joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcf77
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x38]
push eax
push edi
call fcn.0049d1d7
lea ecx, [esp + 0x18]
push ecx
lea edx, [edi + 0x14]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0049cf07
mov edx, edi
lea ecx, [esp + 0x24]
add esp, 0x14
sub edx, ecx
xor eax, eax
mov esi, 5
jmp 0x4bcfb7
mov ebp, dword [esp + eax + 0x10]
lea ecx, [esp + eax + 0x10]
mov ebx, dword [edx + ecx]
xor ebx, ebp
mov dword [esp + eax + 0x24], ebx
add eax, 4
dec esi
jne 0x4bcfb7
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0049cbf7
lea ecx, [esp + 0x54]
push ecx
call fcn.0049cb57
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
add esp, 0xc
cmp word [eax], 0
je 0x4bd022
lea ecx, [eax + 2]
xor eax, eax
mov edx, 5
mov ebp, dword [esp + eax + 0x24]
mov ebx, dword [esp + eax + 0x4c]
xor ebx, ebp
xor ebx, dword [ecx]
mov dword [eax + esi], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x4bd008
jmp 0x4bd03a
xor eax, eax
mov ecx, 5
mov edx, dword [esp + eax + 0x4c]
xor edx, dword [esp + eax + 0x24]
mov dword [eax + esi], edx
add eax, 4
dec ecx
jne 0x4bd029
lea eax, [esp + 0x10]
push eax
call fcn.004bcf57
add esp, 4
xor eax, eax
mov ecx, 5
jmp 0x4bd057
mov ebp, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x24]
xor ebp, edx
mov dword [esp + eax + 0x10], ebp
add eax, 4
dec ecx
jne 0x4bd057
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0049cf07
lea edx, [esp + 0x44]
push edx
push edi
call fcn.0049cbf7
lea eax, [esp + 0x4c]
push eax
call fcn.0049cb57
add esp, 0x18
lea ecx, [esi + 0x14]
xor eax, eax
mov edx, 5
mov esi, dword [esp + eax + 0x60]
xor esi, dword [esp + eax + 0x38]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x4bd09d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x4c2710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4c27f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4c2808
call fcn.00404730
lea eax, [ebp - 8]
mov edx, 0x4c281c
call fcn.00404730
lea eax, [ebp - 0xc]
mov edx, 0x4c2838
call fcn.00404730
mov edx, dword [0x4f4334]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004049a4
mov eax, dword [ebp - 0x10]
call fcn.004093b8
test al, al
je 0x4c27d8
mov eax, dword [0x4f4430]
mov eax, dword [eax]
call fcn.00404958
test eax, eax
jle 0x4c2798
push dword [ebp - 8]
mov eax, dword [0x4f4430]
push dword [eax]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a18
push 5
mov eax, dword [0x4f4334]
mov eax, dword [eax]
call fcn.00404b58
push eax
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
mov edx, dword [0x4f4334]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
call fcn.004049a4
mov eax, dword [ebp - 0x14]
call fcn.00404b58
push eax
push 0x4c2848
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c27fa
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004046bc
ret
Function at 0x4c2850
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4c2858
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c29b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404698
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404730
lea eax, [ebp - 0x14]
call fcn.00404ba8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404b58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4c2996
mov eax, ebx
call fcn.00402778
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c298f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404b58
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4c2979
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4c29c0
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4c2979
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00408f9c
push dword [ebp - 0x18]
push 0x4c29cc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00408f9c
push dword [ebp - 0x1c]
push 0x4c29cc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00408f9c
push dword [ebp - 0x20]
push 0x4c29cc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00408f9c
push dword [ebp - 0x24]
mov eax, esi
mov edx, 7
call fcn.00404a18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2996
mov eax, dword [ebp - 4]
call fcn.00402798
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c29b8
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004046bc
ret
Function at 0x4c2c48
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b48
xor eax, eax
push ebp
push 0x4c2df8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c2ddb
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c2cb1
mov byte [ebp - 5], 0
call fcn.00404164
jmp 0x4c2de2
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c2cdf
mov byte [ebp - 5], 0
call fcn.00404164
jmp 0x4c2de2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4c2cfe
mov byte [ebp - 5], 0
call fcn.00404164
jmp 0x4c2de2
xor edi, edi
test bl, bl
je 0x4c2d5b
cmp dword [ebp - 0x2c], 1
jne 0x4c2d47
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x4c2d47
mov byte [ebp - 5], 0
jmp 0x4c2d51
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [0x4f4540]
mov eax, dword [eax]
