joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a4a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
push eax
push 0x20019
push 0
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
or edi, 0xffffffff
call esi
test eax, eax
jne 0x1009a559
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
push str.Open_Executive_4
push edx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1009a552
mov eax, 4
lea ecx, [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push str.OLAP_ThreadPriority
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009a54b
mov eax, dword [esp + 8]
cmp eax, 0xfffffff1
je 0x1009a549
cmp eax, 0xfffffffe
je 0x1009a549
cmp eax, 0xffffffff
je 0x1009a549
test eax, eax
je 0x1009a549
cmp eax, 1
je 0x1009a549
cmp eax, 2
je 0x1009a549
or eax, 0xffffffff
mov dword [esp + 8], eax
mov edi, eax
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, edi
pop edi
pop esi
add esp, 0x14
ret

Function at 0x1009ac40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, 0x100f0e00
jmp 0x1009ac50
push 0xffffffffffffffff
push 0x100b928e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
lea esi, [edi + 4]
mov ecx, esi
call sub.MFC42.DLL_CString::CString
push str.OBudget.log
mov ecx, esi
mov dword [esp + 0x128], 0
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareOpen_Executive_4Open_BudgetLogFile
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009ad2b
lea ecx, [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.LogFileName
push eax
mov dword [esp + 0x24], 0x104
call ebx
test eax, eax
jne 0x1009aceb
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0
push str.LogLevel
push ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 4
call ebx
test eax, eax
pop ebx
jne 0x1009ad20
mov edx, dword [esp + 0x10]
mov dword [edi], edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x1009bce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push esi
mov esi, dword [esp + 0xc]
push edi
test ebx, ebx
jle 0x1009bcff
mov cl, byte [eax + esi]
xor cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, ebx
jl 0x1009bcf1
mov eax, ebx
xor ecx, ecx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
test edi, edi
jle 0x1009bd22
lea edx, [esi + ebx - 1]
mov bl, byte [edx]
mov al, byte [ecx + esi]
mov byte [ecx + esi], bl
mov byte [edx], al
inc ecx
dec edx
cmp ecx, edi
jl 0x1009bd12
pop edi
pop esi
pop ebx
ret

Function at 0x1009c090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b946b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CString::CString
push 0xa
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], 0
call fcn.100aea28
mov ecx, dword [esp + 8]
mov dword [esi + 0x30], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1009dc20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1d8
mov al, byte [0x100f029c]
push ebp
push esi
push edi
mov byte [esp + 0xe0], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xe1]
rep stosd dword es:[edi], eax
xor ebp, ebp
mov dword [esp + 0x20], 0x104
stosw word es:[edi], ax
push ebp
push ebp
push ebp
mov dword [esp + 0x1c], ebp
stosb byte es:[edi], al
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [esp + 0x1ec]
mov edx, dword [esp + 0x1e8]
mov edi, eax
push ecx
push edx
lea eax, [esp + 0x68]
push str.SoftwareOpen_Executive_4International_s_s
push eax
mov dword [esp + 0x38], edi
xor esi, esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x60]
push ecx
push 1
push ebp
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009dddc
lea eax, [esp + 0x58]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x54]
push edx
lea ecx, [esp + 0x50]
push eax
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push ebp
lea eax, [esp + 0x104]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1009ddc4
mov edx, dword [esp + 0x1c]
push edx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebp
je 0x1009ddc4
cmp dword [esp + 0x10], ebp
jbe 0x1009ddc4
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push ebx
mov ebx, dword [esp + 0x1f4]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x38]
mov dword [esp + 0x20], eax
push esi
push edx
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x14
mov byte [esp + 0x54], 0
push 0
lea ecx, [esp + 0x58]
mov byte [esi], 0
mov edx, dword [esp + 0x28]
push eax
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [esp + 0x48]
push str.AbbrevLangName
push eax
call edi
add esp, 8
test eax, eax
jne 0x1009dd81
mov ecx, dword [esp + 0x1c]
push ecx
push esi
push ebx
jmp 0x1009dd9e
lea edx, [esp + 0x48]
push str.Text
push edx
call edi
add esp, 8
test eax, eax
jne 0x1009ddb0
mov eax, dword [esp + 0x1c]
lea ecx, [ebx + 0x10]
push eax
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [esp + 0x1c]
add esp, 0xc
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, eax
jb 0x1009dd2a
mov edi, dword [esp + 0x2c]
xor ebp, ebp
pop ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x1009dddc
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 2
pop edi
pop esi
pop ebp
sete al
add esp, 0x1d8
ret
Function at 0x1009e070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov ecx, ebx
xor esi, esi
call sub.MFC42.DLL_CString::Empty
lea eax, [esp + 8]
push eax
push 1
push esi
