joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0xfb7ec3a3
sub eax, 0xfb3e91a0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xec790c78
sub dword [ebp - 0x4c], 0x9e26c72d
mov dword [ebp - 0x48], 0x22e519e1
add dword [ebp - 0x48], 0xf4e3264
mov dword [ebp - 0x44], 0x1e611a5f
sub dword [ebp - 0x44], 0xd214d631
mov dword [ebp - 0x40], 0x33e59edd
sub dword [ebp - 0x40], 0x33e59edd
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xd3911765
sub eax, 0xd35096d9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x5f761203
sub dword [ebp - 0x4c], 0xeb03a8ad
mov dword [ebp - 0x48], 0xcb4fad5a
sub dword [ebp - 0x48], 0x89e34be5
mov dword [ebp - 0x44], 0x84a1d035
add dword [ebp - 0x44], 0xdecd9c37
mov dword [ebp - 0x40], 0xcf9fbf4e
add dword [ebp - 0x40], 0x306040b2
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bfb9
push 0
call eax
mov ecx, 0x4d9b9d04
sub ecx, 0x4d9b3f76
xor ebx, ebx
add ebx, eax
mov edx, 0x411000
add edx, dword [ebp - 0x3c]
mov edi, 0xbb6a8837
add edi, 0x13095fd
xor dword [ebp - 0x30], ebx
mov esi, dword [edx]
sub dword [ebp - 0x1c], 0x7e44e2ff
xor esi, edi
xor dword [ebp - 0x30], 0xe9b63189
mov dword [ebx], esi
sub dword [ebp - 0x34], 0x49ec3839
add ebx, 0xb470154f
sub ebx, 0xb470154b
add edx, 0x84b26a84
sub edx, 0x84b26a80
loop 0x40331c
add eax, 0x1690b
mov ebx, eax
add eax, 0xd4f28f4f
sub eax, 0xd4f28f4a
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x403770
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403813
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00416b78
pop ecx
pop ecx
test eax, eax
je 0x4037fc
test ebx, ebx
je 0x4037f0
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00416b78
pop ecx
pop ecx
test eax, eax
jle 0x4037fc
push ebx
call fcn.00404730
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040470f
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037bd
xor edi, edi
cmp ebx, edi
jne 0x403817
xor eax, eax
jmp 0x403883
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403846
call fcn.00404730
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403813
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403813
call fcn.00404730
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403836
cmp dword [ebp - 0x70], edi
je 0x403879
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040470f
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085d9
add ebp, 0x9c
leave
ret
Function at 0x404925
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.00404792
push 8
mov esi, eax
call fcn.004046c8
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404990
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x404997
and dword [ebx + 4], 0
jmp 0x4049ac
xor eax, eax
jmp 0x404a77
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a5d
push edi
call fcn.00407d90
pop ecx
cmp eax, 4
jl 0x404983
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404983
add eax, 0xfffffffd
push 0x4197ac
push eax
mov dword [ebp - 0x74], eax
call fcn.004085f0
pop ecx
pop ecx
test eax, eax
je 0x4049f2
push 0x4197a8
push dword [ebp - 0x74]
call fcn.004085f0
pop ecx
pop ecx
test eax, eax
jne 0x404983
push 0x3b
push edi
call fcn.00409780
pop ecx
pop ecx
test eax, eax
jne 0x404983
push dword [ebp - 0x78]
call fcn.00407d90
push edi
mov ebx, eax
call fcn.00407d90
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046c8
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.00416b78
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.00416b78
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047e8
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404983
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.00404730
push ebx
call fcn.00404730
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085d9
add ebp, 0x214
leave
ret
Function at 0x407d7a
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x41e210
call fcn.0040d880
xor esi, esi
cmp dword [0x422fe8], esi
jne 0x407c3a
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x407c4d
mov dword [ebp - 0x1c], esi
jmp 0x407c83
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x407c48
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x407c48
cmp dword [eax + 0x400074], 0xe
jbe 0x407c48
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040d85e
test eax, eax
jne 0x407c94
push 0x1c
call fcn.00416b78
pop ecx
call fcn.0040d6e3
test eax, eax
jne 0x407ca5
push 0x10
call fcn.00416b78
pop ecx
call fcn.0040d2f3
mov dword [ebp - 4], esi
call fcn.00416b78
test eax, eax
jns 0x407cbe
push 0x1b
call fcn.00416b78
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x422fe4], eax
call fcn.00416b78
mov dword [0x421270], eax
call fcn.0040105b
test eax, eax
jns 0x407ce4
push 8
call fcn.00416b78
pop ecx
call fcn.0040cf3b
test eax, eax
jns 0x407cf5
push 9
call fcn.00416b78
pop ecx
push 1
call fcn.00416b78
pop ecx
cmp eax, esi
je 0x407d08
push eax
call fcn.00416b78
pop ecx
mov eax, dword [0x421294]
mov dword [0x421298], eax
push eax
push dword [0x42128c]
push dword [0x421288]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x407d35
push eax
call fcn.00416b78
call fcn.00408d12
jmp 0x407d6a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040d8c5
ret
call fcn.00416b78
jmp 0x407c19

Function at 0x4085d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4085e3
repz ret
jmp fcn.004101ab
Function at 0x850058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8501a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85006a
add dl, dl
jne 0x850089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8500dc
xor eax, eax
add dl, dl
