joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de35
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
inc eax
mov cl, bl
cmp esi, eax
jbe 0x40de52
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x40de4a
cmp cl, byte [edx]
jne 0x40de8d
push esi
push edx
push 0xffffffffffffffff
call fcn.00406773
not eax
mov ecx, ebx
cmp dword [ecx + 0x440044], eax
jne 0x40de73
cmp dword [ecx + 0x440040], esi
je 0x40de7e
add ecx, 0xc
inc ebx
cmp ecx, 0x48
jb 0x40de63
jmp 0x40de8d
imul eax, ebx, 0xc
mov ecx, dword [eax + 0x440048]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
pop esi
pop ebx
ret 0xc

Function at 0x411346
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x10001030
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x1004f9d8]
test eax, eax
jne 0x100010ae
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x1004f878
mov dword [0x1004f9d8], 1
mov dword [0x1004f878], 0x94
call esi
mov edx, dword [0x1004f888]
xor eax, eax
cmp edx, 2
push 0x1004f938
sete al
mov dword [0x1004b0d0], eax
mov dword [0x1004f938], 0x9c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
mov dword [0x1004f9d4], eax
test eax, eax
push 0x1004f910
je 0x100010a8
call eax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret
Function at 0x10004220
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
je 0x100042ae
xor ebp, ebp
mov esi, 0x100500e8
lea eax, [edi + 0x1004fddc]
lea ebx, [edi + 0x1004fad0]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov dword [esp + 0x14], eax
je 0x10004284
push 0
push 0
push esi
push 0
push 0
push 0
push ebx
call fcn.10001d30
add esp, 0x1c
add esi, 8
inc ebp
add edi, 0x104
cmp esi, 0x10050100
jb 0x10004237
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.cf_failed__i___d__err__0x_08x
push 2
push 0x1004b504
push 0x10051088
call fcn.100059c0
mov eax, dword [esp + 0x2c]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x10004343
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
cmp ebp, edi
je 0x10004343
mov dword [esp + 0x14], edi
xor esi, esi
lea edi, [esi + 0x1004fad0]
lea ebx, [esi + 0x1004fddc]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 5
push edi
push ebx
call ebp
mov edi, eax
test edi, edi
je 0x10004317
mov edx, dword [esp + 0x14]
add esi, 0x104
inc edx
cmp esi, 0x30c
mov dword [esp + 0x14], edx
jb 0x100042d9
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push str.mfe_failed__i___d__err__0x_08x
push 2
push 0x1004b504
push 0x10051088
call fcn.100059c0
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10004560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10040488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
lea ecx, [esp + 4]
call fcn.100177b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0x20019
push eax
xor ebp, ebp
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebp
call fcn.10017850
test eax, eax
je 0x100046b1
push edi
lea ecx, [esp + 0xc]
call fcn.100325d2
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov byte [esp + 0x30], 1
call fcn.100193d0
test eax, eax
je 0x10004699
mov edx, dword [esp + 0x14]
cmp edx, ebp
jle 0x10004699
mov edi, str.360safebox.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ebp
mov dword [esp + 0x34], ecx
jle 0x10004699
push ebx
mov ebx, dword [esp + 0x34]
push esi
lea eax, [esp + 0x40]
push ebp
push eax
lea ecx, [esp + 0x1c]
call fcn.100051f0
mov ecx, dword [esp + 0x40]
push 0x5c
push ecx
mov byte [esp + 0x38], 2
call fcn.100075dd
mov esi, eax
add esp, 8
test esi, esi
je 0x1000467c
mov edx, dword [esp + 0x3c]
push edx
push str.360safebox.exe
push esi
call fcn.10006db4
add esp, 0xc
test eax, eax
jne 0x1000467c
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000467c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x40]
not ecx
dec ecx
sub esi, eax
push ecx
push esi
lea ecx, [esp + 0x48]
call fcn.10031315
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x40]
push ecx
push eax
mov ecx, ebx
call fcn.100328a7
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 1
call fcn.10034b96
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jl 0x100045ff
pop esi
pop ebx
lea ecx, [esp + 8]
call fcn.100178b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.10032605
pop edi
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.100177d0
mov ecx, dword [esp + 0x1c]
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10004930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
test eax, eax
push ebx
push edi
je 0x10004a97
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x10004a97
mov edi, dword [esp + 0x30]
test edi, edi
je 0x10004a97
mov ecx, dword [esp + 0x34]
lea eax, [ebx + ebx]
cmp ecx, eax
jb 0x10004a97
mov ecx, dword [esp + 0x38]
push ebp
xor ebp, ebp
mov byte [esp + 0x14], 0x30
test ebx, ebx
mov byte [esp + 0x15], 0xb
mov byte [esp + 0x16], 0x31
mov byte [esp + 0x17], 0xa
mov byte [esp + 0x18], 0x32
mov byte [esp + 0x19], 9
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 8
mov byte [esp + 0x1c], 0x34
mov byte [esp + 0x1d], 0xf
mov byte [esp + 0x1e], 0x35
mov byte [esp + 0x1f], 0xe
mov byte [esp + 0x20], 0x36
mov byte [esp + 0x21], 0xd
