joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10241e61
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x102697c8], 0x117a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
lea eax, [0x102446b1]
mov ecx, 0xe
lea edx, [ebp - 0x24]
mov dword [0x102697cc], 0x2413
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
call fcn.1024237c
mov dword [0x102697cc], 0x182b
mov dword [0x102697c8], 0xee1
call fcn.102426e3
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.10241208
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x10241fa8
mov eax, dword [ebp - 0x38]
mov dword [0x102697cc], 0x686
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102697cc], 0x1c5a
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10241388
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x3c], 0xd0
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov dword [0x102697cc], 0x145
mov esi, dword [ebp - 0x2c]
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0x40]
mov dword [esi + 0x30], edx
mov dword [0x102697c8], 0x640
cmp edx, 0
mov dword [ebp - 0x3c], eax
je 0x10241fa8
mov dword [0x102697c8], 0x13f8
mov eax, dword [ebp - 0x40]
add eax, 0x1be5
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
jmp 0x10241fa8
mov eax, dword [ebp - 0x3c]
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x10242120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x102697c8]
add ebx, 0x510
mov dword [0x102697cc], ebx
mov dword [0x102697d0], 0
mov dword [0x102697d4], 0
mov dword [0x102697e0], 0
mov dword [0x102697c8], 0x16c5
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x102422cb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102697cc], 0x47c
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102697d0], edx
mov dword [0x102697c8], 0xd85
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102697d4], edx
mov dword [0x102697c8], 0x237c
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102697d8], cl
mov dword [0x102697cc], 0x46d
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x102697cc], 0x7f8
mov cl, byte [0x102697d8]
mov edx, dword [0x102697d4]
mov byte [edi + edx], cl
mov dword [0x102697c8], 0x14d6
mov edx, dword [0x102697d0]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102697d4]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x102697cc], 0x16e2
and ebx, 0xff
mov dword [0x102697e0], ebx
mov dword [0x102697c8], 0xaf
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x102697e5], ch
mov byte [0x102697e6], cl
xor ch, cl
mov byte [0x102697e4], ch
mov dword [0x102697c8], 0xa4e
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x102422cb
mov eax, dword [0x102697d0]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x102697d4]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x10242195
mov dword [0x102697c8], 0xb72
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10242440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x102697c8]
add eax, 0xffffddc7
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [0x102697c8], eax
call fcn.1000107a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x28], ecx
je 0x102424f1
jmp 0x102425f1
mov eax, dword [esp + 0x24]
mov dword [esp + 0x80], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x58], edx
mov dword [0x102697c8], 0xebf
call fcn.10241ca8
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
je 0x102425ab
jmp 0x102424e4
mov eax, dword [esp + 0x24]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x102697cc], 0x773
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x24], eax
je 0x1024258e
jmp 0x102424b3
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
jmp 0x102425f1
lea eax, [esp + 0x30]
mov ecx, dword [0x102697cc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x88]
mov ecx, dword [esp + 0x10]
add ecx, 0xffffd0b8
mov dword [0x102697c8], ecx
mov dword [esp], eax
call fcn.10241659
lea ecx, [0x10241c4f]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x40], 0x126600
mov dword [0x102697cc], 0x1eb7
mov edx, dword [0x102697b4]
mov dword [esp + 0x74], edx
mov edx, dword [0x102697b8]
mov dword [esp + 0x7c], edx
mov edx, dword [0x102697bc]
mov dword [esp + 0x30], edx
mov edx, dword [0x102697c0]
mov dword [esp + 0x3c], edx
mov edx, dword [0x102697c4]
mov dword [esp + 0x64], edx
