joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e00c686
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 8], esi
cmp dword [edi + 0x44], esi
je 0x2e00c6a3
xor ebx, ebx
inc ebx
jmp 0x2e00c889
cmp dword [ebp + 8], esi
jne 0x2e00c6f1
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x40]
mov ebx, eax
cmp ebx, esi
jl 0x2e00c889
lea eax, [ebp + 8]
push eax
push 2
push esi
push dword [edi + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jle 0x2e00c6e0
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x2e00c889
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x48]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x2e001ec0
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c71e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x2e001eac
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c750
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x74]
push eax
push 4
push 0
push 0x2e001e8c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c77c
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x70]
push eax
push 4
push 0
push 0x2e001e6c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c7a8
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x2e001f38
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c7d4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x5c]
push eax
push 4
push 0
push 0x2e001f20
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c800
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x60]
push eax
push 4
push 0
push 0x2e001f04
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c828
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
lea eax, [edi + 0x64]
push eax
push 4
push 0
push 0x2e001eec
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c850
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x2e00c87a
push 4
add edi, 0x68
push edi
push 4
push 0
push 0x2e001ecc
push dword [ebp + 8]
call esi
test eax, eax
jle 0x2e00c878
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x2e00c889
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x2e00f5ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1170
call fcn.2e014628
mov eax, dword [0x2e022064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov esi, 0x1154
push esi
mov dword [ebp - 0x1170], eax
lea eax, [ebp - 0x1158]
push ebx
push eax
mov dword [ebp - 0x1164], ebx
mov dword [edi], ebx
call fcn.2e01440c
push 0xffffffffffffffff
push dword [ebp - 0x1160]
lea eax, [ebp - 0x1150]
push 0x80
push eax
mov dword [ebp - 0x1158], esi
mov dword [ebp - 0x1154], 7
call fcn.2e014486
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x1050]
push eax
push ebx
push ebx
push 0x2e002114
push dword [ebp - 0x1168]
mov dword [ebp - 0x1160], 0x1048
call esi
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jle 0x2e00f6bf
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x115c], ebx
jl 0x2e00f752
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x2e0017cc
push dword [ebp - 0x1168]
mov dword [ebp - 0x1160], 4
call esi
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jle 0x2e00f709
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x115c], ebx
jl 0x2e00f752
lea eax, [ebp - 0x1164]
push eax
push dword [ebp - 0x1170]
lea eax, [ebp - 0x1158]
push eax
push dword [ebp - 0x116c]
call fcn.2e00f579
cmp eax, ebx
mov dword [ebp - 0x115c], eax
jl 0x2e00f752
mov eax, dword [ebp - 0x1164]
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x115c], ebx
jmp 0x2e00f758
mov eax, dword [ebp - 0x1164]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x2e00f76f
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x115c]
xor ecx, ebp
call fcn.2e0142db
leave
ret 0x14
Function at 0x2e00fd11
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, 0xffffffff
jne 0x2e00fd35
mov dword [ebp - 4], 1
jmp 0x2e00fe17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
cmp dword [ebp + 8], edi
je 0x2e00fe17
cmp dword [esi + 0x14], edi
jne 0x2e00fe17
push ebx
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x250], eax
cmp eax, 0xffffffff
jne 0x2e00fd97
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fd92
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fe16
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push edi
push edi
push ecx
push eax
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x2e00fdd2
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fdcd
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fe16
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x2e00fdfd
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x2e00fdf8
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x2e00fe16
mov edx, dword [esi + 0x244]
mov ecx, dword [esi + 0x240]
mov eax, dword [esi + 0x20]
mov edi, dword [eax]
push edx
push ecx
push edx
push ecx
push eax
call dword [edi + 0x50]
pop ebx
mov eax, dword [esi + 0x250]
cmp eax, 0xffffffff
je 0x2e00fe30
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x2e010976
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push esi
push edi
push 0x44
pop edi
push 1
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0xff
call fcn.2e01f441
mov dword [ebp - 4], eax
test eax, eax
jne 0x2e0109a8
mov esi, 0x8007000e
jmp 0x2e010a9e
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.2e010bf3
mov esi, eax
test esi, esi
jl 0x2e010a9e
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x2e010a90
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x2e010a7c
cmp dword [ebp - 0x10], edi
jbe 0x2e010a29
push 1
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e01f463
mov edi, eax
test edi, edi
jne 0x2e010a26
call ebx
mov esi, eax
test esi, esi
jle 0x2e010a24