call fcn.0045da38
inc edi
cmp esi, edi
jle 0x4c2d51
cmp dword [ebp - 0x2c], 4
jne 0x4c2d23
call fcn.00404164
jmp 0x4c2de2
cmp dword [ebp - 0x2c], 4
jne 0x4c2d9e
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x4c2d9e
mov byte [ebp - 5], 0
jmp 0x4c2da8
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [0x4f4540]
mov eax, dword [eax]
call fcn.0045da38
inc edi
cmp esi, edi
jle 0x4c2da8
cmp dword [ebp - 0x2c], 1
jne 0x4c2d7a
call fcn.00404164
jmp 0x4c2de2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2dff
lea eax, [ebp - 4]
call fcn.00404698
ret
Function at 0x4c2e0c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b48
xor eax, eax
push ebp
push 0x4c2ef1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c2ed4
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c2e63
call fcn.00404164
jmp 0x4c2edb
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c2e8a
call fcn.00404164
jmp 0x4c2edb
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4c2ea2
call fcn.00404164
jmp 0x4c2edb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2edb
cmp dword [ebp - 0x10], 0
je 0x4c2ec4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0xc], 0
je 0x4c2ed3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2ef8
lea eax, [ebp - 4]
call fcn.00404698
ret

Function at 0x4c302c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c311f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004c2fc4
mov eax, dword [ebp - 4]
call fcn.004093b8
test al, al
je 0x4c3101
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403158
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [0x4f4540]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404b58
mov dword [ebp - 0x34], eax
mov eax, 0x4c312c
mov dword [ebp - 0x30], eax
mov edx, dword [0x4f4334]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
mov ecx, 0x4c313c
call fcn.004049a4
mov eax, dword [ebp - 0x48]
call fcn.00404b58
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4c3101
mov eax, dword [0x4f4540]
mov eax, dword [eax]
call fcn.0045da38
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 8], 0x103
jne 0x4c3101
mov eax, dword [0x4f4540]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x4c30cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3126
lea eax, [ebp - 0x48]
call fcn.00404698
lea eax, [ebp - 4]
call fcn.00404698
ret
Function at 0x4c3c6c
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c3e46
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x114]
call fcn.004c2f94
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4c3e5c
call fcn.004049a4
lea eax, [ebp - 0x10d]
xor ecx, ecx
mov edx, 0x105
call fcn.00403158
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404908
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040d5d4
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x4c3e5c
call fcn.004049a4
mov eax, dword [ebp - 4]
call fcn.004093b8
test al, al
je 0x4c3d55
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x120]
call fcn.004c2f94
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 4]
mov ecx, 0x4c3e74
call fcn.004049a4
lea eax, [ebp - 0x124]
call fcn.004c3a78
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 8]
mov ecx, 0x4c3e74
call fcn.004049a4
mov eax, dword [ebp - 4]
call fcn.004093b8
test al, al
je 0x4c3db6
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x128]
call fcn.004c2f94
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 4]
mov ecx, 0x4c3e90
call fcn.004049a4
lea eax, [ebp - 0x12c]
call fcn.004c3a78
mov eax, dword [ebp - 0x12c]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x4c3e90
pop eax
pop edx
call fcn.004049a4
mov eax, dword [ebp - 4]
call fcn.004093b8
test al, al
je 0x4c3e1b
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.00404b58
push eax
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3e4d
lea eax, [ebp - 0x12c]
mov edx, 7
call fcn.004046bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046bc
ret
Function at 0x4d929c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b48
xor eax, eax
push ebp
push 0x4d9491
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0xc
call fcn.00403158
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
lea edx, [ebp - 0x17c]
mov eax, dword [0x4f4540]
mov eax, dword [eax]
call fcn.0045e1f4
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x18]
call fcn.004095a0
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0x44
call fcn.00403158
mov dword [ebp - 0x168], 0x44
mov dword [ebp - 0x13c], 0x101
mov word [ebp - 0x138], bx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404b58
push eax
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b58
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4d93ae
mov dword [ebp - 8], 0xffffffff
jmp 0x4d9463
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, eax
mov eax, esi
call fcn.00404698
jmp 0x4d9414
lea eax, [ebp - 0x124]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403158
push 0
lea eax, [ebp - 0x14]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
mov ebx, eax
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x124]
mov ecx, pe_nt_image_headers32
call fcn.00404908
mov edx, dword [ebp - 0x180]
mov eax, esi
call fcn.00404960
test ebx, ebx
jne 0x4d93c2
mov eax, dword [0x4f4540]
mov eax, dword [eax]
call fcn.0045da38
push 0xffffffffffffffff
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x178]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x174]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9498
lea eax, [ebp - 0x180]
mov edx, 2
call fcn.004046bc
lea eax, [ebp - 0x18]
call fcn.00404698
lea eax, [ebp - 4]
call fcn.00404698
ret
Function at 0x100a803
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100a861
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push 0x100131c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100a866
mov eax, 0x80004005
pop esi
leave
ret 8

Function at 0x100a870
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100a8cc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100a8d1
mov eax, 0x80004005
pop esi
leave
ret 0xc

Function at 0x100d775
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
push 0
push 0x105
mov esi, ecx
call fcn.0100b618
test eax, eax
jge 0x100d793
mov ecx, dword [esi + 0xc]
and word [ecx], 0
jmp 0x100d7af
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x100d7b5
mov eax, dword [esi + 0xc]
and word [eax], 0
mov eax, 0x80004005
and dword [esi + 0x10], 0
pop esi
ret
mov ecx, esi
call fcn.0100ca60
xor eax, eax
pop esi
ret

Function at 0x100d7c5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
push 0
push 0x105
mov esi, ecx
call fcn.0100b618
test eax, eax
jge 0x100d7e3
mov ecx, dword [esi + 0xc]
and word [ecx], 0
jmp 0x100d7ff
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jge 0x100d805
mov eax, dword [esi + 0xc]
and word [eax], 0
mov eax, 0x80004005
and dword [esi + 0x10], 0
pop esi
ret
mov ecx, esi
call fcn.0100ca60
xor eax, eax
pop esi
ret
Function at 0x1013fc2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x10360ac]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov edi, ecx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
test eax, eax
jne 0x1014000
mov dword [ebp - 0x260], edi
jmp 0x101401d
lea eax, [ebp - 0x260]
push eax
push 0xf003f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x101413f
push esi
push esi
lea eax, [ebp - 0x270]
push eax
push esi
lea eax, [ebp - 0x268]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, esi
jne 0x1014121
cmp dword [ebp - 0x268], esi
je 0x1014121
push dword [ebp - 0x270]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1014112
cmp dword [ebp - 0x268], esi
mov dword [ebp - 0x264], esi
jbe 0x1014112
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x26c]
push eax
push ebx
lea eax, [ebp - 0x280]
push eax
push esi
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x264]
mov dword [ebp - 0x27c], 0x12c
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, esi
jne 0x1014112
push dword [ebp - 0x26c]
lea eax, [ebp - 0x25c]
push ebx
push dword [ebp - 0x280]
push esi
push eax
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x1014112
inc dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x268]
jb 0x1014087
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101413d
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102699e
leave
ret
Function at 0x1014173
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x10360ac]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp + 0x10]
push 0x64
xor edi, edi
cmp dword [ebp + 8], edi
pop ebx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], ebx
mov eax, 0x1004a90
jne 0x10141b4
mov eax, 0x1004a30
lea ecx, [ebp - 0xd0]
push ecx
push edi
push 0xf003f
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101430d
push ebx
lea eax, [ebp - 0xcc]
push eax
push edi
push dword [ebp - 0xd0]
mov dword [ebp - 0xd4], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1014301
push esi
mov esi, dword [ebp - 0xe4]
jmp 0x1014232
mov eax, dword [esi + 0x1d8]
cmp eax, 4
jbe 0x101422c
mov ecx, dword [esi + 0x1d4]
lea eax, [ecx + eax*2 - 8]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10142d8
mov esi, dword [esi + 0x1ea8]
cmp esi, edi
jne 0x1014201
lea eax, [ebp - 0xd8]
push eax
push edi
push 0x20019
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10142d8
push 0x198
call fcn.01026e50
mov esi, eax
cmp esi, edi
pop ecx
je 0x10142cc
push 0x66
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [esi + 0xc8]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0
push 0x1004a14
push dword [ebp - 0xd8]
mov dword [ebp - 0xdc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xcc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ecx]
test eax, eax
mov dword [esi + 0x194], eax
je 0x10142c8
mov dword [eax + 0x190], esi
mov dword [ecx], esi
xor edi, edi
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xd4]
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd4]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10141f9
pop esi
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0102699e
leave
ret