mov dword [0x102697c8], 0x19e4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
jmp 0x102424cf
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x20], ecx
je 0x1024247a
jmp 0x102424b3
lea eax, [esp + 0x30]
mov dword [0x102697c8], 0x1b81
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10241e61
mov dword [0x102697cc], 0xecc
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x1c], eax
jmp 0x102424e4
mov eax, dword [esp + 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x1016635
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x102dfa0
call fcn.01016f84
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1033220
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101644a
cmp eax, esi
jne 0x101643d
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x101644d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1016424
xor esi, esi
inc esi
mov eax, dword [0x103321c]
cmp eax, esi
jne 0x1016460
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101649b
mov eax, dword [0x103321c]
test eax, eax
jne 0x1016495
mov dword [0x103321c], esi
push 0x1001380
push 0x1001374
call fcn.010163a1
pop ecx
pop ecx
test eax, eax
je 0x101649b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1016565
mov dword [0x1032ae4], esi
mov eax, dword [0x103321c]
cmp eax, esi
jne 0x10164bf
push 0x1001370
push 0x100135c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x103321c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10164cc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1033230], ebx
je 0x10164ed
push 0x1033230
call fcn.01016ef9
pop ecx
test eax, eax
je 0x10164ed
push ebx
push 2
push ebx
call dword [0x1033230]
push dword [0x1032acc]
push dword [0x1032ad0]
push dword [0x1032ac8]
call fcn.01015f45
add esp, 0xc
mov dword [0x1032ae0], eax
cmp dword [0x1032ad4], ebx
jne 0x101654b
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1032ae4], ebx
jne 0x1016559
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1032ae0]
call fcn.01016fc9
ret
call fcn.010170c9
jmp 0x1016402

Function at 0x1018d57
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push esi
push 0x1018bf8
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, edi
je 0x1018d82
mov dword [esi + 0xc], 1
jmp 0x1018da6
mov edi, 0x4106
push edi
call fcn.0102728b
test eax, eax
je 0x1018da6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b90
push edi
call fcn.01027339
add esp, 0xc
mov eax, dword [esi + 0xc]
pop edi
pop esi
ret
Function at 0x1019b75
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 3
mov dword [ebp - 0x808], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1019bcf
mov esi, 0x4102
push esi
call fcn.0102728b
test eax, eax
je 0x1019c20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002b50
jmp 0x1019c00
mov eax, dword [ebp - 0x808]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x808], eax
cmp eax, 0x800
jbe 0x1019c0b
mov esi, 0x4102
push esi
call fcn.0102728b
test eax, eax
je 0x1019c20
push dword [ebp - 0x808]
push 0x1002aa0
push esi
call fcn.01027339
add esp, 0xc
jmp 0x1019c20
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push 0x100282c
push esi
call fcn.0101cb2b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01016715
leave
ret 4
Function at 0x101c59d
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x194]
push eax
push 0x202
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
mov dword [ebp - 0x198], eax
cmp eax, esi
je 0x101c5fd
mov esi, 0x4102
push esi
call fcn.0102728b
test eax, eax
je 0x101c66f
push dword [ebp - 0x198]
push 0x10042b0
push esi
call fcn.01027339
add esp, 0xc
jmp 0x101c66f
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
cmp eax, esi
jne 0x101c61c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
jmp 0x101c66f
push ebx
push 0x1004290
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x101c63c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
jmp 0x101c66e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004270
push ebx
call esi
push 0x1004258
push ebx
mov dword [edi + 0x34], eax
call esi
push 0x1004240
push ebx
mov dword [edi + 0x38], eax
call esi
push 0x1004228
push ebx
mov dword [edi + 0x3c], eax
call esi
mov dword [edi + 0x40], eax
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x198], eax
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.01016715