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x2e010a9d
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc], 0xff
jbe 0x2e010a44
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.2e010bf3
mov esi, eax
test esi, esi
jl 0x2e010a9d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x2e010a90
call ebx
mov esi, eax
test esi, esi
jle 0x2e010a8e
and esi, 0xffff
or esi, 0x80070000
jmp 0x2e010a8c
test eax, eax
jle 0x2e010a8a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x2e010a9d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
pop ebx
cmp dword [ebp - 8], 0
je 0x2e010aac
push dword [ebp - 8]
call fcn.2e010d00
cmp dword [ebp - 4], 0
je 0x2e010aba
push dword [ebp - 4]
call fcn.2e01f488
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x2e010ac2
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor edx, edx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, 0x80070000
cmp ecx, edx
je 0x2e010af6
lea eax, [ebp - 4]
push eax
push ecx
push edx
call fcn.2e010976
mov esi, eax
jmp 0x2e010b35
lea ecx, [ebp - 4]
push ecx
push dword [eax + 0x30]
movzx ecx, byte [eax + 0x12]
push dword [eax + 0x2c]
add eax, 0xc
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x2e010b39
call edi
mov esi, eax
test esi, esi
jle 0x2e010b37
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e010b6b
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x2e010b61
call edi
mov esi, eax
test esi, esi
jle 0x2e010b5f
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e010b6b
xor eax, eax
cmp dword [ebp - 8], eax
sete al
mov esi, eax
cmp dword [ebp - 4], 0
je 0x2e010b7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x2e011164
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e011209
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2e011209
movzx eax, word [ebx]
push esi
xor esi, esi
mov ecx, ebx
test ax, ax
je 0x2e0111b3
movzx eax, ax
cmp ax, 0x5c
jne 0x2e0111a5
mov esi, ecx
inc ecx
inc ecx
movzx eax, word [ecx]
test ax, ax
jne 0x2e01119d
test esi, esi
jne 0x2e0111ba
mov edi, 0x80070003
jmp 0x2e011208
push dword [ebp + 0xc]
xor eax, eax
push ebx
mov word [esi], ax
call fcn.2e011164
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
jl 0x2e011208
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e011206
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2e0111f4
xor edi, edi
inc edi
jmp 0x2e011208
test eax, eax
jle 0x2e011202
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x2e011208
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x2e01143c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ebx, 0x80070000
cmp eax, esi
jne 0x2e011486
call edi
mov esi, eax
test esi, esi
jle 0x2e011480
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011515
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x2e01149f
mov esi, 0x8007000e
jmp 0x2e011506
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x2e0114c6
call edi
mov esi, eax
test esi, esi
jle 0x2e0114c4
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011506
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x2e0017b0
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x2e0114f3
call edi
mov esi, eax
test esi, esi
jle 0x2e0114f1
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011506
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x2e011515
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x2e01158d
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x2e011632
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
jne 0x2e011621
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x2e0115c8
mov esi, 0x80070005
jmp 0x2e011631
test al, 0x10
je 0x2e0115d3
mov esi, 0x8000ffff
jmp 0x2e011631
test al, 7
je 0x2e011631
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, 0x80070000
test eax, eax
jne 0x2e011602
call edi
mov esi, eax
test esi, esi
jle 0x2e011600
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011631
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x2e011631
call edi
mov esi, eax
test esi, esi
jle 0x2e011631
and esi, 0xffff
or esi, ebx
jmp 0x2e011631
test eax, eax
jle 0x2e01162f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x2e01163a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.2e010c3d
mov ebx, eax
cmp ebx, edi
jl 0x2e01172a
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor esi, esi
cmp dword [ebp - 4], 0xffffffff
jne 0x2e0116ef
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push dword [ebp + 8]
push dword [ebp - 0xc]
push 0x2e0022a4
push eax
call fcn.2e011050
mov ebx, eax
add esp, 0x18
cmp ebx, edi
jl 0x2e01172a
push edi
push 0x80
push 1
push edi
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x2e0116e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x2e0116d4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, 0x80070050
jne 0x2e0116e2
xor ebx, ebx
jmp 0x2e0116e6
cmp ebx, edi
jl 0x2e01172a
inc esi
cmp esi, 0x3e8
jl 0x2e011674
cmp dword [ebp + 0x10], edi
je 0x2e011707
push 0xfde9
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.2e010dcb
mov ebx, eax
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x2e011713
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp ebx, edi
jl 0x2e01171b
cmp eax, edi
jne 0x2e01172a
cmp dword [ebp - 4], 0xffffffff
je 0x2e01172a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x2e011737
push dword [ebp - 8]
call fcn.2e010d00
cmp dword [ebp - 0xc], edi
je 0x2e011744
push dword [ebp - 0xc]
call fcn.2e010d00
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x2e0121e5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
push esi
mov esi, 0xff
cmp dword [0x2e023350], ecx
jne 0x2e01222e
mov dword [0x2e023350], 1
