joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 3
mov byte [ebp - 0x26], 0x8a
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 3
mov byte [ebp - 0x23], 0xff
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 5
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0xc
mov byte [ebp - 0x1d], 0x29
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x1c
mov byte [ebp - 0x1a], 0x42
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x56
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0xf2
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 8], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x100a4b0b
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x100a4b0b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x100a4b0b
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x100a4b0b
mov al, 1
jmp 0x100a4bea
mov dword [ebp - 0x2c], 0
jmp 0x100a4b1d
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x28]
cmp ecx, 0xff
je 0x100a4b77
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x28]
cmp eax, edx
jne 0x100a4b75
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x2c]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x27]
cmp ecx, eax
jne 0x100a4b75
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x26]
cmp edx, ecx
jne 0x100a4b75
mov al, 1
jmp 0x100a4bea
jmp 0x100a4b14
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
test eax, eax
jne 0x100a4b94
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 1]
cmp edx, 0xfc
jne 0x100a4b94
mov al, 1
jmp 0x100a4bea
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
test ecx, ecx
jne 0x100a4bcd
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 4]
cmp eax, 0x30
jne 0x100a4bcd
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
test edx, edx
jne 0x100a4bcd
call fcn.100e1f50
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x100a4bcd
mov al, 1
jmp 0x100a4bea
push 6
push 0x101a264c
mov edx, dword [ebp + 8]
push edx
call fcn.1014cc41
add esp, 0xc
test eax, eax
jne 0x100a4be8
mov al, 1
jmp 0x100a4bea
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100a5090
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x28], eax
movzx eax, byte [0x101de799]
test eax, eax
jne 0x100a515c
mov dword [ebp - 0xc0], 0x94
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xb0], 2
jne 0x100a50d9
mov byte [0x101de1f8], 1
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x10], 1
jbe 0x100a5155
mov dword [ebp - 0xcc], 1
mov eax, 1
mov ecx, dword [ebp - 0x10]
shl eax, cl
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0xcc]
cmp ecx, dword [ebp - 0xc4]
je 0x100a5145
mov edx, dword [ebp - 0x14]
and edx, dword [ebp - 0xcc]
je 0x100a5135
mov eax, dword [ebp - 0xc8]
add eax, 1
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xcc]
shl ecx, 1
mov dword [ebp - 0xcc], ecx
jmp 0x100a510d
cmp dword [ebp - 0xc8], 1
jbe 0x100a5155
mov byte [0x101de1fa], 1
mov byte [0x101de799], 1
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100a8970
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100a8820
push 0x101de848
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x101de818]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100a89bb
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x100a89b0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
jmp 0x100a898c
mov byte [0x101de7ee], 1
push 0x101de848
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100a8850
mov esp, ebp
pop ebp
ret

Function at 0x100a92a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax*4 + 0x674], 0
je 0x100a9309
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4 + 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
je 0x100a9309
push 0
push 0x101a1864
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 4], 0
jmp 0x100a92f0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 6
jge 0x100a9309
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x674], 0
jmp 0x100a92e7
mov esp, ebp
pop ebp
ret 4
Function at 0x100acbf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x100acc40
call dword [0x101e6f5c]
add esp, 8
lea eax, [ebp - 0x10]
push eax
push 0x100accc0
call dword [0x101e6f5c]
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4

Function at 0x100acc70
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100a8820
mov eax, dword [0x101de818]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100accac
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], eax
je 0x100acca1
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 4], edx
jmp 0x100acc81
call fcn.100a8850
mov esp, ebp
pop ebp
ret
Function at 0x100b2d70
Capabilities:
Create thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x101e219c], eax
mov eax, dword [ebp + 8]
mov dword [0x101e21a8], eax
call fcn.100b2ec0
mov ecx, 0x12
shl ecx, 2
mov edx, dword [0x101db5fc]
mov eax, dword [0x101db5fc]
mov esi, dword [0x101db5fc]
mov ebx, dword [esi + 0x6c]
xor ebx, dword [eax + 0x64]
xor ebx, dword [edx + ecx]
and ebx, 0x80
neg ebx
sbb ebx, ebx
neg ebx
movzx ecx, bl
test ecx, ecx
je 0x100b2e3a
mov edx, 0x12
shl edx, 2
mov eax, dword [0x101db5fc]
mov ecx, dword [0x101db5fc]
mov esi, dword [0x101db5fc]
mov ebx, dword [esi + 0x6c]
xor ebx, dword [ecx + 0x64]
xor ebx, dword [eax + edx]
and ebx, 0x2000
neg ebx
sbb ebx, ebx
neg ebx
movzx edx, bl
test edx, edx
je 0x100b2e05
jmp 0x100b2e9d
push 0
push str.ArmServerInfo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x100b3480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100b2e9d
mov ecx, 0x12
shl ecx, 2
mov edx, dword [0x101db5fc]
mov eax, dword [0x101db5fc]
mov esi, dword [0x101db5fc]
mov ebx, dword [esi + 0x6c]
xor ebx, dword [eax + 0x64]
xor ebx, dword [edx + ecx]
and ebx, 0x2000
neg ebx
sbb ebx, ebx
neg ebx
movzx ecx, bl
test ecx, ecx
je 0x100b2e7f
call fcn.100e1f50
test eax, eax
jne 0x100b2e7f
call fcn.100a8970
jmp 0x100b2e9d
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x100b4090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b36b0
Capabilities:
Create mailslot
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push str._08X
lea ecx, [ebp - 0x108]
push ecx
call fcn.1014ea28
add esp, 0xc
push 0
lea edx, [ebp - 0x108]
push edx
push str.ArmServerInfo
mov ecx, 0x101dd548
call fcn.1006a3a0
lea eax, [ebp - 0x108]
push eax
push str.ArmServerInfo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str..mailslot_server_
lea ecx, [ebp - 0x208]
push ecx
call fcn.1014e930
add esp, 8
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.1014e940
add esp, 8
push 0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x101e2198], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100b4f30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x101a3488]
mov word [ebp - 0x114], ax
mov cl, byte [0x101a348a]
mov byte [ebp - 0x112], cl
mov dl, byte [0x101a0fc1]
mov byte [ebp - 0x110], dl
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.1014e270
add esp, 0xc
mov cl, byte [ebp + 8]
mov byte [ebp - 0x114], cl
push 0x104
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x100b4fa8
xor al, al
jmp 0x100b4fc2
push str.Floppy
lea ecx, [ebp - 0x110]
push ecx
call fcn.10150260
add esp, 8
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret

Function at 0x100b4fd0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d1f1
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0
push 0
push 3
push 0
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x100b5070
mov dword [ebp - 0x2c], 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0xc
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push 0x2d1080
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100b5066
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x18]
call fcn.100b6de0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.100b6be0
mov ecx, dword [ebp - 0x30]
or ecx, 1
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 3
mov byte [ebp - 4], 0
movzx edx, byte [ebp - 0x18]
test edx, edx
je 0x100b509c
mov byte [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100bb390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018eb08
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.100bb270
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100bb4ab
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100c2030
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x100bb425
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x100bb42e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x101a3874
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.101506ea
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10042350
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100bb4ab
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.101509e1
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10150353
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100bb4d3
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bb4f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018eb68
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.100bb270
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100bb618
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100c2030
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x14], 0x10
jb 0x100bb585
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x100bb58e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], eax
push 0x101a34a4
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.101506ea
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10042350
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100bb618
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10150611
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10150353
add esp, 4
mov byte [ebp - 0x51], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x51]
jmp 0x100bb640
mov byte [ebp - 0x52], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x52]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bc790
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x23c], ecx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.100bc510
push eax
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp - 0x23c]
add edx, 0xed0
push edx
push 0x80000000
call fcn.100bc630
add esp, 0x24
test eax, eax
jne 0x100bc968
cmp dword [ebp - 4], 1
je 0x100bc801
mov eax, dword [ebp - 8]
push eax
call fcn.100bcbf0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x100bc95e
push str.Version
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x101a3998
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
call fcn.1015020e
add esp, 4
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0xc]
push edx
call fcn.100bc6e0
or eax, 0x20019
push eax
push 0
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bc95e
mov al, byte [0x101a0fc1]
mov byte [ebp - 0x218], al
push 0x1ff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.1014e270
add esp, 0xc
mov dword [ebp - 0x21c], 0
jmp 0x100bc89d
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0x1e
jge 0x100bc8f4
push 0x200
lea ecx, [ebp - 0x10]
call fcn.10069850
mov dword [ebp - 0x220], eax
push 0x200
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100bc8de
jmp 0x100bc8f4
push 0x101a0fc1
lea eax, [ebp - 0x218]
push eax
call fcn.1014e930
add esp, 8
jmp 0x100bc88e
lea ecx, [ebp - 0x218]
push ecx
call fcn.1014e8a0
add esp, 4
test eax, eax
je 0x100bc954
lea edx, [ebp - 0x224]
push edx
call fcn.100bc6e0
or eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bc954
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.100bc980
add esp, 0x10
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100bcbf0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
mov al, byte [0x101a0fc1]
mov byte [ebp - 0x210], al
push 0x1ff
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.1014e270
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x214], 0
jmp 0x100bcc4a
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
push 0x200
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100bcc92
push str.Version
lea eax, [ebp - 0x210]
push eax
call fcn.1015d9f0
add esp, 8
test eax, eax
jne 0x100bcc87
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x100bcc94
jmp 0x100bcc96
jmp 0x100bcc3b
movzx edx, byte [ebp - 5]
test edx, edx
je 0x100bcca4
cmp dword [ebp - 4], 1
je 0x100bccb6
cmp dword [ebp - 4], 0
je 0x100bccb6
mov dword [ebp - 0x218], 0
jmp 0x100bccc0
mov dword [ebp - 0x218], 1
mov al, byte [ebp - 0x218]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret
Function at 0x100bcce0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x64c], ecx
mov eax, 0xe
shl eax, 2
mov ecx, dword [0x101db5fc]
mov edx, dword [0x101db5fc]
mov esi, dword [0x101db5fc]
mov esi, dword [esi + 0x6c]
xor esi, dword [edx + 0x64]
xor esi, dword [ecx + eax]
and esi, 0x40000
je 0x100bcd2d
mov eax, dword [ebp + 0xc]
jmp 0x100bced5
lea eax, [ebp - 4]
push eax
call fcn.100bc6e0
or eax, 0x20019
push eax
push 0
push str.CLSID
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bced2
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0xc], 0x40
mov dword [ebp - 8], 0xa
mov cl, byte [0x101a0fc1]
mov byte [ebp - 0x218], cl
push 0x1ff
push 0
lea edx, [ebp - 0x217]
push edx
call fcn.1014e270
add esp, 0xc
mov dword [ebp - 0x21c], 0
jmp 0x100bcda8
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xa
jae 0x100bcded
push 0x40
mov ecx, dword [ebp + 8]
call fcn.10069850
mov dword [ebp - 0x220], eax
push 0x200
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100bcde4
jmp 0x100bcded
mov byte [ebp - 0x218], 0
jmp 0x100bcd99
movsx ecx, byte [ebp - 0x218]
test ecx, ecx
je 0x100bcec8
lea edx, [ebp - 0x224]
push edx
call fcn.100bc6e0
or eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bcec8
mov dword [ebp - 0x228], 0
jmp 0x100bce44
mov edx, dword [ebp - 0x228]
add edx, 1
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x634], 0x200
mov dword [ebp - 0x430], 0x200
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x42c]
push edx
push 0
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100bceb4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x430]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.100f48e0
add esp, 0xc
mov dword [ebp + 0xc], eax
jmp 0x100bceb6
jmp 0x100bcebb
jmp 0x100bce35
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret 8