mov byte [esp + 0x22], 0x37
mov byte [esp + 0x23], 0xc
mov byte [esp + 0x24], 0x38
mov byte [esp + 0x25], 3
mov byte [esp + 0x26], 0x39
mov byte [esp + 0x27], 2
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], 0x1b
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x15
mov byte [esp + 0x10], 0x3a
mov byte [esp + 0x11], 1
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0x67
mov dword [ecx], 0
jbe 0x10004a80
push esi
mov edx, dword [esp + 0x30]
mov al, byte [edx + ebp]
cmp al, 0x61
jl 0x10004a25
cmp al, 0x7a
jg 0x10004a25
mov edx, dword [ecx]
movsx eax, al
mov al, byte [eax + 0x1004b647]
mov byte [edx + edi], al
jmp 0x10004a6c
cmp al, 0x41
jl 0x10004a3d
cmp al, 0x5a
jg 0x10004a3d
movsx edx, al
mov eax, dword [ecx]
mov dl, byte [edx + 0x1004b64b]
mov byte [eax + edi], dl
jmp 0x10004a6c
cmp al, 0x30
jl 0x10004a53
cmp al, 0x39
jg 0x10004a53
mov edx, dword [ecx]
movsx eax, al
mov al, byte [esp + eax*2 - 0x47]
mov byte [edx + edi], al
jmp 0x10004a6c
xor edx, edx
lea esi, [esp + 0x10]
cmp al, byte [esi]
je 0x10004a8c
inc edx
add esi, 2
cmp edx, 4
jb 0x10004a59
mov eax, dword [ecx]
mov byte [eax + edi], 0x3b
mov edx, dword [ecx]
mov byte [edx + edi + 1], 0x3b
mov esi, dword [ecx]
add esi, 2
inc ebp
cmp ebp, ebx
mov dword [ecx], esi
jb 0x10004a06
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov eax, dword [ecx]
mov dl, byte [esp + edx*2 + 0x11]
mov byte [eax + edi], dl
jmp 0x10004a6c
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x10005660
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x10005677
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100056cb
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x100056cb
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x100056cb
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x18], 0
not ecx
dec ecx
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x100056fe
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
push ecx
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
pop esi
pop ebx
ret 4

Function at 0x10005710
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [esi + 8]
test eax, eax
je 0x10005726
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10005779
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x10005779
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x10005779
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
mov dword [esp + 0x18], 0
call fcn.100068fe
mov edx, dword [esi + 0x18]
add esp, 4
shl eax, 1
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x100057ab
lea eax, [esp + 0xc]
push 0
push eax
push edi
mov dword [esp + 0x18], 0
call fcn.100068fe
add esp, 4
shl eax, 1
push eax
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
pop edi
pop esi
ret 4

Function at 0x10016a40
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10016a90
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x10016be0
push 0
push 0
call fcn.10008ea4
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x10016a90
mov ecx, dword [esi + 0x18]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x10016a7f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10016ac0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x10016ace
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10016af9
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0xc], 0
mov eax, 1
pop esi
ret

Function at 0x10017670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1001767b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x1001777d
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10044978]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10044978]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10044978]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10044978]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10044978]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10044978]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10044978]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10044978]
xor eax, edx
inc ecx
dec edi
jne 0x10017696
test esi, esi
je 0x1001779f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10044978]
xor eax, edx
inc ecx
dec esi
jne 0x10017781
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x10017d20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
test eax, eax
je 0x10017d42
push 0x20019
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.10017880
add esp, 0xc
mov ebx, eax
jmp 0x10017d46
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x10017e1f
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10017e10
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10017d8c
cmp eax, 2
je 0x10017d8c
cmp eax, 6
je 0x10017d8c
cmp eax, 7
jne 0x10017e10
mov eax, dword [esp + 0x14]
push edi
add eax, 2
push eax
call fcn.100337e7
mov ecx, dword [esp + 0x1c]
mov esi, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push esi
push 0
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
test eax, eax
push esi
jne 0x10017dfa
mov ecx, dword [esp + 0x20]
call fcn.10034d1f
cmp ebx, dword [esp + 0x10]
je 0x10017de8
push ebx
call fcn.100178d0
add esp, 4
push esi
