joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b516dd0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x3b597758]
test eax, eax
jne 0x3b516e4b
mov dword [0x3b597758], 1
call fcn.3b55add0
test eax, eax
je 0x3b516e3b
push 0
push 0x104
push 0x3b59775c
call fcn.3b55e1d0
add esp, 0xc
test eax, eax
je 0x3b516e4b
push esi
push edi
mov edi, 0x3b58bbe0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x3b59775c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x3b59775c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x3b59775c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x3b59775c
ret

Function at 0x3b5172f0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x3b597f98]
test eax, eax
jne 0x3b51734c
mov dword [0x3b597f98], 1
call fcn.3b55add0
test eax, eax
je 0x3b51733c
push 0
push 0x104
push 0x3b597f9c
call fcn.3b55e3d0
add esp, 0xc
test eax, eax
je 0x3b51734c
push str.SysWow64
push 0x3b597f9c
call fcn.3b54653a
add esp, 8
mov eax, 0x3b597f9c
ret
push 0x104
push 0x3b597f9c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x3b597f9c
ret

Function at 0x3b5176e0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x3b599018]
test eax, eax
je 0x3b5176ef
mov eax, 1
ret
push esi
mov esi, 0x3b599020
push esi
mov dword [0x3b599018], 1
call fcn.3b54651d
add esp, 4
test eax, eax
jne 0x3b517711
mov esi, str.snapb2p.dll
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x3b59901c], eax
je 0x3b5177ba
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TB2P_Initialize
push eax
call esi
mov dword [0x3b598ff8], eax
mov eax, dword [0x3b59901c]
push str.TB2P_Uninitialize
push eax
call esi
mov ecx, dword [0x3b59901c]
push str.TB2P_Conver
push ecx
mov dword [0x3b598ffc], eax
call esi
mov edx, dword [0x3b59901c]
push str.TP2B_Conver
push edx
mov dword [0x3b599000], eax
call esi
mov dword [0x3b599004], eax
mov eax, dword [0x3b59901c]
push str.TP2J_Conver
push eax
call esi
mov ecx, dword [0x3b59901c]
push str.TJ2J_Conver
push ecx
mov dword [0x3b599008], eax
call esi
mov edx, dword [0x3b59901c]
push str.TX2B_Conver
push edx
mov dword [0x3b59900c], eax
call esi
mov dword [0x3b599010], eax
mov eax, dword [0x3b59901c]
push str.TX2B_Free
push eax
call esi
mov dword [0x3b599014], eax
mov eax, dword [0x3b598ff8]
pop esi
test eax, eax
je 0x3b517809
mov eax, dword [0x3b598ffc]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b599000]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b599004]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b599008]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b59900c]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b599010]
test eax, eax
je 0x3b517809
mov eax, dword [0x3b599014]
test eax, eax
je 0x3b517809
mov eax, 1
ret
xor eax, eax
ret
Function at 0x3b518080
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebp, ebp
push edi
xor eax, eax
lea ecx, [esp + 0x14]
push ebp
mov dword [esp + 0x1e], eax
push ecx
lea edx, [esp + 0x20]
push 0xe
mov dword [esp + 0x2a], eax
push edx
push ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov word [esp + 0x2c], bp
mov dword [esp + 0x36], eax
call esi
test eax, eax
je 0x3b518202
cmp dword [esp + 0x14], 0xe
jne 0x3b518202
cmp word [esp + 0x18], 0x4d42
jne 0x3b518202
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x28], ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push ebp
mov edi, 0x28
push eax
lea ecx, [esp + 0x30]
push edi
push ecx
push ebx
mov dword [esp + 0x28], ebp
call esi
test eax, eax
je 0x3b518202
cmp dword [esp + 0x14], edi
jne 0x3b518202
cmp dword [esp + 0x28], edi
jne 0x3b518202
sub esp, 0x28
mov ecx, 0xa
lea esi, [esp + 0x50]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.3b5187b0
mov esi, eax
push esi
call fcn.3b546472
mov edi, eax
add esp, 0x2c
cmp edi, ebp
mov dword [esp + 0x10], edi
je 0x3b518202
mov ecx, esi
xor eax, eax
mov edx, ecx
lea esi, [esp + 0x28]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
push ecx
call fcn.3b518630
add esp, 4
test eax, eax
jbe 0x3b5181bf
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebp
push edx
push eax
call fcn.3b518630
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call fcn.3b518830
