joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100124d0
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x88
push edi
mov dword [ebp - 0x624], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x100126f8
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x429
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x620]
push eax
push 0x43a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x43b
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
je 0x10012589
cmp word [ebp - 0x620], 0
je 0x10012713
cmp word [ebp - 0x418], 0
je 0x10012713
push 0
push 0
push 0x147
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x150
push 0x42a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov cx, word [ebp - 0x210]
lea ebx, [eax + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
test cx, cx
jne 0x100126ce
push 0x420
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x34], 0
jne 0x100126be
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1001261a
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10012644
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x10012627
push ecx
jmp 0x1001262f
mov eax, dword [eax + 0x10]
test eax, eax
je 0x10012644
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
cmp word [ebp - 0x210], 0
je 0x100126be
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012657
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x34]
test edx, edx
je 0x10012713
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10012694
sub esi, ecx
lea eax, [ebp - 0x210]
sar esi, 1
push eax
lea eax, [esi + 1]
push eax
push edx
call dword [sym.imp.msvcrt.dll_wcscpy_s]
mov esi, dword [ebp - 0x624]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.100114f0
mov cx, word [ebp - 0x210]
mov ax, word [ebp - 0x418]
cmp ebx, 1
jl 0x100126ee
test cx, cx
je 0x10012713
cmp word [ebp - 0x620], 0
je 0x10012713
test ax, ax
je 0x10012713
test cx, cx
jne 0x1001270e
test ax, ax
jne 0x10012713
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x100126f8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
Function at 0x10012730
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, ecx
push edi
mov dword [ebp - 0x214], eax
xor edi, edi
jmp 0x1001275c
mov eax, dword [ebp - 0x214]
cmp di, 0x1d
jb 0x10012766
xor esi, esi
jmp 0x10012772
movzx esi, di
shl esi, 5
add esi, section..data
inc edi
test esi, esi
je 0x10012817
test dword [esi + 8], 0x1000
je 0x1001275c
cmp dword [esi + 4], 0x3ef
jne 0x10012793
test byte [eax + 0x16], 2
jne 0x1001275c
cmp dword [esi + 0x14], 0x403
jne 0x100127c6
push 0x420
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x100127c6
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
mov eax, dword [ebp - 0x214]
jne 0x1001275c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10012756
push eax
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x10012756
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
jne 0x1001275c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
mov edx, eax
mov ecx, ebx
call fcn.100124d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
Function at 0x100158f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x411
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40f
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
mov edi, eax
push 0x188
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xb8
push ebx
mov dword [ebp - 0x670], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x10015a0c
push 0x104
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x412
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x18f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10002384
lea eax, [ebp - 0x66c]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
push 0
push esi
push 0x182
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x66c]
push eax
push 0
push 0x180
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x19a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp - 0x670]
push 0x186
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
Function at 0x10023490
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.10023240
test ax, ax
je 0x100234b1
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x100039f0
push 0
push 0x100039e0
push dword [esi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100234f2
push 1
mov edx, 0x100039e0
mov ecx, esi
call fcn.10022b80
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0x100039f0
push 0
push 0x10002b78
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10023539
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov edx, 0x10002b78
mov ecx, esi
call fcn.10022b80
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 6
push 0x10001e48
push 1
push 0
push 0x10001cac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002355d
mov edx, 0x10001cac
jmp 0x1002357f
push 6
push 0x10001e48
push 1
push 0
push 0x10001e28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002358b
mov edx, 0x10001e28
push 1
mov ecx, esi
call fcn.10022b80
movzx edi, ax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100235b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
movzx esi, word [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
cmp dword [edi + 0x108], 0
jne 0x100235e9
call fcn.10024030
test ax, ax
je 0x100235e6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 8]
cmp dword [ebp + 0x14], 0
mov ebx, dword [ebp + 0xc]
je 0x100235fe
mov eax, dword [edi + 0x110]
test eax, eax
je 0x1002361b
jmp 0x10023604
mov eax, dword [edi + 0x108]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002363b
lea eax, [esi - 1]
push eax
push dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
mov eax, 0x64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, edx
shr ecx, 1
shr eax, 1
cmp eax, ecx
jbe 0x1002364c
mov eax, ecx
test eax, eax
jne 0x10023655
mov eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
test edx, edx
jne 0x10023672
lea eax, [esi - 1]
push eax
push dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10023680
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
cmp dword [edi + 0x10c], 0
jne 0x100236b6
call fcn.10023240
test ax, ax
jne 0x100237aa
test esi, esi
je 0x100236d8
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100236c0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x100236e2
mov ecx, 2
mov esi, 0x10001ba0
cmp dword [ebp + 0xc], 0
je 0x100236f0
mov eax, dword [edi + 0x110]
jmp 0x100236f6
mov eax, dword [edi + 0x10c]
push ecx
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100237c0
xor eax, eax
push 0x104
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0xb3b0
push dword [0x10043578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x210], 0
jne 0x10023764
mov esi, dword [0x1004338c]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x418]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8
Function at 0x100237e0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x10c], 0
jne 0x10023813
call fcn.10023240
test ax, ax
jne 0x100238df
cmp dword [ebp + 0xc], 0
je 0x10023821
mov eax, dword [edi + 0x110]
jmp 0x10023827
mov eax, dword [edi + 0x10c]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100238f5
xor eax, eax
push 0x104
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0xb3b0
push dword [0x10043578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x210], 0
jne 0x10023899
mov esi, dword [0x1004338c]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x418]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8

Function at 0x10023910
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 4
push edi
mov ebx, edx
cmp dword [esi + 0x108], 0
jne 0x10023945
call fcn.10024030
test ax, ax
je 0x10023945
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 0xc]
je 0x1002395a
mov eax, dword [esi + 0x110]
test eax, eax
je 0x10023977
jmp 0x10023960
mov eax, dword [esi + 0x108]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 8]
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002398a
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, 0x64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 4], 0
jne 0x10023995
mov eax, dword [ebp + 8]
mov dword [edi], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10024450
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x10c], 0
jne 0x10024483
call fcn.10023240
test ax, ax
jne 0x1002455d
cmp dword [ebp + 8], 0
seta byte [ebp - 0x419]
cmp dword [ebp + 0xc], 0
je 0x1002449c
mov eax, dword [edi + 0x110]
jmp 0x100244a2
mov eax, dword [edi + 0x10c]
push 1
lea ecx, [ebp - 0x419]
push ecx
push 3
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10024573
xor eax, eax
push 0x104
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0xb3b0
push dword [0x10043578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x210], 0
jne 0x10024517
mov esi, dword [0x1004338c]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x418]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 8

Function at 0x10024590
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], 2
push edi
mov edi, edx
cmp dword [esi + 0x108], 0
jne 0x100245c3
call fcn.10024030
test ax, ax
je 0x100245c3
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x110]
je 0x100245d5
test eax, eax
je 0x100245f5
jmp 0x100245db
mov eax, dword [esi + 0x108]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002460b
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, 0x64
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 8], 0
je 0x1002462b
cmp byte [ebp - 4], 0
je 0x1002462b
mov eax, dword [ebp + 8]
mov ecx, 1
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10024750
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x974], 4
mov dword [ebp - 0x970], 4
mov dword [ebp - 0x968], 0
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x100247a1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x10c], 0
mov eax, dword [esi + 0x108]
test eax, eax
je 0x100247bc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x108], 0
mov eax, dword [esi + 0x110]
test eax, eax
je 0x100247d7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x110], 0
test dword [esi + 0x5c], 0x8000
je 0x1002499a
movzx ecx, byte [esi + 0xa9]
mov eax, dword [esi + 0xac]
push dword [eax + ecx*4 + 0x4c]
push esi
push dword [esi + 0x118]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10003730
lea eax, [ebp - 0x70c]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
lea eax, [ebp - 0x70c]
push eax
push 0x100036ec
lea eax, [ebp - 0x4b4]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
push 0x100039e0
lea eax, [ebp - 0x4b4]
push eax
push 0x100021b4
lea eax, [ebp - 0x25c]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
mov eax, dword [esi + 0xac]
add esp, 0x40
movzx ecx, byte [esi + 0xa9]
push dword [eax + ecx*4 + 0x4c]
lea eax, [ebp - 0x25c]
push eax
push 0x100021b4
lea eax, [ebp - 0x964]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
lea eax, [ebp - 0x964]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x25c]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x4b4]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and dword [esi + 0x5c], 0xffff7fff
lea eax, [ebp - 0x96c]
push eax
push 0x2001f
push 0
push 0x100037c0
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x1002490e
lea eax, [ebp - 0x96c]
push eax
push 0x2001f
push 0
push 0x100037c0
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002499a
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x974]
push eax
push 0
push 0x10003820
push dword [ebp - 0x96c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10024975
mov eax, dword [ebp - 0x968]
test eax, eax
je 0x10024953
dec eax
mov dword [ebp - 0x968], eax
push dword [ebp - 0x970]
lea eax, [ebp - 0x968]
push eax
push 4
push 0
push 0x10003820
push dword [ebp - 0x96c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x96c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x968], 0
jne 0x1002499a
push 0x100037c0
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
Function at 0x1003b244
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x110]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10004838
push Ordinal_3
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003b327
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10c], 1
push eax
lea eax, [ebp - 0x108]
mov edi, 0x104
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], edi
push eax
push ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003b316
cmp dword [ebp - 0x10c], 2
mov byte [ebp - 5], bl
jne 0x1003b2e7
push edi
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb ebx, ebx
inc ebx
jmp 0x1003b316
lea ecx, [ebp - 0x108]
sub ecx, esi
lea eax, [edi + 0x7ffffefa]
test eax, eax
je 0x1003b308
mov al, byte [ecx + esi]
test al, al
je 0x1003b308
mov byte [esi], al
inc esi
sub edi, 1
jne 0x1003b2ef
test edi, edi
jne 0x1003b30d
dec esi
mov byte [esi], bl
xor ebx, ebx
test edi, edi
setne bl
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
jmp 0x1003b329
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
leave
ret

Function at 0x1003b5d0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
push edi
test ebx, ebx
je 0x1003b64a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, 1
je 0x1003b64a
lea esi, [edi + edi]
lea ecx, [esi + 1]
push 1
push ecx
call dword [sym.imp.msvcrt.dll_calloc]
mov ecx, dword [ebp - 4]
add esp, 8
mov dword [ecx], eax
test eax, eax
jne 0x1003b622
push 0x10004b40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
push esi
push eax
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, esi
jg 0x1003b63c
test esi, esi
jns 0x1003b64a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003bf50
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1003bf8e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1003bf86
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1003bf90
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1003bf76
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1003c060
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1003c091
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1003c091
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1003c091
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10052321
Capabilities:
Encode data using xor

Disassembly:
call 0x1005229a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100522ca
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100522e6
xor edx, 0
jmp 0x100522f1
xor edx, edx
jmp 0x10052308
jmp 0x10052314
xor eax, eax
push 0x8427d7c0
call 0x10052321
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1005235d
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x10052336
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x10052374
add eax, 0
jno 0x10052379
add esi, 0
ret 0x10