joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013870
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x80
xor bl, bl
mov dword [ebp - 0x808], 0x80
mov dword [ebp - 0x810], 0x400
call sym.vmtools.dll_UtilSafeMalloc0
add esp, 4
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x808]
push edx
push eax
push str.__vmware__
push 0
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x10013918
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.W32Util_GetVMwareGroupSid
push str._s:_LookupAccountNameW:__d_n
call sym.vmtools.dll_Log
mov eax, dword [esi]
add esp, 0xc
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov dword [esi], 0
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x80c], 4
je 0x10013932
push str.VMware_User_Group
push str.W32Util_GetVMwareGroupSid
push str._s:_Bad_account_type_for__S_group_n
jmp 0x100138ec
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
Function at 0x10013fd0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 1], al
mov dword [esi], eax
cmp dword [ebp + 0xc], eax
jne 0x10014042
lea esi, [ebp - 0xc]
call fcn.10013f70
test al, al
jne 0x10014038
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_check_for_linked_token:__d_n
push 0
call sym.vmtools.dll_Str_Asprintf
push 0
mov esi, eax
push 0xffffffffffffffff
push esi
call sym.vmtools.dll_Unicode_AllocWithLength
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call edi
add esp, 0x1c
jmp 0x10014116
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x10014047
mov eax, ebx
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x10014066
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_get_impersonation_token:__d_n
jmp 0x10014015
lea edx, [ebp - 0x10]
push edx
call fcn.100137a0
add esp, 4
test al, al
jne 0x10014084
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_look_up_Admin_group:__d_n
jmp 0x10014015
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push esi
push edx
push eax
call ebx
test eax, eax
jne 0x100140aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_check_Admin_group_membership:__d_n
jmp 0x10014015
cmp dword [esi], 0
jne 0x10014112
lea edx, [ebp - 0x14]
push edx
call fcn.10013870
add esp, 4
test al, al
jne 0x100140f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VMware_User_Group
push str.Cant_look_up__S_group:__d_n
push 0
call sym.vmtools.dll_Str_Asprintf
push 0
mov esi, eax
push 0xffffffffffffffff
push esi
call sym.vmtools.dll_Unicode_AllocWithLength
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call edi
add esp, 0x20
jmp 0x10014116
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push esi
push edx
push eax
call ebx
test eax, eax
jne 0x10014112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VMware_User_Group
push str.Unable_to_check__S_group_membership:__d_n
jmp 0x100140d0
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x10]
push edx
call edi
mov eax, dword [ebp - 0x14]
push eax
call edi
mov eax, dword [ebp - 8]
add esp, 8
pop edi
pop esi
pop ebx
test eax, eax
je 0x10014136
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x10014140
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, eax
xor eax, eax
push eax
push eax
push 1
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10014171
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x1001418a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1001419b
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
push ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
jne 0x1001421a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1001421a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001420a
cmp eax, 0x102
jne 0x1001421a
push edi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
test esi, esi
jne 0x1001421a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e3
jne 0x1001421a
push 0x102
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push ebx
lea ecx, [ebp - 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100155c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea edx, [esi + 2]
mov bl, 1
push edi
mov dword [ebp - 4], ecx
mov byte [ebp + 0x13], bl
cmp edx, esi
jb 0x100156f4
mov eax, dword [ebp + 0x14]
cmp eax, 1
jb 0x100156f4
lea edi, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edi, 2
shr edx, 1
cmp edx, edi