add esp, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3b518202
mov eax, dword [esp + 0x22]
cmp eax, ebp
je 0x3b518202
push ebp
push ebp
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebp
push edx
push eax
mov dword [esp + 0x20], ebp
call fcn.3b518700
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call fcn.3b518860
add esp, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x3b51820f
lea edx, [esp + 0x10]
push edx
call fcn.3b517f00
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x3b5182c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
xor esi, esi
test ebx, ebx
push edi
mov dword [esp + 0xc], esi
je 0x3b51839a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x3b51839a
push esi
push esi
push 2
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x3b51839a
push ebp
push ebx
call fcn.3b5187f0
mov esi, eax
xor eax, eax
mov dword [esp + 0x1a], eax
push ebx
mov dword [esp + 0x22], eax
lea ecx, [esi + 0xe]
mov dword [esp + 0x26], eax
mov word [esp + 0x1c], 0x4d42
mov dword [esp + 0x1e], ecx
call fcn.3b518630
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 8
add eax, 0x36
lea edx, [esp + 0x28]
mov dword [esp + 0x1e], eax
push 0
push edx
lea eax, [esp + 0x1c]
push 0xe
push eax
push edi
mov dword [esp + 0x3c], 0
call ebp
test eax, eax
je 0x3b518385
cmp dword [esp + 0x28], 0xe
jne 0x3b518385
lea ecx, [esp + 0x28]
push 0
push ecx
push esi
push ebx
push edi
mov dword [esp + 0x3c], 0
call ebp
test eax, eax
je 0x3b518385
mov eax, dword [esp + 0x28]
cmp eax, esi
mov esi, 1
je 0x3b518389
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x3b51d9c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x3b57446b
push eax
mov eax, dword [0x3b59926c]
mov dword fs:[0], esp
sub esp, 0x910
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x3b51dc06
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3b57795c
mov dword [0x3b59926c], 1
mov dword [esp + 0xc], ebx
stosb byte es:[edi], al
call fcn.3b5163b0
push eax
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.3b546cef
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push 0x400
push edx
push 0x3b599270
push 0x3b577974
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jbe 0x3b51dab6
cmp byte [esp + 0x517], bl
jne 0x3b51dab6
lea eax, [esp + 0x518]
push 0x400
lea ecx, [esp + 0x11c]
push eax
push ecx
call fcn.3b543030
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x3b51daba
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x3b51dbc4
lea ecx, [esp + 0xc]
call fcn.3b53a3c0
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push 0x80000002
lea ecx, [esp + 0x18]
mov dword [esp + 0x92c], ebx
call fcn.3b53a530
test eax, eax
je 0x3b51db39
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
push 0x3b5779c0
call fcn.3b53a950
cmp eax, ebx
je 0x3b51db39
mov ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x3b51db2c
mov edx, ecx
push esi
mov esi, eax
lea edi, [esp + 0x51c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3b51db30
mov dword [esp + 8], ebx
push eax
call fcn.3b54606f
add esp, 4
lea ecx, [esp + 0xc]
call fcn.3b53a580
lea ecx, [esp + 0xc]
mov dword [esp + 0x920], 0xffffffff
call fcn.3b53a4b0
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x3b51dbc4
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x118]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x11c]
push eax
push 0x3b599270
push 0x3b5779c0
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
jbe 0x3b51dbbc
cmp byte [esp + 0x517], bl
jne 0x3b51dbbc
lea ecx, [esp + 0x518]
push 0x400
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.3b543030
add esp, 0xc
jmp 0x3b51dbc0
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x3b51dc06
cmp eax, 4
jbe 0x3b51dc06
lea ecx, [esp + 0x518]
test ecx, ecx
je 0x3b51dc06
cmp dword [esp + 0x518], 1
je 0x3b51dc06
mov edx, dword [esp + 0x534]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x3b51dc06
add eax, 0xfffffffc
cmp ecx, eax
ja 0x3b51dc06
mov eax, dword [esp + 0x520]
mov dword [0x3b599268], eax
mov ecx, dword [esp + 0x918]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x91c
ret
