joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8ed810
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x6da26d58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d8ed992
sub esp, 0x24
mov eax, dword [0x6da270bc]
test eax, eax
je 0x6d8ed93d
mov eax, dword [esp + 0x38]
cmp eax, 5
jg 0x6d8ed948
mov ecx, dword [0x6da26d58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x20], edx
mov ebx, dword [edx + 0x50]
test ebx, ebx
je 0x6d8ed896
cmp ecx, ebx
je 0x6d8ed896
mov ecx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov esi, dword [edx + 0x178]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.6d916cf0
mov eax, dword [esp + 0x14]
jmp 0x6d8ed8c0
mov ecx, dword [edx + 0x178]
mov ebx, dword [edx + 0x17c]
mov ebp, dword [edx + 0x180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.6d92a120
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx + 0x180]
cmp eax, edx
ja 0x6d8ed941
mov ecx, dword [ebx + 0x178]
mov ebp, dword [esp + 0x28]
mov dword [esp], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.6d8ee250
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x6da26d58]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x6d8ed939
movzx eax, byte [ebx + 0x69]
test al, al
je 0x6d8ed939
mov dword [ebx + 8], 0xfffffade
add esp, 0x24
ret
add esp, 0x24
ret
mov ecx, eax
call fcn.6d92c320
call fcn.6d8f6bb0
lea eax, [0x6d9791f6]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.6d8f7410
mov eax, dword [esp + 0x38]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.6d8f7230
call fcn.6d8f6c10
lea eax, [0x6d979c68]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.6d926a90
nop
call fcn.6d92ae50
jmp fcn.6d8ed810
Function at 0x6d91c8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6da26d58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d91cada
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x6d91ca8a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x6d91c99a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.6d919190
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x6d91ca1c
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.6d919190
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x6d91ca71
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.6d919190
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.6d8f6bb0
lea eax, [0x6d978fb4]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.6d8f7410
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.6d8f7100
call fcn.6d8f6db0
call fcn.6d8f6c10
lea eax, [0x6d97fe26]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.6d926a90
nop
call fcn.6d92ae50
jmp fcn.6d91c8d0
Function at 0x6d922cb0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6d922db0
mov eax, dword [0x6da26d58]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x9c]
lea ebx, [eax + 0x1d0]
mov dword [esp + 0x30], ebx
lea ebp, [eax + 0x318]
mov dword [esp + 0x2c], ebp
add ecx, 1
mov dword [eax + 0x98], ecx
adc edx, 0
mov dword [eax + 0x9c], edx
mov ecx, dword [eax + 0xa8]
mov dword [ecx], 0
call fcn.6d926d80
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.6d8f3ae0
mov eax, dword [esp + 0x28]
mov byte [eax + 0x8c], 1
inc dword [eax + 0xa0]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.6d92bee0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov byte [ecx + 0x8c], 0
dec dword [ecx + 0xa0]
nop
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.6d930980
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x30]
call fcn.6d92c954
call fcn.6d926f30
mov eax, dword [0x6da26d58]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x1d0]
lea esi, [esp + 0xc]
call fcn.6d92c954
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
lea eax, [0x6d978374]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.6d926a90
nop
int3
Function at 0x6d92c100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6da26f80]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x6d92a8ab
je 0x6d92a8fe
cmp ebx, 0x20
jbe 0x6d92a904
cmp ebx, 0x40
jbe 0x6d92a94a
jmp 0x6d92a9eb
test ebx, ebx
je 0x6d92a8f4
add eax, 0x10
test ax, 0xff0
je 0x6d92a8e0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d999d00]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d999e00]
jmp 0x6d92a8c8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x6d92a8c8
pxor xmm1, xmmword [0x6da26f90]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da26f90]
pxor xmm2, xmmword [0x6da26fa0]
pxor xmm3, xmmword [0x6da26fb0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da26f90]
pxor xmm2, xmmword [0x6da26fa0]
pxor xmm3, xmmword [0x6da26fb0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x6d92aa4a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x6da26c46], 0
je 0x6d92c11a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x6d92a870
jmp fcn.6d8c90f0
Function at 0x6d953cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x6da26d58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d953e44
sub esp, 0x7c
mov eax, 0
mov dword [esp + 0x78], eax
mov byte [esp + 0x4d], 0
lea eax, [0x6d9781dd]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.6d954360
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6d953d0e
jne 0x6d953e27
jmp 0x6d953e2a
mov eax, dword [esp + 8]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x4e], 0x45414c4b
mov dword [esp + 0x50], 0x364b4541
mov dword [esp + 0x54], 0x67564d31
lea ebx, [esp + 0x4e]
mov dword [esp], ebx
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.6d93a280
lea edi, [esp + 0x2d]
lea esi, [esp + 0xc]
call fcn.6d92c940
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
lea eax, [esp + 0x2d]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x20
call fcn.6d953f50
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], ebx
test eax, eax
jne 0x6d953e16
lea eax, [0x6d977cf5]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.6d953a80
mov eax, dword [esp + 8]
nop
lea ecx, [0x6d953ef0]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x78], ecx
mov byte [esp + 0x4d], 1
lea ecx, [esp + 0x64]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d953e50
mov byte [esp + 0x4d], 0
mov edx, dword [esp + 0x78]
mov eax, dword [edx]
call eax
add esp, 0x7c
ret
je 0x6d953e1b
mov eax, dword [eax + 4]
mov dword [esp], eax
mov dword [esp + 4], ebp
call fcn.6d926700
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6d926700
nop
call fcn.6d8f4630
add esp, 0x7c
ret
call fcn.6d92ae50
jmp fcn.6d953cc0
Function at 0x10050e5
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x1023148
call fcn.01003100
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1006ee9
push ebx
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1c]
push eax
call fcn.01004ae6
push esi
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x1006ee9
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.01005180
push esi
push dword [ebp - 0x10]
mov ecx, edi
call fcn.010024a5
mov edi, dword [edi + 4]
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006ee9
lea eax, [ebp - 0x1c]
push eax
call fcn.01003ffd
call fcn.01002052
ret 8
push dword [ebp + 8]
push 0x41
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100bc45
int3
Function at 0x10052b4
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x1023040
call fcn.01003100
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x1005358
cmp word [eax], bx
je 0x1005358
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10052d9
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x1006e0a
cmp byte [section..data], bl
jne 0x1006ead
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.01005365
cmp eax, ebx
jl 0x1006e86
mov eax, dword [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100532f
push ebx
lea ecx, [ebp - 0x14]
push ecx
sub eax, edx
push eax
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006e97
lea ecx, [ebp - 0x28]
call fcn.010043cc
xor eax, eax
call fcn.01002052
ret
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x10052fc
cmp edi, ebx
jbe 0x1005358
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0xc], eax
mov esi, 0x1000
mov eax, edi
sub eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x1006e3e
mov eax, esi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x1006e69
add dword [ebp - 0x10], esi
add dword [ebp + 0xc], 0x2000
cmp dword [ebp - 0x10], edi
jae 0x1005358
jmp 0x1006e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100535a
and eax, 0xffff
or eax, 0x80070000
jmp 0x100535a
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.010043cc
mov eax, esi
jmp 0x100535a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1006e86
and eax, 0xffff
or eax, 0x80070000
jmp 0x1006e86
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + edi]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1005358
jmp 0x1006e69

Function at 0x100bb8b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100bbbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
call fcn.0100bb75
leave
ret 4
Function at 0x10136b8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ecx + 8]
sub esp, 0x20
push esi
push dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x10136db
mov al, 1
pop esi
leave
ret 4
cmp esi, 2
jne 0x10136e4
xor al, al
jmp 0x10136d6
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1013719
test byte [eax + 0x1c], 1
je 0x1013719
cmp byte [eax + 0x19], 2
jb 0x1013719
push esi
push 0x186
push 0x1008650
push 0x1008504
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01012a74
push esi
lea ecx, [ebp - 0x20]
call fcn.01011e1d
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1020301
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1020480
cmp word [edi], 0
je 0x1020480
mov esi, dword [ebp + 0xc]
push 0
push 0x104
mov ecx, esi
call fcn.01001e91
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x102033c
xor eax, eax
jmp 0x1020343
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 1
push eax
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
test eax, eax
jne 0x10203ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1020363
mov esi, 0x507
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x102038e
test byte [eax + 0x1c], 1
je 0x102038e
cmp byte [eax + 0x19], 2
jb 0x102038e
push esi
push 0x1008878
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x2e
push 0x1008888
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
mov edx, dword [esi + 4]
test edx, edx
jne 0x10203b7
xor ecx, ecx
jmp 0x10203be
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 1
cmp eax, ecx
jbe 0x1020498
push 0
push eax
mov ecx, esi
call fcn.01001e91
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x10203db
xor eax, eax
jmp 0x10203e2
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 1
push eax
push ecx
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1020430
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10203fe
mov esi, 0x507
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020429
test byte [eax + 0x1c], 1
je 0x1020429
cmp byte [eax + 0x19], 2
jb 0x1020429
push esi
push 0x1008878
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x33
jmp 0x1020390
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x102043b
xor esi, esi
jmp 0x1020442
mov esi, dword [esi + 8]
sub esi, ecx
sar esi, 1
cmp eax, esi
jbe 0x1020498
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020472
test byte [eax + 0x1c], 1
je 0x1020472
cmp byte [eax + 0x19], 2
jb 0x1020472
push 0x7a
push 0x1008878
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x36
push 0x1008888
push 0x7a
jmp 0x1020396
mov ecx, dword [ebp + 0xc]
call fcn.0102013f
mov ecx, dword [ebp + 0xc]
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.0100b1cc
pop edi
pop esi
leave
ret 8
Function at 0x1020929
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1029008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x210]
push ecx
push 0x2001f
push 0
push eax
push ebx
mov dword [ebp - 0x214], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10209b0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x10209a0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.01020929
mov esi, eax
test esi, esi
je 0x1020968
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10209b8
cmp esi, 0x103
jne 0x10209cb
push 0
push 0
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01004e68
leave
ret 8

Function at 0x1020a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 2
jne 0x1020a37
xor al, al
jmp 0x1020ac3
test edi, edi
je 0x1020a84
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020a66
test byte [eax + 0x1c], 1
je 0x1020a66
cmp byte [eax + 0x19], 2
jb 0x1020a66
push edi
push 0x10088b4
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x1b
push 0x10088c4
push edi
lea ecx, [ebp - 0x24]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x24]
push eax
call sub.msvcrt.dll__CxxThrowException
cmp dword [ebp + 0x10], 4
je 0x1020ac1
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020ab6
test byte [eax + 0x1c], 1
je 0x1020ab6
cmp byte [eax + 0x19], 2
jb 0x1020ab6
push 0xd
push 0x10088b4
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x1e
push 0x10088c4
push 0xd
jmp 0x1020a6e
mov al, 1
pop edi
leave
ret 0xc
Function at 0x1020acd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x1020b04
xor al, al
jmp 0x1020b90
test esi, esi
je 0x1020b51
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020b33
test byte [eax + 0x1c], 1
je 0x1020b33
cmp byte [eax + 0x19], 2
jb 0x1020b33
push esi
push 0x10088b4
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x36
push 0x10088c4
push esi
lea ecx, [ebp - 0x24]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x24]
push eax
call sub.msvcrt.dll__CxxThrowException
cmp dword [ebp + 0x10], 0xb
je 0x1020b8e
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020b83
test byte [eax + 0x1c], 1
je 0x1020b83
cmp byte [eax + 0x19], 2
jb 0x1020b83
push 0xd
push 0x10088b4
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0x39
push 0x10088c4
push 0xd
jmp 0x1020b3b
mov al, 1
pop esi
leave
ret 0xc

Function at 0x1020b9a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1020c0b
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020bea
test byte [eax + 0x1c], 1
je 0x1020bea
cmp byte [eax + 0x19], 2
jb 0x1020bea
push esi
push 0x10088b4
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0xb2
push 0x10088c4
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
pop esi
leave
ret 0xc

Function at 0x1020c15
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x1020c86
mov eax, dword [0x1029004]
cmp eax, 0x1029004
je 0x1020c65
test byte [eax + 0x1c], 1
je 0x1020c65
cmp byte [eax + 0x19], 2
jb 0x1020c65
push esi
push 0x10088b4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008c25
push 0xc3
push 0x10088c4
push esi
lea ecx, [ebp - 0x20]
call fcn.01008c61
push 0x10263ec
lea eax, [ebp - 0x20]
push eax
call sub.msvcrt.dll__CxxThrowException
pop esi
leave
ret 0x10