ja 0x100156f4
cmp esi, 2
jbe 0x1001568d
lea edx, [esi - 3]
mov eax, 0xaaaaaaab
mul edx
mov eax, dword [ebp + 8]
mov edi, edx
shr edi, 1
inc edi
mov edi, edi
movzx edx, byte [eax]
shr edx, 2
movzx edx, byte [edx + 0x10063fd0]
mov byte [ecx], dl
movzx edx, byte [eax]
movzx ebx, byte [eax + 1]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
movzx edx, byte [edx + 0x10063fd0]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
movzx ebx, byte [eax + 2]
and edx, 0xf
add edx, edx
add edx, edx
shr ebx, 6
or edx, ebx
movzx edx, byte [edx + 0x10063fd0]
mov byte [ecx + 2], dl
movzx edx, byte [eax + 2]
and edx, 0x3f
movzx edx, byte [edx + 0x10063fd0]
mov byte [ecx + 3], dl
sub esi, 3
add eax, 3
add ecx, 4
sub edi, 1
jne 0x10015620
mov bl, byte [ebp + 0x13]
jmp 0x10015690
mov eax, dword [ebp + 8]
mov edx, esi
dec esi
test edx, edx
je 0x100156ef
test esi, esi
je 0x100156a0
mov dl, byte [eax + 1]
jmp 0x100156a2
xor dl, dl
movzx edi, byte [eax]
shr edi, 2
mov bl, byte [edi + 0x10063fd0]
mov byte [ecx], bl
movzx eax, byte [eax]
movzx edx, dl
and eax, 3
shl eax, 4
mov edi, edx
shr edi, 4
or eax, edi
mov al, byte [eax + 0x10063fd0]
mov byte [ecx + 1], al
test esi, esi
je 0x100156dd
and edx, 0xf
movsx eax, byte [edx*4 + 0x10063fd0]
jmp 0x100156e2
mov eax, 0x3d
mov bl, byte [ebp + 0x13]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov byte [ecx], 0
jmp 0x100156f6
xor bl, bl
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10015702
sub ecx, dword [ebp - 4]
mov dword [eax], ecx
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015be0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_free]
push esi
push edi
mov edi, dword [0x1008cedc]
test edi, edi
jne 0x10015c6f
push 4
call sym.vmtools.dll_UtilSafeMalloc0
add esp, 4
mov edi, eax
call fcn.10019fd0
test eax, eax
jne 0x10015c25
push str.Hostinfo_MachineID
push str._s_Hostinfo_HostName_failure__providing_default._n
call sym.vmtools.dll_Warning
add esp, 8
mov dword [edi], 0
jmp 0x10015c52
movzx ecx, byte [eax]
mov esi, eax
mov edx, 0x1505
test ecx, ecx
je 0x10015c4a
mov ebx, edx
shl ebx, 5
inc esi
add ebx, ecx
movzx ecx, byte [esi]
add edx, ebx
test ecx, ecx
jne 0x10015c33
mov ebx, dword [sym.imp.MSVCR90.dll_free]
push eax
mov dword [edi], edx
call ebx
add esp, 4
mov ecx, edi
mov edx, 0x1008cedc
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10015c6f
push edi
call ebx
mov edi, dword [0x1008cedc]
add esp, 4
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov esi, dword [0x1008cee0]
test esi, esi
jne 0x10015cd9
push 8
call sym.vmtools.dll_UtilSafeMalloc0
mov esi, eax
push esi
call fcn.10015880
add esp, 8
test eax, eax
je 0x10015cbc
push eax
call sym.vmtools.dll_Err_Errno2String
push eax
push str.Hostinfo_MachineID
push str._s_ObtainHardwareID_failure___s___providing_default._n
call sym.vmtools.dll_Warning
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
mov edx, esi
mov ecx, 0x1008cee0
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x10015cd9
push esi
call ebx
mov esi, dword [0x1008cee0]
add esp, 4
mov edx, dword [esi]
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], edx
mov ecx, dword [esi + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
pop ebp
ret

Function at 0x100161e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
push 4
mov edi, eax
push 0x10061d40
push edi
call dword [sym.imp.MSVCR90.dll_wcsncmp]
add esp, 0x14
test eax, eax
je 0x10016250
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016210
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x10016250
call dword [sym.imp.MSVCR90.dll__errno]
push 0xce
mov dword [eax], 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
or esi, 0xffffffff
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
push edi
call dword [sym.imp.MSVCR90.dll__wmkdir]
add esp, 4
push edi
mov esi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10016370
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ecx, dword [ebp + 0xc]
push 1
push ecx
mov edi, eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov esi, dword [sym.imp.MSVCR90.dll_wcsncmp]
push 4
push 0x10061d40
push edi
mov ebx, eax
call esi
add esp, 0x1c
test eax, eax
je 0x100163e2
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100163b0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x100163e2
call dword [sym.imp.MSVCR90.dll__errno]
push 0xce
mov dword [eax], 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x10016423
push 4
push 0x10061d40
push ebx
call esi
add esp, 0xc
test eax, eax
je 0x10016416
mov eax, ebx
lea edx, [eax + 2]
jmp 0x10016400
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016400
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x100163c6
push ebx
push edi
call dword [sym.imp.MSVCR90.dll__wrename]
add esp, 8
mov esi, eax
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
push ebx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x10016530
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100165ab
cmp byte [esi], 0
je 0x100165ab
mov ax, word [esi]
mov cl, byte [esi + 2]
movsx edx, al
push edi
mov edi, dword [sym.imp.MSVCR90.dll_strchr]
push edx
push 0x10061684
mov word [ebp + 8], ax
mov byte [ebp + 0xa], cl
mov byte [ebp + 0xb], 0
call edi
add esp, 8
test eax, eax
je 0x1001657d
movsx eax, byte [ebp + 9]
push eax
push 0x10061684
call edi
add esp, 8
test eax, eax
jne 0x10016591
lea ecx, [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
sete al
test al, al
je 0x1001659e
push esi
call sym.vmtools.dll_UtilSafeStrdup0
add esp, 4
pop edi
pop esi
pop ebp
ret
push esi
call fcn.10014e50
add esp, 4
pop edi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10016a20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10016960

Function at 0x10016a30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x6c
call sym.vmtools.dll_UtilSafeMalloc0
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x64]
add esp, 4
mov dword [ebp - 0x64], 0x95f24dab
mov dword [ebp - 0x60], 0xb685215
mov dword [ebp - 0x5c], 0xe76ccae7
mov dword [ebp - 0x58], 0xaf3ec239
mov dword [ebp - 0x54], 0x715fad23
mov dword [ebp - 0x50], 0x24a590ad
mov dword [ebp - 0x4c], 0x69e4b5ef
mov dword [ebp - 0x48], 0xbf456141
mov dword [ebp - 0x44], 0x96bc1b7b
mov dword [ebp - 0x40], 0xa7bdf825
mov dword [ebp - 0x3c], 0xc1de75b7
mov dword [ebp - 0x38], 0x8858a9c9
mov dword [ebp - 0x34], 0x2da87693
mov dword [ebp - 0x30], 0xb657f9dd
mov dword [ebp - 0x2c], 0xffdc8a9f
mov dword [ebp - 0x28], 0x8121da71
mov dword [ebp - 0x24], 0x8b823ecb
mov dword [ebp - 0x20], 0x885d05f5
mov dword [ebp - 0x1c], 0x4e20cd47
mov dword [ebp - 0x18], 0x5a9ad5d9
mov dword [ebp - 0x14], 0x512c0c03
mov dword [ebp - 0x10], 0xea857ccd
mov dword [ebp - 0xc], 0x4cc1d30f
mov dword [ebp - 8], 0x8891a8a1
mov dword [ebp - 4], 0xa6b7aadb
mov ecx, eax
sub edx, eax
mov esi, 0x19
mov ebx, dword [edx + ecx]
xor ebx, edi
mov dword [ecx], ebx
add ecx, 4
sub esi, 1
jne 0x10016b01
pop edi
pop esi
mov dword [eax + 0x64], 0x18
mov dword [eax + 0x68], 6
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017010
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push str.kernel32
call sym.vmtools.dll_Win32U_GetModuleHandle
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov esi, eax
push str.IsWow64Process
push esi
call edi
push str.GetNativeSystemInfo
push esi
mov ebx, eax
call edi
mov esi, eax
test ebx, ebx
je 0x10017069
test esi, esi
je 0x10017069
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x10017069
cmp dword [ebp - 4], 0
je 0x10017069
lea ecx, [ebp - 0x28]
push ecx
call esi
jmp 0x10017073
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x28]
pop edi
pop esi
pop ebx
cmp ax, 9
jne 0x10017089
mov eax, 0x40
mov esp, ebp
pop ebp
ret
movzx eax, ax
neg eax
sbb eax, eax
and eax, 0xffffffdf
add eax, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10019610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x10083481]
test al, al
jne 0x1001963f
mov eax, dword [0x1008cf60]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
push 0x9c
lea ecx, [ebp - 0xa0]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0xa0]
push edx
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10019688
mov dword [0x1008cf60], eax
mov byte [0x10083481], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x9c]
cmp eax, 5
jbe 0x1001969a
mov eax, 8
jmp 0x100196b1
jne 0x100196af
mov eax, dword [ebp - 0x98]
test eax, eax
ja 0x10019693
jne 0x100196af
cmp word [ebp - 0xc], 4
jae 0x10019693
xor eax, eax
mov dword [0x1008cf60], eax
mov byte [0x10083481], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x1001cd40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ecx, dword [ebp + 8]
add esp, 8
mov esi, eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x1001cd80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov esi, dword [ebp + 0x14]
add esp, 8
mov edi, eax
test esi, esi
jbe 0x1001cdc4
cmp esi, 2
jbe 0x1001cdaa
cmp esi, 7
jne 0x1001cdc4
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x18]
lea edx, [ebp - 4]
push edx
push eax
push ecx
call sym.vmtools.dll_CodeSet_Utf8ToUtf16le
add esp, 0x10
jmp 0x1001cdd0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
push esi
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp esi, 1
je 0x1001cdf9
cmp esi, 2
je 0x1001cdf9
cmp esi, 7
jne 0x1001ce06
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ce20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x418], ecx
xor ecx, ecx
push 0x1fc
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x24]
push ecx
lea edx, [ebp - 0x202]
push edx
mov dword [ebp - 0x414], eax
mov word [ebp - 0x204], cx
call sub.MSVCR90.dll_memset
xor eax, eax
push 0x1fc
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x40c], 0xff
mov word [ebp - 0x404], ax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x414]
add esp, 0x18
push edx
neg eax
sbb eax, eax
lea ecx, [ebp - 0x408]
and eax, ecx
push eax
mov edx, esi
neg edx
sbb edx, edx
lea eax, [ebp - 0x404]
and edx, eax
mov eax, dword [ebp + 0xc]
push edx
push edi
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x204]
push edx
push eax
push ebx
mov dword [ebp - 0x408], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x1001cf55
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x40c]
mov edi, dword [ebp - 0x41c]
push ecx
lea eax, [ebp - 0x204]
add edx, edx
push eax
call fcn.1001ca10
add esp, 8
test al, al
jne 0x1001cf26
mov ebx, 0xea
test esi, esi
je 0x1001cf53
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x408]
push ecx
lea eax, [ebp - 0x404]
add edx, edx
push eax
mov edi, esi
call fcn.1001ca10
add esp, 8
test al, al
mov eax, 0xea
je 0x1001cf55
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
Function at 0x1001cf70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 2
xor ebx, ebx
push 0x4000
mov dword [ebp - 8], 0x4000
mov dword [ebp - 4], ebx
call sym.vmtools.dll_UtilSafeCalloc0
add esp, 8
mov edi, eax
mov dword [ebp - 0x10], edi
cmp dword [ebp + 0x20], ebx
je 0x1001cfb3
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
add eax, eax
push eax
mov dword [ebp - 4], eax
call sym.vmtools.dll_UtilSafeMalloc0
add esp, 4
mov ebx, eax
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
je 0x1001cffb
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
push ecx
push edi
mov edi, dword [ebp + 0x10]
add edx, edx
call fcn.1001ca10
add esp, 8
test al, al
jne 0x1001cffb
mov esi, 0xea
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp + 0x20]
mov eax, esi
mov esi, dword [ebp + 0x24]
push ebx
call fcn.1001ca90
mov esi, eax
mov eax, dword [ebp + 0x1c]
add esp, 8
test eax, eax
je 0x1001d021
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.MSVCR90.dll_free]
push edx
call edi
push ebx
call edi
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001d040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
mov ebx, dword [ebp + 0x18]
xor edi, edi
add esp, 8
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x1001d080
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
add eax, eax
mov dword [ebp - 4], eax
add eax, 2
push eax
call sym.vmtools.dll_UtilSafeMalloc0
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push edi
lea eax, [ebp - 8]
push eax
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test edi, edi
je 0x1001d0bd
test esi, esi
jne 0x1001d0bd
cmp dword [ebp - 8], 1
jne 0x1001d0bd
mov ecx, dword [ebp - 4]
push 1
push edi
mov word [ecx + edi], ax
call sym.vmtools.dll_Unicode_LengthInBytes
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push edx
mov eax, esi
mov esi, dword [ebp + 0x1c]
push edi
mov edx, ebx
call fcn.1001ca90
mov esi, eax
mov eax, dword [ebp + 0x14]
add esp, 8
test eax, eax
je 0x1001d0e2
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov ebx, dword [sym.imp.MSVCR90.dll_free]
push edx
call ebx
push edi
call ebx
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret