joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d59d
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x1012e5e7
call fcn.10123c44
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x1016aee4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10099432
xor ebx, ebx
mov dword [esi], vtable.WinInterAppStream.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1008988d
lea eax, [esi + 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100898fe
pop ecx
pop ecx
push eax
call fcn.100898fe
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.MSVCR120.dll_memset
push edi
mov ecx, ebx
call fcn.1009d663
add esp, 0x18
test al, al
je 0x1009d610
cmp dword [esi + 0x5a], ebx
cmovne ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
mov byte [ebp - 4], bl
call fcn.100898c9
mov eax, esi
call fcn.10123c12
ret 8

Function at 0x1009d78d
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x1012e635
call fcn.10123c44
mov esi, ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.1007e048
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.1008975f
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push dword [eax + 8]
push dword [eax + 4]
call fcn.10089db4
push 0
xor ecx, ecx
lea eax, [esi + 0x56]
cmp dword [esi + 0x5a], ecx
push 0x80
push 3
cmovne ecx, eax
push ecx
push ebx
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp - 0x10], 0
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1009d828
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0
push ecx
push dword [edi + 8]
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1009d828
mov eax, dword [edi + 8]
cmp dword [ebp - 0x10], eax
je 0x1009d82a
xor bl, bl
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.100898c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1007e178
mov al, bl
call fcn.10123c12
ret 8
Function at 0x1009d8fd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, 0x8001
xor ecx, ecx
cmp byte [ebp + 0xc], cl
push esi
cmovne eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String___thiscall_ScCore::FileSpec::getPath_void_]
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.1007b0bd
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
lea ecx, [ebp + 0xc]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebx + 8]
mov eax, dword [eax]
test eax, eax
jne 0x1009d955
push 0x34
pop eax
jmp 0x1009d9b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ESInitialize
push eax
call esi
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 8]
push str.ESTerminate
push dword [eax]
call esi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 8]
push str.ESFreeMem
push dword [eax]
call esi
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
push str.ESGetVersion
push dword [eax]
call esi
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 8]
push str.ESClientInterface
push dword [eax]
call esi
mov ecx, dword [ebx + 8]
push str.ESMallocMem
mov dword [ebx + 0x1c], eax
push dword [ecx]
call esi
mov dword [ebx + 0x20], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1009f83c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x107ad634]
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x1009f966
push ebx
push esi
xor ebx, ebx
mov byte [0x107ad69c], 1
push ebx
push ebx
push 5
mov byte [0x107ad69d], bl
call fcn.1009f73e
add esp, 0xc
test al, al
je 0x1009f8aa
push ebx
push 1
push 5
mov byte [0x107ad69c], 2
call fcn.1009f73e
movzx ecx, byte [0x107ad69c]
add esp, 0xc
test al, al
push 3
pop edx
cmovne ecx, edx
mov byte [0x107ad69c], cl
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x1014006c
call esi
push str.E3_REPLACE_RENDERWINDOW
mov dword [0x107ad624], eax
call esi
push str.E3_INIT_PICK
mov dword [0x107ad628], eax
call esi
push str.E3_REFINED
mov dword [0x107ad62c], eax
call esi
mov dword [0x107ad630], eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x814]
mov dword [0x1016b000], eax
call fcn.1009fcf3
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push ebx
push eax
call sub.MSVCR120.dll_memset
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x107ad690]
call fcn.1009fe9c
lea eax, [ebp - 0x804]
push eax
call fcn.1009f7ff
lea eax, [ebp - 0x804]
push str.language.eng
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy]
push ebx
push ebx
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.1009f980
mov eax, dword [0x107ad634]
add esp, 0x34
pop esi
pop ebx
mov ecx, dword [ebp - 4]
inc eax
mov dword [0x107ad634], eax
xor ecx, ebp
mov eax, dword [0x107ad68c]
pop edi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret
Function at 0x1009ff23
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107ad69c], 0
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], eax
je 0x1009ff59
push dword [ebp + 0x10]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1009ffd5
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
test ebx, ebx
jle 0x1009ffcf
push esi
cmp ebx, 0x104
jge 0x1009ff78
lea esi, [ebp - 0x108]
jmp 0x1009ff84
lea eax, [ebx + 1]
push eax
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
lea ecx, [ebx + 1]
mov byte [esi], 0
push ecx
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x1009ffb2
push dword [ebp + 0x10]
push edi
push esi
call sym.rt3d.dll_int___stdcall_AtoWex_char_const___unsigned_short_int___int_
push edi
call dword [sym.imp.MSVCR120.dll_wcslen]
pop ecx
mov edi, eax
jmp 0x1009ffb9
xor eax, eax
mov word [edi], ax
xor edi, edi
lea eax, [ebp - 0x108]
cmp esi, eax
je 0x1009ffca
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop esi
jmp 0x1009ffd4
xor eax, eax
mov word [edi], ax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a0adf
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push dword [0x107ad688]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a0b32
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x100a0b6c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a0b63
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x100a0bc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107ad69c], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
jne 0x100a0c2a
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push esi
push eax
push edi
call fcn.100e325d
add esp, 0x14
test eax, eax
je 0x100a0c23
push ebx
lea eax, [ebp - 0x108]
push eax
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
xor eax, eax
inc eax
jmp 0x100a0cc3
xor eax, eax
jmp 0x100a0cc3
lea ecx, [ebp - 0x508]
push ecx
push eax
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea eax, [ebp - 0x308]
push eax
push esi
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
xor esi, esi
mov dword [ebp - 0x50c], esi
test edi, edi
je 0x100a0cc1
lea eax, [ebp - 0x510]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x508]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a0cc1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x50c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x510]
call edi
test eax, eax
jne 0x100a0cb5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50c], eax
lea eax, [ebp - 0x50c]
push eax
push ebx
push esi
push esi
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x510]
call edi
inc esi
push dword [ebp - 0x510]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10123bfc
mov esp, ebp
pop ebp
ret
Function at 0x100a0cd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push dword [0x107ad688]
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xd4], 4
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0xcc]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a0de1
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
push edi
push dword [ebp - 0xcc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x100a0d73
cmp dword [ebp - 0xd0], 4
cmove esi, ecx
cmp dword [ebp - 0xd0], ecx
jne 0x100a0dcb
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x40
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0
push edi
push dword [ebp - 0xcc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a0dcb
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x48]
push 0x101323b0
push eax
call dword [sym.imp.MSVCR120.dll_sscanf]
xor ecx, ecx
add esp, 0xc
inc ecx
cmp eax, ecx
cmove esi, ecx
push dword [ebp - 0xcc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd8]
test esi, esi
jne 0x100a0de4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a0ef7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
push dword [0x107ad688]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], edi
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
xor ebx, ebx
test esi, esi
je 0x100a0f40
mov byte [esi], bl
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a0fbe
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x10c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x100a0fb2
cmp dword [ebp - 0x110], ebx
je 0x100a0fb2
test esi, esi
je 0x100a0fac
cmp dword [ebp + 0x14], ebx
je 0x100a0fac
lea eax, [ebp + 0x14]
push eax
push esi
push ebx
push ebx
push dword [ebp - 0x114]
push dword [ebp - 0x10c]
call edi
mov ebx, dword [ebp + 0x14]
jmp 0x100a0fb2
mov ebx, dword [ebp - 0x110]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10123bfc
mov esp, ebp
pop ebp
ret
Function at 0x100a102c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push dword [0x107ad688]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
mov eax, dword [0x1016af30]
xor esi, esi
add esp, 0x10
mov dword [ebp - 0x110], esi
test eax, eax
je 0x100a10bf
lea ecx, [ebp - 0x10c]
push ecx
push 0x20019
push esi
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a10bf
lea eax, [ebp - 0x110]
push eax
push esi
push esi
push esi
push edi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
test eax, eax
cmove esi, dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a10d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push ebx
push esi
push eax
push 0x20019
xor esi, esi
xor ebx, ebx
push esi
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a114a
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a113d
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
setl bl
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100a11ac
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a11ac
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x100a11a3
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp - 4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
setl bl
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a11b4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107ad69c], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x514], esi
mov dword [ebp - 0x50c], eax
jne 0x100a1219
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
call sym.rt3d.dll_int___stdcall_WtoAex_unsigned_short_int_const___char___int_
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x50c]
push ebx
push esi
call fcn.100e32d3
add esp, 0x10
jmp 0x100a12ab
lea eax, [ebp - 0x508]
push eax
push ebx
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x50c]
call sym.rt3d.dll_void___stdcall_AtoW_char_const___unsigned_short_int__
lea eax, [ebp - 0x518]
xor esi, esi
push eax
lea eax, [ebp - 0x510]
push eax
push esi
push 0xf003f
push esi
push 0x10131ee8
push esi
push ebx
push dword [ebp - 0x514]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a12a1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push esi
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x510]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x510]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a12a9
push 1
call fcn.100a0827
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a1358
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push dword [0x107ad688]
lea eax, [ebp - 0x84]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push 0xf003f
push esi
push 0x10131ee8
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a13ec
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push edi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x88]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret
Function at 0x100a145c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push dword [0x107ad688]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x110]
xor esi, esi
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push 0xf003f
push esi
push 0x10131ee8
push esi
lea eax, [ebp - 0x108]
push eax
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a14e6
push dword [ebp + 0x14]
push ebx
push 3
push esi
push edi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10123bfc
mov esp, ebp
pop ebp
ret

Function at 0x100a1559
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
xor ecx, ecx
push eax
lea eax, [ebp - 4]
mov esi, ecx
push eax
push ecx
push 0xf003f
push ecx
push 0x10131ee8
push ecx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a15b7
push dword [ebp + 0x10]
call sub.MSVCR120.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push 0x10131ee8
push eax
push dword [ebp + 8]
push dword [0x1016af30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a160f
push dword [ebp + 0x10]
call sub.MSVCR120.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e325d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
mov ebx, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
je 0x100e32cb
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100e32cb
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100e32c2
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
setl bl
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e32d3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push 0x10131ee8
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100e332d
push dword [ebp + 0x14]
call sub.MSVCR120.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e7831
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 0xc]
sub esp, 0x20
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], edi
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [eax + 0x58]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax + 0x38]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [eax + 0x18]
lea eax, [ebp - 0x130]
movsd qword [esp], xmm0
push eax
call fcn.100e73fc
push 8
mov esi, eax
lea eax, [ebp - 0x104]
pop ecx
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
call fcn.100e7f5e
fstp qword [ebp - 0x110]
xorps xmm0, xmm0
add esp, 0x30
comisd xmm0, xmmword [ebp - 0x110]
jbe 0x100e78fa
push 3
lea ecx, [ebp - 0x84]
pop edx
push 3
mov eax, ecx
pop esi
movsd xmm0, qword [eax]
xorpd xmm0, xmmword [0x10136a30]
movsd qword [eax], xmm0
lea eax, [eax + 8]
dec esi
jne 0x100e78d4
add ecx, 0x20
dec edx
jne 0x100e78cf
movsd xmm0, qword [0x101322d8]
jmp 0x100e7902
movsd xmm0, qword [0x10132290]
mov eax, dword [ebp - 0x108]
movsd qword [eax + 0x80], xmm0
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.100e745d
mov edi, dword [ebp - 0x108]
mov esi, eax
push 8
pop ecx
lea eax, [ebp - 0x84]
add edi, 0x20
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.100e8aa1
mov edi, dword [ebp - 0x108]
mov esi, eax
push 8
pop ecx
lea eax, [ebp - 0x84]
add edi, 0x60
push eax
lea eax, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.100e745d
mov edi, dword [ebp - 0x108]
add esp, 0x1c
add edi, 0x40
mov esi, eax
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x108]
mov esi, eax
add ecx, 0x60
lea eax, [ebp - 0x130]
push ecx
sub esp, 0x20
push 8
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.100e83af
add esp, 8
mov esi, eax
lea eax, [ebp - 0x130]
push 8
pop ecx
mov edi, esp
sub esp, 0x20
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x108]
push 8
pop ecx
mov edi, esp
add esi, 0x40
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.100e76e3
mov edi, dword [ebp - 0x108]
add esp, 0x44
add edi, 0x40
mov esi, eax
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10123bfc
mov esp, ebp
pop ebp
ret