Function at 0x3b51fa90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
mov edx, dword [ecx + 4]
push edi
xor eax, eax
xor ebp, ebp
xor edi, edi
xor esi, esi
test edx, edx
mov ebx, edi
jle 0x3b51fb23
mov ecx, dword [ecx]
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 4]
xor eax, eax
mov al, byte [ecx]
add esi, edx
imul eax, edx
add ebp, eax
xor eax, eax
mov al, byte [ecx + 1]
add ecx, 8
and eax, 0xff
imul eax, edx
add ebx, eax
mov eax, dword [ecx - 8]
shr eax, 0x10
and eax, 0xff
imul eax, edx
add edi, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x3b51faaf
test esi, esi
jle 0x3b51fb21
mov eax, ebp
cdq
idiv esi
mov ecx, eax
mov eax, ebx
cdq
idiv esi
and ecx, 0xff
mov ebx, eax
mov eax, edi
cdq
idiv esi
and ebx, 0xff
pop edi
pop esi
pop ebp
and eax, 0xff
shl eax, 8
or eax, ebx
pop ebx
shl eax, 8
or eax, ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x3b528dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
xor eax, eax
mov ecx, dword [esi + 0x14]
mov edi, ebp
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x14]
mov edx, ecx
sub edx, edi
sub edx, eax
test edx, edx
jle 0x3b528ec5
push ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor edx, edx
mov dl, byte [ebx + edi]
mov edi, dword [esi + 0xc]
xor ebx, ebx
mov bl, byte [ebp]
xor edx, ebx
mov dl, byte [edx + edi]
mov byte [esp + 0x1c], dl
mov ebx, dword [esp + 0x1c]
and ebx, 0xff
cmp ebx, ecx
je 0x3b528e61
mov edi, 1
cmp eax, edi
jle 0x3b528e61
mov ecx, dword [esi + 0x10]
xor edx, edx
sub ecx, edi
mov dl, byte [ecx + eax]
add edx, ebx
push edx
push esi
call fcn.3b528a40
mov ecx, dword [esi + 8]
add esp, 8
mov dl, byte [eax + ecx]
mov al, byte [edi + ebp]
xor al, dl
mov byte [edi + ebp], al
mov eax, dword [esi + 0x14]
inc edi
cmp edi, eax
jl 0x3b528e35
mov eax, dword [esi + 0x14]
lea ecx, [ebp + 1]
dec eax
push eax
push ecx
push ebp
call fcn.3b547070
mov eax, dword [esi + 4]
add esp, 0xc
cmp ebx, eax
je 0x3b528e9c
mov edx, dword [esi + 0x10]
xor eax, eax
mov al, byte [edx]
add eax, ebx
push eax
push esi
call fcn.3b528a40
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
add esp, 8
mov al, byte [eax + ecx]
mov byte [edx + ebp - 1], al
jmp 0x3b528ea4
mov ecx, dword [esi + 0x14]
mov byte [ecx + ebp - 1], 0
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x14]
mov edi, ecx
inc edx
sub edi, ebx
mov dword [esp + 0x14], edx
sub edi, eax
cmp edx, edi
jl 0x3b528e00
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x3b52e580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x3b52e5ce
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x3b52e5ce
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x3b52e5d3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x3b52e5b9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x3b52e5e3
test esi, esi
jne 0x3b52e601
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x3b52e5ff
mov byte [eax + esi - 1], 0
jne 0x3b52e608
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x3b533d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x3b533db0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x3b533db0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x3b533db5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x3b533d9b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x3b533dc2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x3b53a600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x3b53a641
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b53a643
mov esi, edi
test esi, esi
je 0x3b53a6b8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b53a6ad
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x3b53a6ad
cmp dword [esp + 0x1c], eax
jbe 0x3b53a67e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b53a6ad
cmp esi, edi
je 0x3b53a69f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x3b53a6b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x3b53a950
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x3b53a9c4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b53a9c4
cmp dword [esp + 0x10], 3
jne 0x3b53a9c4
mov edx, dword [esp + 0x18]
push edx
call fcn.3b546472
mov edi, eax
add esp, 4
test edi, edi