jne 0x850096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85017d
add dl, dl
jne 0x8500a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8500b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8500bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8500c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8500d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x850075
mov eax, 1
add dl, dl
jne 0x8500ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8500f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8500e1
sub eax, ebx
mov ebx, 1
jne 0x850128
mov ecx, 1
add dl, dl
jne 0x85010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x850119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x850105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x850075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x850136
cmp eax, 0x7d00
jae 0x85016d
cmp eax, 0x500
jb 0x850168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x850075
cmp eax, 0x7f
ja 0x850170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x850075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x850075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10022e2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov esi, 0x1010ac0
push 0xfff
xor ebx, ebx
push esi
mov word [0x1012abe], bx
call dword [sym.imp.msvcrt.dll__vsnwprintf]
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
xor ecx, ecx
add esp, 0x10
add eax, 0x40
cmp dword [ebp + 8], eax
setne cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test al, 1
mov dword [ebp + 8], eax
push ebx
je 0x1002346
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1002374
push ebx
push 0x1000
mov edi, 0x1012ac0
push edi
push dword [ebp - 4]
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100237d
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x100237d
mov eax, dword [ebp - 8]
jmp 0x100237f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002cab
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x1002e6f
mov eax, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.msvcrt.dll_calloc]
inc eax
push 1
push eax
call edi
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x1002cf8
push 8
pop eax
jmp 0x1002e6e
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x1002e6e
mov eax, dword [ebp + 0x18]
cmp dword [eax], ebx
jne 0x1002e4a
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call esi
test eax, eax
jne 0x1002e4a
cmp dword [ebp + 0x14], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ebx
jne 0x1002d47
mov eax, 0x1013ac0
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
add esi, 0x64
push 2
push esi
call edi
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1002d68
xor eax, eax
jmp 0x1002e6e
push 2
push esi
call edi
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1002d83
push ebx
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1002e6d
push esi
push edi
push 0x8f
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x1002d9e
mov eax, 0x1013ac0
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov edi, dword [sym.imp.msvcrt.dll_free]
call edi
add esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push ebx
push eax
call fcn.010022e2
push dword [sym.imp.msvcrt.dll__iob]
call dword [sym.imp.msvcrt.dll_fgetwc]
add esp, 0xc
mov esi, eax
call dword [sym.imp.msvcrt.dll__flushall]
movzx eax, si
cmp eax, 0x61
je 0x1002deb
cmp eax, 0x6e
je 0x1002deb
cmp eax, 0x79
jne 0x1002df2
mov dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x1002db3
push ebx
call edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], 0x1001514
push eax
call fcn.010022e2
cmp si, 0x61
pop ecx
pop ecx
je 0x1002e3f
cmp si, 0x41
je 0x1002e3f
cmp si, 0x79
je 0x1002e48
cmp si, 0x59
je 0x1002e48
cmp si, 0x6e
je 0x1002d61
cmp si, 0x4e
jne 0x1002e48
jmp 0x1002d61
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
xor ebx, ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
mov eax, esi
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1003623
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1008028]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edx, edx
mov dword [ebp - 4], eax
xor eax, eax
cmp ebx, edx
lea edi, [ebp - 0x42]
mov word [ebp - 0x44], dx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 1
stosw word es:[edi], ax
jne 0x100365a
lea ebx, [ebp - 0x44]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x3c]
push eax
push edx
lea eax, [ebp - 0x40]
push eax
push edx
push ebx
push ecx
call esi
test eax, eax
jne 0x10037ce
mov eax, dword [ebp - 0x3c]
and eax, 1
add dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 2
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100369e
push 8
pop eax
jmp 0x10037ce
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
push 0
push ebx
push dword [ebp - 0x48]
call esi
test eax, eax
je 0x10036ba
mov esi, eax
jmp 0x10037c4
push dword [ebp - 0x40]
lea eax, [ebp - 0x38]
push eax
call fcn.0100359a
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
jne 0x10036d7
mov ebx, 0x1013ac0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x20
push 0x10015c8
push eax
call fcn.010022e2
mov eax, dword [ebp - 0x40]
add esp, 0x10
test eax, eax
jbe 0x1003785
cmp eax, 2
jbe 0x100376c
cmp eax, 3
jbe 0x1003785
cmp eax, 5
jbe 0x1003763
cmp eax, 7
jne 0x1003785
mov eax, dword [ebp - 0x3c]
add eax, edi
cmp edi, eax
mov esi, edi
jae 0x10037ad
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
cmp word [esi], 0
jne 0x100373f
push 0x1001254
push eax
call fcn.010022e2
pop ecx
inc esi
pop ecx
inc esi
jmp 0x1003758
push esi
push 0x100146c
push eax
call fcn.010022e2
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x3c]
add eax, edi
cmp esi, eax
jb 0x1003720
jmp 0x10037ad
push dword [edi]
push 0x10015bc
jmp 0x1003772
push edi
push 0x100146c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call fcn.010022e2
add esp, 0xc
jmp 0x10037ad
xor esi, esi
cmp dword [ebp - 0x3c], esi
jbe 0x10037ad
movzx eax, byte [esi + edi]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x10015b0
push eax
call fcn.010022e2
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x3c]
jb 0x100378c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x1001514
push eax
call fcn.010022e2
pop ecx
pop ecx
xor esi, esi
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006c87
leave
ret 8
Function at 0x100417a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1004275
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x10041d2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004272
mov eax, dword [ebp - 0x10]
inc dword [ebp - 8]
imul eax, dword [ebp - 8]
push ebx
push edi
push 2
push eax
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
xor ebx, ebx
cmp dword [ebp - 0x10], esi
pop ecx
mov edi, eax
jbe 0x100421f
cmp dword [ebp - 4], esi
jne 0x100421f
mov eax, dword [ebp - 8]
push esi
mov dword [ebp - 4], eax
imul eax, ebx
push esi
push esi
push esi
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + eax*2]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
cmp ebx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jb 0x10041f2
xor ebx, ebx
cmp dword [ebp - 4], esi
jne 0x1004247
cmp ebx, dword [ebp - 0x10]
jae 0x1004247
mov eax, dword [ebp - 8]
imul eax, ebx
lea eax, [edi + eax*2]
push eax
push dword [ebp - 0xc]
call fcn.0100417a
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1004247
inc ebx
jmp 0x1004226
cmp edi, esi
je 0x1004253
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
pop edi
pop ebx
jne 0x1004272
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x100427f
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x18], edi
mov dword [ebp - 0x10], edi
je 0x10042aa
push dword [esi + 0x1c]
push dword [esi + 0x30]
push 0x10017a0
call fcn.010025e9
test eax, eax
je 0x10042c3
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x10042ca
push dword [esi + 0x1c]
push eax
push 0x1001750
call fcn.010025e9
test eax, eax
jne 0x10042ca
xor eax, eax
jmp 0x10043c2
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push dword [esi + 0x30]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043c2
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x1004303
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
jmp 0x10043b6
cmp dword [esi + 0x18], edi
je 0x10043b6
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043b6
mov eax, dword [ebp - 0xc]
inc dword [ebp - 8]
imul eax, dword [ebp - 8]
push ebx
push 2
push eax
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
xor ebx, ebx
cmp dword [ebp - 0xc], edi
pop ecx
mov esi, eax
mov dword [ebp - 0x10], edi
jbe 0x1004380
cmp dword [ebp + 8], edi
jne 0x1004380
mov eax, dword [ebp - 8]
push edi
mov dword [ebp - 0x10], eax
imul eax, ebx
push edi
push edi
push edi
lea ecx, [ebp - 0x10]
push ecx
lea eax, [esi + eax*2]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
cmp ebx, dword [ebp - 0xc]
mov dword [ebp + 8], eax
jb 0x1004353
xor ebx, ebx
cmp dword [ebp + 8], edi
jne 0x10043a9
cmp ebx, dword [ebp - 0xc]
jae 0x10043a9
mov eax, dword [ebp - 8]
imul eax, ebx
lea eax, [esi + eax*2]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x10043a9
inc ebx
jmp 0x1004387
cmp esi, edi
pop ebx
je 0x10043b6
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 4
Function at 0x1004923
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
jne 0x1004a7f
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp + 0x10]
call esi
cmp eax, edi
jne 0x1004a7f
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.msvcrt.dll_calloc]
inc eax
push 1
push eax
call edi
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x18], eax
jne 0x100498d
mov dword [ebp + 8], 8
jmp 0x1004a7c
mov eax, dword [ebp - 8]
inc eax
push 1
push eax
call edi
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x10049aa
mov dword [ebp + 8], 8
jmp 0x1004a68
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
push 0
push ebx
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x10049dc
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp + 0x10]
call esi
test eax, eax
mov dword [ebp + 8], eax
je 0x10049f0
push dword [ebp + 0x18]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push edi
call esi
pop ecx
jmp 0x1004a7b
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
jne 0x1004a2e
cmp esi, dword [ebp - 8]
jne 0x1004a2e
push esi
push edi
push dword [ebp + 0x18]
call fcn.010046cf
test eax, eax
jne 0x1004a2e
cmp dword [ebp + 0x1c], 2
je 0x1004a1a
cmp dword [ebp + 0x1c], 3
jne 0x1004a68
push 0
push esi
push dword [ebp + 0x18]
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
call fcn.01004556
jmp 0x1004a68
cmp dword [ebp + 0x1c], 1
je 0x1004a3a
cmp dword [ebp + 0x1c], 3
jne 0x1004a5e
push 1
push esi
push dword [ebp + 0x18]
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
call fcn.01004556
push 2
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
push ebx
push dword [ebp + 0x14]
call fcn.01004556
mov dword [0x1008040], 1
push dword [ebp + 0x18]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
test edi, edi
pop ecx
je 0x1004a7c
push edi
call esi
pop ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x18