leave
ret

Function at 0x101c8d5
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
je 0x101c909
test eax, eax
je 0x101c906
push eax
push 0x3dd
push 0x1002bfc
push 0x10044d8
call fcn.01028181
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x101d228
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push esi
push 0x101d210
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
cmp eax, edi
jne 0x101d270
mov ebx, 0x4100
push ebx
call fcn.0102728b
test eax, eax
je 0x101d28c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1004d10
push ebx
call fcn.01027339
add esp, 0xc
jmp 0x101d28c
mov ebx, 0xc100
push ebx
call fcn.0102728b
test eax, eax
je 0x101d28c
push 0x1004c98
push ebx
call fcn.01027339
pop ecx
pop ecx
xor eax, eax
cmp dword [esi], edi
pop edi
pop esi
setne al
pop ebx
ret
Function at 0x101e4fa
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x128], 0
and dword [ebp - 0x124], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne bl
mov edi, 0x4104
test bl, bl
je 0x101e587
cmp dword [ebp - 0x11c], 6
jb 0x101e55d
mov dword [ebp - 0x124], 0x10061c8
jmp 0x101e5a6
cmp dword [ebp - 0x11c], 5
jne 0x101e57b
cmp dword [ebp - 0x118], 1
jb 0x101e57b
mov dword [ebp - 0x124], 0x1006178
jmp 0x101e5a6
mov dword [ebp - 0x124], 0x100613c
jmp 0x101e5a6
push edi
call fcn.0102728b
test eax, eax
je 0x101e604
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10060b0
push edi
call fcn.01027339
add esp, 0xc
test bl, bl
je 0x101e604
push 0
lea eax, [ebp - 0x128]
push eax
push 1
push dword [ebp - 0x124]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne bl
test bl, bl
jne 0x101e5ea
push edi
call fcn.0102728b
test eax, eax
je 0x101e604
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006008
push edi
call fcn.01027339
add esp, 0xc
jmp 0x101e604
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x128]
and dword [esi + 8], 0
mov dword [esi + 4], eax
mov dword [esi], 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.01016715
leave
ret 4
Function at 0x101e641
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp byte [ebp + 8], bl
je 0x101e6da
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov edi, eax
cmp edi, ebx
je 0x101e691
mov esi, 0x4104
push esi
call fcn.0102728b
test eax, eax
je 0x101e7a1
push edi
push 0x10065e0
jmp 0x101e756
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov edi, eax
cmp edi, ebx
je 0x101e6c3
mov esi, 0x4104
push esi
call fcn.0102728b
test eax, eax
je 0x101e7a1
push edi
push 0x1006560
jmp 0x101e756
push dword [ebp - 0x18]
push 0x25
push 0x1033060
call fcn.01016953
add esp, 0xc
jmp 0x101e77e
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
je 0x101e715
mov esi, 0x8104
push esi
call fcn.0102728b
test eax, eax
je 0x101e7a1
push edi
push 0x1006418
jmp 0x101e756
lea eax, [ebp - 0x20]
push eax
push 0x1033060
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1006404
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x4a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
je 0x101e761
mov esi, 0x8104
push esi
call fcn.0102728b
test eax, eax
je 0x101e7a1
push edi
push 0x1006360
push esi
call fcn.01027339
add esp, 0xc
jmp 0x101e7a1
cmp dword [ebp - 0x20], 0x48
jb 0x101e782
cmp dword [ebp - 0x24], 1
jne 0x101e782
cmp word [0x10330a8], bx
je 0x101e77e
xor eax, eax
mov word [0x10330a8], ax
xor edi, edi
jmp 0x101e7a1
push 0xd
pop edi
mov esi, 0x8104
push esi
call fcn.0102728b
test eax, eax
je 0x101e7a1
push 0x10062b0
push esi
call fcn.01027339
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x101e7af
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
je 0x101e7be
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp edi, ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.01016715
leave
ret 4
Function at 0x101e7db
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0101e4fa
test al, al
jne 0x101e808
push 0xe
pop esi
jmp 0x101e89d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 1
push ebx
push ebx
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x101e84a
mov edi, 0x8104
push edi
call fcn.0102728b
test eax, eax
je 0x101e89d
push esi
push 0x1006708
jmp 0x101e894
mov ecx, 0x1033060
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x101e854
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x1006404
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x101e89d
mov edi, 0x4104
push edi
call fcn.0102728b
test eax, eax
je 0x101e89d
push esi
push 0x1006660
push edi
call fcn.01027339
add esp, 0xc
cmp dword [ebp - 4], ebx
je 0x101e8ab
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
call fcn.0101e61c
xor eax, eax
cmp esi, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x101e8c5
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x101e949
push esi
push edi
lea eax, [ebp + 8]
push eax
push 2
push 0
push 0x10064b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x101e929
push 0x1006404
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 0xc104
push esi
mov edi, eax
call fcn.0102728b
test eax, eax
je 0x101e91e
push edi
push 0x1006820
push esi
call fcn.01027339
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101e947
mov esi, 0xc104
push esi
call fcn.0102728b
test eax, eax
je 0x101e947
push edi
push 0x10067a8
push esi
call fcn.01027339
add esp, 0xc
pop edi
pop esi
xor eax, eax
mov word [0x1033060], ax
pop ebp
ret 4
Function at 0x1023175
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0xc105
push esi
call fcn.0102728b
test eax, eax
je 0x10231b0
push 0x100b8c8
push esi
call fcn.01027339
pop ecx
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push 4
push edi
push edi
push edi
push 0x100ae00
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x10231f9
push esi
call fcn.0102728b
test eax, eax
je 0x10232c7
push 0x100ae00
push 0x100b7d8
push esi
call fcn.01027339
add esp, 0xc
jmp 0x10232c7
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100ae44
push dword [ebp - 0x18]
call ebx
test eax, eax
je 0x102323d
push esi
call fcn.0102728b
test eax, eax
je 0x102322f
push 0x100ae80
push 0x100b7d8
push esi
call fcn.01027339
add esp, 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10232c7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x1023268
push esi
call fcn.0102728b
test eax, eax
je 0x10232b7
push 0x100b720
push esi
call fcn.01027339
pop ecx
pop ecx
jmp 0x10232b7
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x1c]
push 1
push edi
mov edi, 0x100ae60
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10232ad
push esi
call fcn.0102728b
test eax, eax
je 0x10232ad
push edi
push 0x100ae80
push 0x100b688
push esi
call fcn.01027339
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01016715
leave
ret 0x10
Function at 0x10232dd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xc105
push ebx
mov dword [ebp - 0x218], edi
call fcn.0102728b
test eax, eax
je 0x102331a
push 0x100bc00
push ebx
call fcn.01027339
pop ecx
pop ecx
mov esi, 0x10100a0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x210]
push eax
movsd dword es:[edi], dword [esi]
push 1
xor edi, edi
push edi
mov esi, 0x100ae80
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1023366
push ebx
call fcn.0102728b
test eax, eax
je 0x10233f8
push esi
push 0x100bb10
push ebx
call fcn.01027339
add esp, 0xc
jmp 0x10233f8
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
mov edi, 0x100ae60
push edi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10233be
push ebx
call fcn.0102728b
test eax, eax
je 0x10233b0
push edi
push esi
push 0x100ba00
push ebx
call fcn.01027339
add esp, 0x10
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10233f8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x10233f8
push ebx
call fcn.0102728b
test eax, eax
je 0x10233f8
push 0x100b928
push ebx
call fcn.01027339
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01016715
leave
ret 4

Function at 0x102340e
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0xc105
push esi
call fcn.0102728b
test eax, eax
je 0x1023432
push 0x100bdd8
push esi
call fcn.01027339
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
mov edi, 0x100ae80
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x102346a
push esi
call fcn.0102728b
test eax, eax
je 0x10234a2
push edi
push 0x100bcf8
push esi
call fcn.01027339
add esp, 0xc
jmp 0x10234a2
push ebx
mov ebx, 0x100ae60
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1023498
push esi
call fcn.0102728b
test eax, eax
je 0x1023498
push ebx
push edi
push 0x100bc68
push esi
call fcn.01027339
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
leave
ret