je 0x3b53a9c4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x3b53a9bb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.3b54606f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x3b53a9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x3b574fbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x3b5789ec]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x3b53aa3b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b53aa3d
mov esi, edi
test esi, esi
je 0x3b53ab07
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3b53aafc
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x3b53aa7f
cmp eax, 2
je 0x3b53aa7f
cmp eax, 6
je 0x3b53aa7f
cmp eax, 7
jne 0x3b53aafc
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.3b546472
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x3b53aae2
lea ecx, [esp + 0x14]
call fcn.3b52ada0
cmp esi, dword [esp + 0x14]
je 0x3b53aad7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.3b54606f
add esp, 4
jmp 0x3b53ab19
call fcn.3b54606f
add esp, 4
lea ecx, [esp + 0x10]
push 0x3b599270
call fcn.3b52ada0
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x3b53ab07
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x3b53ab19
push eax
lea ecx, [esp + 0x14]
call fcn.3b52ada0
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.3b52a110
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.3b52ab40
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x3b53b880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x3b575088
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x3b53b8d6
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b53b8d9
mov esi, dword [ebp + 8]
test esi, esi
je 0x3b53b9c3
call fcn.3b55ae60
test eax, eax
je 0x3b53b95e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x3b53b927
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
inc ebx
lea eax, [ebx + ebx]
add eax, 3
and al, 0xfc
call fcn.3b546820
mov edi, esp
test edi, edi
je 0x3b53b927
mov eax, dword [ebp + 0x10]
push ebx
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x3b53b929
xor edi, edi
mov ebx, dword [ebp + 0x18]
push ebx
call fcn.3b54651d
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x3b53b9b7
cmp esi, dword [ebp + 8]
je 0x3b53b957
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x3b53b9c5
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.3b52a3e0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x3b53b9a8
cmp esi, dword [ebp + 8]
je 0x3b53b992
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.3b52ab40
mov eax, 1
jmp 0x3b53b9c5
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.3b52ab40
cmp esi, dword [ebp + 8]
je 0x3b53b9c3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3b53ca90
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push ebx
test edx, edx
push esi
mov ebx, ecx
je 0x3b53cac6
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
or eax, 0x20019
push esi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x3b53cac8
mov esi, dword [ebx]
test esi, esi
je 0x3b53cb53
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x14]
xor edi, edi
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x3b53caf8.2
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.0x3b53caf8.2
jmp dword [eax*4 + 0x3b53cb5c]
mov edi, 1
jmp case.0x3b53caf8.2
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 4
sete al
mov edi, eax
jmp case.0x3b53caf8.2
mov eax, dword [esp + 0x10]
cmp eax, 1
je case.0x3b53caf8.0
cmp eax, 2
je case.0x3b53caf8.0
cmp eax, 6
je case.0x3b53caf8.0
cmp eax, 7
je case.0x3b53caf8.0
xor edi, edi
jmp case.0x3b53caf8.2
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 3
sete cl
mov edi, ecx
cmp esi, dword [ebx]
je 0x3b53cb4b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x3b543420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x3b57556f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x3b5789ec]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push 0x3b58d8bc
push ecx
call fcn.3b52d9a0
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.3b52a110
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.3b52ab40
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret