebp, qword [eax]
or ebp, dword [edi - 0x6bd97714]
test eax, 0x5bca722
jae 0x4a56c9
fimul word [esp + ebp]
adc byte [eax - 0x68aa40ee], ah
cmpsd dword [esi], dword es:[edi]
invalid
wait
invalid
cmpsb byte ss:[esi], byte es:[edi]
insb byte es:[edi], dx
dec edi
shl ch, 0x47
push ebx
popfd
xor eax, 0xa10be544
shr dword fs:[0xb0ed6dd2], cl
and dword [edi + 0x9e36c1f], esp
js 0x4a573c
stosb byte es:[edi], al
jle 0x4a568d
xor sp, word [ebp + 0x2d71a1ac]
cmp dword [esp + esi*8], esp
out dx, al
in eax, 0x12
push edx
lds ecx, [ecx - 0x2d]
push eax
pop ebx
fdivrp st(5)
add eax, 0xd2988303
inc ebx
inc ebp
push eax
push ds
fnsave dword [edi + 1]
adc dh, bh
add ebx, dword [0x5635829a]
or eax, 0x1fe0d761
mov esp, 0xdea18c76
add byte [edi], ah
or cl, byte [eax + 0x13c62eea]
sub cl, cl
mov dh, 0xf8
sbb eax, 0x1b92b623
in al, dx
ficomp dword [ebx - 0x295c76bd]
push esp
or dword [0x7ce2f72e], ebx
stosd dword es:[edi], eax
clc
sub eax, 0x4084b0b2
invalid
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x558b30
push dword [0x40470c]
push 0x558b10
push dword [0x558b30]
push 0x558b34
call fcn.0040102b
add esp, 0x14
push 0x558b34
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x558b50
push dword [0x40470c]
push 0x558b10
push dword [0x558b50]
push 0x558b54
call fcn.0040102b
add esp, 0x14
push 0x558b54
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x558b70
push dword [0x40470c]
push 0x558b10
push dword [0x558b70]
push 0x558b74
call fcn.0040102b
add esp, 0x14
push 0x558b74
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x404024]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404028
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x404024]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x404708
push dword [0x4046c8]
push 0x4046cc
push dword [0x404708]
push 0x404710
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x558bcc], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x558bcc]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2fdc3814
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x754022f7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x75005430
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x750055c1
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3000]
push edi
or ebp, 0xffffffff
jmp 0x7500545a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x75005461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x75005450
mov eax, 1
add ebx, ebx
jne 0x75005473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x75005468
jne 0x75005484
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x75005468
xor ecx, ecx
sub eax, 3
jb 0x75005498
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7500550a
mov ebp, eax
add ebx, ebx
jne 0x750054a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x750054b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x750054d4
inc ecx
add ebx, ebx
jne 0x750054c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x750054b5
jne 0x750054d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x750054b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x750054f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x750054e5
jmp 0x75005456
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x750054f4
add edi, ecx
jmp 0x75005456
pop esi
mov edi, esi
mov ecx, 0x4a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x75005512
cmp byte [edi], 5
jne 0x75005512
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x75005517
lea edi, [esi + 0x3000]
mov eax, dword [edi]
or eax, eax
je 0x7500558f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x75005544
mov ecx, edi
jns 0x75005573
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5054]
or eax, eax
je 0x75005589
mov dword [ebx], eax
add ebx, 4
jmp 0x75005561
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x750055c0
cmp al, 0xef
ja 0x750055b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x75005595
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x750055a2
popal
jmp 0x75001eac
Function at 0x100018b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100018ce
cmp dword [ebp + 0x14], 0xffffffff
jne 0x100018ce
mov eax, 0x57
jmp 0x10001913
cmp dword [ebp + 0x14], 0xffffffff
jne 0x100018e4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp + 0x14], eax
movzx edx, byte [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 6
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10001b50
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fc88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [0x100262c4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.10001920
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.10001a20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.10008d60
mov byte [ebp - 4], 2
push 0x2001f
lea ecx, [ebp - 0x4c]
call fcn.10001fd0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.10001860
test eax, eax
jne 0x10001be8
lea ecx, [ebp - 0x30]
call fcn.10001fd0
push eax
lea ecx, [ebp - 0x10]
call fcn.10001c90
lea ecx, [ebp - 0x30]
call fcn.10001fd0
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x10]
call fcn.100017b0
push 0x2001f
push 0x100213f4
push SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.10001860
test eax, eax
jne 0x10001c1c
lea ecx, [ebp - 0x30]
call fcn.10001fd0
push eax
lea ecx, [ebp - 0x10]
call fcn.10001c70
lea ecx, [ebp - 0x10]
call fcn.100017b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.10001790
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10001f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10001f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.10015c30
mov esp, ebp
pop ebp
ret
Function at 0x10006460
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100064a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 1
jne 0x100064b6
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 7
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8

Function at 0x10006980
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100262c4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x10]
call fcn.10008d60
push 0x2001f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx]
push edx
lea ecx, [ebp - 0x10]
call fcn.10001860
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100069de
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x10]
call fcn.10001790
mov eax, dword [ebp - 0x11c]
jmp 0x10006a6f
mov dword [ebp - 4], pe_nt_image_headers32
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x118]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10006a44
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x10]
call fcn.10006980
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006a3b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x10]
call fcn.10001790
mov eax, dword [ebp - 0x120]
jmp 0x10006a6f
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x100069e5
lea ecx, [ebp - 0x10]
call fcn.100017b0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x128]
call fcn.10001c70
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x10]
call fcn.10001790
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x18]
call fcn.10015c30
mov esp, ebp
pop ebp
ret 4
Function at 0x100099b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002002b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov eax, dword [0x100262c4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x5c], ecx
push 0x1002197e
lea ecx, [ebp - 0x34]
call fcn.1000c550
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.100167e0
add esp, 0xc
movzx edx, byte [0x10021c80]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
call fcn.10015a77
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.100167e0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
push str.bwojxiu
mov edx, dword [ebp - 0x38]
push edx
call fcn.100164a0
add esp, 0xc
push 0x10021c2c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.10011c60
add esp, 0xc
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x34]
call fcn.10001fb0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.100163da
add esp, 4
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x34]
call fcn.10001fd0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10009b7a
movzx eax, byte [0x10021cd2]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x3c]
add ecx, 1
push ecx
call fcn.10015a77
add esp, 4
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.100167e0
add esp, 0xc
mov edx, dword [ebp - 0x3c]
push edx
push str.r_Xba
mov eax, dword [ebp - 0x40]
push eax
call fcn.100164a0
add esp, 0xc
push 0x10021c2c
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.10011c60
add esp, 0xc
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x34]
call fcn.10001fb0
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
push edx
call fcn.100163da
add esp, 4
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.10001fd0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10009b70
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001f90
mov eax, dword [ebp - 0x54]
jmp 0x10009b93
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x58], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001f90
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x18]
call fcn.10015c30
mov esp, ebp
pop ebp
ret 8