push str.SoftwareOpen_Executive_4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009e134
mov eax, dword [esp + 0x120]
mov dword [esp + 0x10], 1
test eax, eax
mov dword [esp + 0xc], 0x104
mov eax, str.OpenDir2
jne 0x1009e0cd
mov eax, str.OpenDir
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009e129
push edi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
mov esi, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x1009e129
mov al, byte [esp + ecx + 0x13]
cmp al, 0x5c
mov eax, 0x100f029c
je 0x1009e115
mov eax, 0x100e0670
push eax
lea eax, [esp + 0x18]
push eax
push 0x100e0be8
push ebx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x1009e140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
mov ecx, ebp
xor esi, esi
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x128]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009e207
lea eax, [esp + 0x10]
push eax
push 1
push esi
push str.SoftwareOpen_Executive_4
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009e207
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push esi
push str.TempDir
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x104
call ebx
test eax, eax
jne 0x1009e1f4
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, 1
je 0x1009e1f4
mov al, byte [esp + ecx + 0x1b]
cmp al, 0x5c
mov eax, 0x100f029c
je 0x1009e1e0
mov eax, 0x100e0670
lea edx, [esp + 0x1c]
push eax
push edx
push 0x100e0be8
push ebp
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1009e2ac
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push str.SoftwareOpen_Executive_4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009e2ac
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.TempDir
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0x104
call ebx
test eax, eax
jne 0x1009e2a1
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1009e266
mov byte [esp + 0x1c], 0
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov esi, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1009e2a1
mov al, byte [esp + ecx + 0x1b]
cmp al, 0x5c
mov eax, 0x100f029c
je 0x1009e28d
mov eax, 0x100e0670
push eax
lea eax, [esp + 0x20]
push eax
push 0x100e0be8
push ebp
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x1009e2c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100b97d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 4]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.1009e140
add esp, 8
test eax, eax
je 0x1009e371
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 8]
test eax, eax
je 0x1009e365
push 6
push 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x1009e365
mov edx, dword [esp + 0x18]
lea ecx, [esp + 4]
push edx
push eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.100ae920
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
jmp 0x1009e37b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
lea ecx, [esp + 4]
neg esi
sbb esi, esi
mov dword [esp + 0x10], 0xffffffff
neg esi
call fcn.100ae920
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1009e3b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
push esi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareOpen_Executive_4
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, 0x80004005
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009e41b
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edi
push edx
push eax
mov eax, dword [esp + 0x24]
push str.OpenMode
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009e410
xor esi, esi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x1009e430
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.SoftwareOpen_Executive_4
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009e498
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009e48d
xor esi, esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x100a4560
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100b9d8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push esi
mov esi, dword [esp + 0x164]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call sub.MFC42.DLL_CStringArray::SetSize
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x164]
mov ebx, dword [esp + 0x160]
push eax
push ebx
lea ecx, [esp + 0x14]
push str._s._s
push ecx
mov dword [esp + 0x168], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x1c]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100a45f1
lea ecx, [esp + 0xc]
mov dword [esp + 0x158], eax
call fcn.100ae920
xor eax, eax
jmp 0x100a464a
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x10]
push ecx
push ebx
push str._s_s
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 8]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CStringArray::SetAtGrow
lea edx, [esp + 0x14]
push edx
push edi
call ebp
test eax, eax
jne 0x100a45f8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov dword [esp + 0x15c], 0xffffffff
call fcn.100ae920
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret
Function at 0x100bb295
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push ebx
push ebp
push esi
push edi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push 0x100bb250
push 0
push 0x100bb258
push SysReAllocStringLen
call edi
mov esi, eax
test esi, esi
jne 0x100bb3c8
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push eax
push esi
push 0xf003f
push esi
push 0x100bb260
push esi
push ecx
push edx
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x100bb3b1
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x100bb268
push 0
push 0x100bb270
push edx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
jne 0x100bb380
mov edx, dword [esp + 0x2c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push 0x100bb280
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x100bb379
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100bb379
mov ecx, dword [esp + 0x10]
push 5
push eax
push 1
push esi
push 0x100bb284
push ecx
call ebx
mov esi, eax
mov edx, dword [esp + 0x10]
push edx
call ebp
test esi, esi
jne 0x100bb3aa
mov edx, dword [esp + 0x28]
test edx, edx
je 0x100bb3aa
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x24]
push 0x100bb294
push eax
call ebx
mov esi, eax
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x1c]
push edx
call ebp
test esi, esi
jne 0x100bb3c8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
push esi
call fcn.100bb6d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x100bb408
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x38
lea eax, [esp + 4]
push ebx
push esi
push edi
push 0x32
push eax
push ecx
xor ebx, ebx
call fcn.100bb1a0
lea edx, [esp + 0xc]
lea eax, [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push eax
push ebx
push 0xf003f
push ebx
push 0x100bb3f0
lea ecx, [esp + 0x28]
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x100bb481
mov edx, dword [esp + 0x54]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x5c]
push 0x100bb3f8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100bb489
push esi
call fcn.100bb6d0
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x38
ret 0x14
Function at 0x100bdce0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x134
mov ecx, dword [esp + 0x13c]
push esi
lea eax, [esp + 8]
push edi
push eax
push ecx
mov dword [esp + 0x14], 0
xor edi, edi
mov dword [esp + 0x18], 0x28
call sub.RPCRT4.dll_UuidToStringA
test eax, eax
je 0x100bdd20
mov eax, 0x8007000e
pop edi
pop esi
add esp, 0x134
ret 8
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
push edx
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call sub.RPCRT4.dll_RpcStringFreeA
lea edx, [esp + 0x3c]
push 0x100bdcc0
push edx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
push ecx
call esi
lea edx, [esp + 0x3c]
push 0x100bdccc
push edx
call esi
lea eax, [esp + 8]
lea ecx, [esp + 0x3c]
push eax
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100bdd8f
mov eax, 0x80004005
pop edi
pop esi
add esp, 0x134
ret 8
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
push eax
push 0
push 0
push 0x100bdcd0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100bddce
mov edx, dword [esp + 8]
push edx
call esi
xor eax, eax
mov edi, 0x80004005
mov dword [esp + 8], eax
jmp 0x100bddd2
mov eax, dword [esp + 8]
test eax, eax
je 0x100bddd9
push eax
call esi
mov eax, edi
pop edi
pop esi
add esp, 0x134
ret 8
Function at 0x639f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18a000]
push edi
or ebp, 0xffffffff
jmp 0x639f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x639f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x639f28
mov eax, 1
add ebx, ebx
jne 0x639f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x639f5c
jne 0x639f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x639f7b
dec eax
add ebx, ebx
jne 0x639f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x639f40
add ebx, ebx
jne 0x639f77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x639fcd
xor ecx, ecx
sub eax, 3
jb 0x639f93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x63a002
sar eax, 1
mov ebp, eax
jmp 0x639f9e
add ebx, ebx
jne 0x639f9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x639f6c
inc ecx
add ebx, ebx
jne 0x639fac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x639f6c
add ebx, ebx
jne 0x639fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x639fae
jne 0x639fca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x639fae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x639fec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x639fde
jmp 0x639f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x639fec
add edi, ecx
jmp 0x639f2e
pop esi
mov edi, esi
mov ecx, 0xa239
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x63a00a
cmp byte [edi], 0x19
jne 0x63a00a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x63a00f
lea edi, [esi + 0x227000]
mov eax, dword [edi]
or eax, eax
je 0x63a087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27a4a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x27a644]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x63a03c
mov ecx, edi
jns 0x63a06b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x27a648]
or eax, eax
je 0x63a081
mov dword [ebx], eax
add ebx, 4
jmp 0x63a059
call dword [esi + 0x27a658]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x63a0b8
cmp al, 0xef
ja 0x63a0ab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x63a08d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x63a09a
mov ebp, dword [esi + 0x27a64c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x63a0ec
sub esp, 0xffffff80
jmp 0x529c4e