push edi
push 8
mov edx, ecx
pop edi
test dl, 1
je 0x2e01221a
shr edx, 1
xor edx, 0xedb88320
jmp 0x2e01221c
shr edx, 1
dec edi
test edi, edi
jg 0x2e01220b
mov dword [ecx*4 + 0x2e022f50], edx
inc ecx
cmp ecx, esi
jle 0x2e012206
pop edi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jbe 0x2e01224f
mov edx, dword [ebp + 8]
movzx edx, byte [edx]
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x2e022f50]
inc dword [ebp + 8]
dec ecx
jne 0x2e012235
not eax
pop esi
pop ebp
ret 8

Function at 0x2e0128d3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x2e022064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x20c], eax
xor eax, eax
push edi
mov dword [ebp - 0x208], eax
mov ebx, 0xffff
mov edi, 0x80070000
lea ecx, [ebp - 0x218]
push ecx
push eax
push eax
push eax
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x204]
push ecx
push eax
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x2e01293f
and esi, ebx
or esi, edi
test esi, esi
jne 0x2e0129bf
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x2e01296e
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0129d4
push dword [ebp - 0x208]
call fcn.2e0128d3
mov esi, eax
test esi, esi
jle 0x2e012987
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0129d4
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jle 0x2e0129bb
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0129d4
jmp 0x2e0129c7
cmp esi, 0x80070103
je 0x2e0129d2
test esi, esi
jne 0x2e0129d4
xor eax, eax
jmp 0x2e012904
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x2e0129e9
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e0142db
leave
ret 4
Function at 0x2e0129fc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x2e022064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.2e014486
add esp, 0x10
cmp eax, 0x50
jne 0x2e012a39
mov eax, 0x8007007a
jmp 0x2e012a7a
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x2e012a89
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.2e01524d
pop ecx
pop ecx
test eax, eax
je 0x2e012a6a
xor ecx, ecx
mov word [eax], cx
cmp cx, word [eax + 2]
je 0x2e012a4b
cmp word [ebp - 0x20c], 0
je 0x2e012a78
test eax, eax
jne 0x2e012a39
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.2e0142db
leave
ret 8
cmp eax, 2
je 0x2e012aa3
cmp eax, 3
je 0x2e012aa3
test eax, eax
jle 0x2e012aa5
and eax, 0xffff
or eax, 0x80070000
jmp 0x2e012aa5
xor eax, eax
cmp eax, 1
je 0x2e012a39
jmp 0x2e012a7a

Function at 0x2e012aac
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x2e012ad6
xor ebx, ebx
inc ebx
jmp 0x2e012b23
push esi
push edi
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x2e012aea
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jl 0x2e012b21
push dword [ebp - 4]
call fcn.2e0128d3
mov ebx, eax
test ebx, ebx
jl 0x2e012b21
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x2e012b1f
and eax, edi
or eax, esi
mov ebx, eax
pop edi
pop esi
cmp dword [ebp - 4], 0
je 0x2e012b32
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x2e012ba4
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp edi, eax
je 0x2e012bf2
cmp word [edi], ax
je 0x2e012bf2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
push dword [ebp + 0xc]
mov ebx, eax
call esi
lea eax, [ebx + eax + 3]
push eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.2e010c88
mov edi, eax
test edi, edi
jl 0x2e012d85
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
jmp 0x2e012c2b
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
add eax, 3
push eax
lea eax, [ebp - 4]
push eax
call fcn.2e010bf3
mov edi, eax
test edi, edi
jl 0x2e012d85
push 0xffffffffffffffff
push ebx
push 4
push dword [ebp - 4]
call fcn.2e014486
add esp, 0x10
add ebx, 6
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx]
push 0x5c
pop edx
cmp dx, ax
jne 0x2e012c3f
cmp dx, word [ecx + 2]
je 0x2e012c7b
push 0x61
pop edx
cmp dx, ax
ja 0x2e012c4f
push 0x7a
pop edx
cmp dx, ax
jae 0x2e012c5f
push 0x41
pop edx
cmp dx, ax
ja 0x2e012c71
push 0x5a
pop edx
cmp dx, ax
jb 0x2e012c71
push 0x3a
pop eax
cmp ax, word [ecx + 2]
jne 0x2e012c71
push 0x5c
pop eax
cmp ax, word [ecx + 4]
je 0x2e012c7b
mov edi, 0x80070057
jmp 0x2e012d88
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x2e012c96
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 8], eax
push ecx
call esi
mov ecx, dword [ebp - 4]
lea ebx, [ecx + eax*2]
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
je 0x2e012d88
mov esi, 0x80070000
push 0x5c
pop edx
cmp dx, ax
jne 0x2e012cc7
mov edx, dword [ebp + 0xc]
cmp dword [ebp + 8], edx
je 0x2e012d70
push 0x5c
pop ecx
mov word [ebx], ax
cmp cx, ax
jne 0x2e012d6b
push dword [ebp - 8]
xor eax, eax
mov word [ebx + 2], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e012d3d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x2e012d2c
cmp dword [ebp + 0x14], 0
je 0x2e012d28
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x2e012d28
call edi
mov edi, eax
test edi, edi
jle 0x2e012d26
and edi, 0xffff
or edi, esi
test edi, edi
jl 0x2e012d85
xor edi, edi
jmp 0x2e012d3d
test eax, eax
jle 0x2e012d37
and eax, 0xffff
or eax, esi
mov edi, eax
test edi, edi
jl 0x2e012d85
cmp dword [ebp + 0x18], 0
je 0x2e012d6b
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x2e012d6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x2e012d69
and edi, 0xffff
or edi, esi
test edi, edi
jl 0x2e012d85
mov ecx, dword [ebp - 4]
inc ebx
inc ebx
add dword [ebp + 8], 2
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
jne 0x2e012cb3
jmp 0x2e012d88
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x2e012d92
push ecx
call fcn.2e010d00
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14