call fcn.10033810
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
ret
call fcn.10033810
mov ecx, dword [esp + 0x20]
add esp, 4
push 0x1004278c
call fcn.10034d1f
cmp ebx, dword [esp + 0x10]
je 0x10017e1f
push ebx
call fcn.100178d0
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10017f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x10017f54
push 0x20019
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10017880
add esp, 0xc
mov ebx, eax
jmp 0x10017f57
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001810e
call fcn.1002ec00
test eax, eax
je 0x10018041
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10017f78
mov dword [ebp + 0x10], eax
jmp 0x10017fab
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10007690
mov ecx, dword [ebp + 0x10]
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], edi
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push 0
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10018100
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x10017fe5
cmp eax, 2
je 0x10017fe5
cmp eax, 6
je 0x10017fe5
cmp eax, 7
jne 0x10018100
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.100337e7
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push 0
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push esi
jne 0x100180eb
mov ecx, dword [ebp + 0x14]
call fcn.100202c0
cmp ebx, dword [ebp + 8]
je 0x100180d3
jmp 0x100180ca
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push 0
push eax
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10018100
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x1001807b
cmp eax, 2
je 0x1001807b
cmp eax, 6
je 0x1001807b
cmp eax, 7
jne 0x10018100
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.100337e7
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, esi
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push 0
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push esi
jne 0x100180eb
mov ecx, dword [ebp + 0x14]
call fcn.100203b0
cmp ebx, dword [ebp + 8]
je 0x100180d3
push ebx
call fcn.100178d0
add esp, 4
push esi
call fcn.10033810
add esp, 4
mov eax, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10033810
mov ecx, dword [ebp + 0x14]
add esp, 4
push 0x1004278c
call fcn.100203b0
cmp ebx, dword [ebp + 8]
je 0x1001810e
push ebx
call fcn.100178d0
add esp, 4
lea esp, [ebp - 0x10]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100189b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10041128
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x100189e8
push 0x20006
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10017910
add esp, 0xc
mov edi, eax
jmp 0x100189eb
mov edi, dword [ebp + 8]
test edi, edi
je 0x10018ad7
call fcn.1002ec00
test eax, eax
je 0x10018a6e
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10018a07
xor ebx, ebx
jmp 0x10018a37
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10007690
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push esi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp + 0x14]
push esi
call fcn.100068fe
add esp, 4
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10018ac9
cmp edi, dword [ebp + 8]
je 0x10018a67
push edi
call fcn.100178d0
add esp, 4
mov eax, 1
jmp 0x10018ad9
mov eax, dword [ebp + 0x14]
lea ecx, [ebp + 0x14]
push eax
call fcn.10019d90
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [ebp + 0x10]
push eax
push 1
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10018aba
cmp edi, dword [ebp + 8]
je 0x10018aa4
push edi
call fcn.100178d0
add esp, 4
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a630
mov eax, 1
jmp 0x10018ad9
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a630
cmp edi, dword [ebp + 8]
je 0x10018ad7
push edi
call fcn.100178d0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100192a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
je 0x100192c5
push 0x20019
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.10017880
add esp, 0xc
mov ebx, eax
jmp 0x100192c9
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebp
call fcn.10032665
cmp ebx, ebp
je 0x100193b3
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x2c]
push ebp
lea edx, [esp + 0x24]
push ecx
push edx
push ebp
push ebp
push ebp
push ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x100193a4
cmp dword [esp + 0xc], ebp
jbe 0x100193a4
mov eax, dword [esp + 0x18]
cmp eax, 0x104
jae 0x10019325
mov eax, 0x104
mov dword [esp + 0x18], eax
inc eax
push eax
call fcn.100337e7
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x100193a4
cmp dword [esp + 0xc], ebp
jbe 0x10019380
push edi
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10019376
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [ecx + 8]
push edx
call fcn.1003287b
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jb 0x1001933c
pop edi
push esi
call fcn.10033810
mov eax, dword [esp + 0x18]
add esp, 4
cmp ebx, eax
je 0x1001939a
push ebx
call fcn.100178d0
add esp, 4
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp ebx, dword [esp + 0x14]
je 0x100193b3
push ebx
call fcn.100178d0
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret