joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c0d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x51c117
call fcn.0052caa8
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x51c117
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x51c133
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0052e23c
mov ebx, eax
test edi, edi
je 0x51c131
test esi, esi
je 0x51c131
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x51cb1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x51cbda
cmp dword [esi + 0x20], 0
je 0x51cbda
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x51cbda
cmp dword [ebp + 8], 0
je 0x51cbda
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0052caa8
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x51cbab
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x51cbda
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00533a1b
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x51cbcb
test edi, edi
je 0x51cbcb
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x51cbd6
mov ecx, esi
call fcn.0051c8bf
mov eax, ebx
jmp 0x51cbdc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x521518
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x6718c9
call fcn.0064f2ce
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x52153e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x52159d
call fcn.005196d3
push eax
lea ecx, [ebp - 0x10]
call fcn.004de2fd
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0064f291
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00658dfe
push eax
call fcn.0042bbdd
add esp, 0x14
test esi, esi
je 0x521590
push esi
call fcn.00658e40
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042c180
mov eax, ebx
call fcn.0064f297
ret 8
Function at 0x521c5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x521c86
cmp dword [ebx + 0x80], 0
jne 0x521c86
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.0052caa8
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.00521f14
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x521cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0052caa8
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x521cf7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00521d18
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x52f678
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00521462
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x52f6b4
call fcn.0052f89a
mov dword [esi + 0xc], 1
jmp 0x52f6b9
call fcn.0052f89a
cmp dword [esi], 0
je 0x52f702
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x52f6dc
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00453daa
jmp 0x52f6ed
push 0xff
mov ecx, esi
call fcn.0042c0c0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0042c1af
jmp 0x52f726
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x52f726
push dword [esi]
push dword [ebp - 4]
call fcn.00531a68
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52f7ef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0052f89a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x52f837
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00453daa
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0042c1af
jmp 0x52f842
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00531a68
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5362fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x536318
mov edi, dword [esi + 0xc]
jmp 0x536358
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x536331
call fcn.0052d528
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x536346
call fcn.0052d528
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x536358
call fcn.0052d528
call fcn.0052caa8
cmp dword [eax + 0x3c], 0
je 0x53636d
push edi
mov ecx, ebx
call fcn.00535992
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0053654a
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x536396
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x5363a2
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5617a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x5617be
call fcn.0052caa8
mov esi, dword [eax + 0xc]
push 0x695f10
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x561814
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x561813
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x5617f4
xor esi, esi
jmp 0x56180a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0056181c
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5f15e3
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x67927b
call fcn.0064f302
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00435524
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x6821b4
call fcn.00453d3a
cmp eax, 0xffffffff
jne 0x5f16ae
push 0
push 0x681ef4
lea ecx, [ebp - 0x278]
call fcn.00453d3a
cmp eax, 0xffffffff
jne 0x5f16ae
push 0
push 0x688e98
lea ecx, [ebp - 0x278]
call fcn.00453d3a
cmp eax, 0xffffffff
jne 0x5f16ae
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00435524
mov edi, eax
pop ecx
mov dword [ebp - 0x27c], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x280], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x114]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x5f168b
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0064f291
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.0042c180
jmp 0x5f16e6
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.0042c24d
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0042c180
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x5f16d4
mov edi, dword [ebp - 0x274]
jmp 0x5f16e6
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0064f291
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0042c180
mov eax, edi
call fcn.0064f2ac
ret

Function at 0x6693ef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006690af
Function at 0x406887
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x406895
call 0x8566858
mov al, byte [0x8b640041]
cmp eax, 0x30
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x446630], eax
sub eax, eax
je 0x4068ba
call 0xa8d650c3
invalid
call 0x401154
call 0x40664a
pop edi
xor eax, eax
pop esi
ret

Function at 0x407505
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407544
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407544
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407544
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407544
cmp dword [ecx + 0x74], 0xe
jbe 0x407544
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d5db
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2c8
push 0x41c2c0
push str.FlsAlloc
push 0x1e
call fcn.0040d49c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d60f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
jmp 0x40d615
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d659
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2d8
push 0x41c2d0
push str.FlsGetValue
push 0x20
call fcn.0040d49c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d690
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x22914fa8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x22915112
cmp dword [ebp + 0xc], ebx
je 0x22915112
cmp dword [ebp + 0x10], ebx
je 0x22915112
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x22915112
or dword [eax], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
mov esi, 0x2291404c
push esi
push 0x80000002
call dword [entry0]
cmp eax, ebx
je 0x2291500c
push eax
push esi
call fcn.22914e7a
jmp 0x2291500e
mov al, 1
cmp al, bl
jne 0x2291501a
mov byte [ebp + 0x13], bl
jmp 0x22915131
push 0x200
call fcn.22916356
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x22915112
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x28]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x100
call esi
mov edi, 0x103
cmp eax, edi
mov dword [ebp - 0x14], 1
je 0x22915108
cmp eax, ebx
jne 0x2291513b
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
call fcn.229146df
test al, al
je 0x229150d9
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jle 0x229150d9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], eax
je 0x229150aa
push dword [ebp - 0x10]
call fcn.22916362
pop ecx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.22916356
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
je 0x22915112
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.229143cb
test eax, eax
jl 0x22915112
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x100
push dword [ebp - 0x14]
push dword [ebp - 8]
call esi
inc dword [ebp - 0x14]
cmp eax, edi
jne 0x22915069
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x2291514a
push 0x1d
push ebx
call fcn.229156f6
pop ecx
pop ecx
mov byte [ebp + 0x13], bl
cmp dword [ebp - 8], ebx
je 0x22915123
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x22915131
push dword [ebp - 4]
call fcn.22916362
pop ecx
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0x2291404c
push 0x13
push eax
call fcn.229157c4
jmp 0x22915112
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
push eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
push 0x17
lea eax, [ebp + 0x10]
push eax
push 0x22913f90
mov eax, esi
mov dword [edx], ecx
call fcn.22914eab
add esp, 0x10
test al, al
je 0x22915112
push dword [ebp + 8]
mov esi, dword [esi]
push 0x20019
push ebx
push esi
push 0x80000002
call dword [entry0]
cmp eax, ebx
je 0x2291519e
push eax
push esi
call fcn.22914e7a
mov byte [ebp + 0x13], al
jmp 0x22915115
mov byte [ebp + 0x13], 1
jmp 0x22915115
Function at 0x229151ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
je 0x229152da
mov eax, dword [ebp + 0x10]
call fcn.2291454c
test al, al
jne 0x229152da
cmp dword [ebp + 0x14], ebx
je 0x229152da
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x22915242
push eax
lea esi, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
call fcn.22914562
test eax, eax
jbe 0x229152fc
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push 0x16
push ebx
call fcn.229156f6
add esp, 0x14
cmp dword [ebp + 0xc], ebx
je 0x229152fc
push dword [ebp + 0xc]
call fcn.22916362
pop ecx
jmp 0x229152fc
cmp dword [ebp - 0x10], 1
je 0x22915253
push edi
push dword [ebp + 0x10]
push 0x18
jmp 0x229152f3
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x22915260
push edi
jmp 0x229152ee
shr eax, 1
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.22916356
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x229152fc
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
mov word [eax + edi*2], bx
push dword [ebp + 8]
call esi
cmp eax, ebx
je 0x229152df
push eax
lea esi, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.22914562
test eax, eax
jbe 0x229152cc
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x16
push ebx
call fcn.229156f6
add esp, 0x14
cmp dword [ebp + 8], ebx
je 0x229152cc
push dword [ebp + 8]
call fcn.22916362
pop ecx
push dword [ebp - 8]
call fcn.22916362
pop ecx
mov dword [ebp - 8], ebx
jmp 0x229152fc
mov byte [ebp - 1], bl
jmp 0x22915301
mov eax, dword [ebp - 8]
call fcn.2291454c
test al, al
je 0x229152ff
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0xe
push ebx
call fcn.229156f6
add esp, 0x10
mov byte [ebp - 1], bl
pop edi
pop esi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, byte [ebp - 1]
pop ebx
leave
ret 0x10
Function at 0x22916750
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x22916763
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x2291675f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x22916790
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x229167cf
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x229167c5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x229167d1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x229167b5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x2291704b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x2291901c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x2291969c], si
jne 0x229170e3
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x22911680
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [entry0]
test eax, eax
jne 0x229170e3
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x22911738
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x229170e3
push 3
push dword [esi*8 + 0x229114d0]
lea eax, [ebp - 0xc]
push eax
call fcn.22917de8
add esp, 0xc
test eax, eax
je 0x229170d5
inc esi
cmp esi, 0x1c
jb 0x229170b4
jmp 0x229170e3
mov ax, word [esi*8 + 0x229114d4]
mov word [0x2291969c], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x2291969c]
xor ecx, ebp
pop esi
call fcn.22916341
leave
ret
Function at 0x401090
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010cb
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4010e2
cmp dword [esp + 8], 0
je 0x4010e2
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0x20206
jmp 0x4010f0
push 0
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401130
mov ecx, dword [esp + 4]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.APPLICATION_COMPLETED
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x401140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
push str.IsWow64Process
push str.kernel32
mov edi, 0x20019
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401181
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40118d
cmp dword [esp + 8], 0
je 0x40118d
mov edi, 0x20219
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011e1
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x10
ret