joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d7fd
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x1021360]
mov esi, 0x1021360
cmp eax, esi
je 0x100d839
test dword [eax + 0x1c], 0x20000000
je 0x100d839
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1002528
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100d5d4
push 1
push 0x35
push 0x100257c
lea ecx, [ebp - 0x2c]
call fcn.0100c063
xor edi, edi
push 0x40
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
pop eax
cmp dword [ebp + 8], edi
jne 0x100d86a
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x100d9e1
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0xc]
push 0x41
cmp eax, edi
jne 0x100d87a
pop eax
jmp 0x100d85a
pop ecx
mov word [ebp - 0x28], cx
push 0x42
cmp dword [ebp + 0x10], edi
jbe 0x100d877
pop ecx
mov word [ebp - 0x28], cx
xor ecx, ecx
mov dword [ebp - 0x2c], edi
mov word [eax], cx
mov dword [ebp - 4], 0x105
push ebx
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov ebx, eax
push 0x4d
mov dword [ebp - 8], ebx
pop eax
cmp ebx, edi
je 0x100d90a
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x2c], edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, edi
jne 0x100d958
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100d8e8
cmp eax, 0xea
jne 0x100d8ea
xor eax, eax
cmp eax, edi
jle 0x100d8f8
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, edi
push 0x57
mov dword [ebp - 0x2c], ecx
pop eax
jl 0x100d91a
mov word [ebp - 0x28], ax
jmp 0x100d89b
mov dword [ebp - 0x2c], 0x8007000e
mov word [ebp - 0x26], ax
jmp 0x100d9e0
mov word [ebp - 0x26], ax
mov eax, dword [0x1021360]
cmp eax, esi
je 0x100d9e0
test dword [eax + 0x1c], 0x2000000
je 0x100d9e0
push ecx
push dword [ebp + 8]
push 0x1001bd8
push 0x1002528
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e84
jmp 0x100d9e0
or edi, 0xffffffff
cmp word [ebx], 0
mov ecx, ebx
je 0x100d98d
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100d968
sub eax, esi
sar eax, 1
cmp eax, edi
jae 0x100d97e
mov edi, eax
mov ebx, ecx
lea ecx, [ecx + eax*2 + 2]
cmp word [ecx], 0
jne 0x100d963
mov esi, 0x1021360
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100bd67
push 0x70
mov dword [ebp - 0x2c], eax
test eax, eax
pop eax
jge 0x100d9dc
mov word [ebp - 0x26], ax
mov eax, dword [0x1021360]
cmp eax, esi
je 0x100d9e0
test dword [eax + 0x1c], 0x2000000
je 0x100d9e0
push dword [ebp - 0x2c]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push 0x100253c
push 0x1002528
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100d64d
jmp 0x100d9e0
mov word [ebp - 0x28], ax
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x100dd12
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push 2
push 0x21
push 0x1002698
lea ecx, [ebp - 0x30]
call fcn.0100c063
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x100dd41
mov dword [ebx], esi
push 0x2a
pop eax
cmp dword [ebp + 0xc], esi
jne 0x100dd59
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x100de06
push 0x2b
mov word [ebp - 0x2c], ax
pop eax
cmp ebx, esi
je 0x100dd49
mov word [ebp - 0x2c], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], esi
je 0x100dda0
cmp eax, 2
jne 0x100dda0
mov dword [ebp - 0x30], 1
push 0x31
jmp 0x100de01
cmp eax, esi
jle 0x100ddae
and eax, 0xffff
or eax, 0x80070000
push 0x34
mov dword [ebp - 0x30], eax
cmp eax, esi
pop eax
jge 0x100ddc5
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x28], 1
jmp 0x100de06
cmp dword [ebp - 8], 4
push 0x36
mov word [ebp - 0x2c], ax
pop eax
je 0x100ddde
mov dword [ebp - 0x30], 0x8007065d
jmp 0x100dd50
cmp dword [ebp - 4], 4
mov word [ebp - 0x2c], ax
je 0x100ddf7
push 0x37
mov dword [ebp - 0x30], 0x80004005
pop eax
jmp 0x100dd50
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x30], esi
push 0x3b
pop eax
mov word [ebp - 0x2c], ax
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.0100c22a
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100de1e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 2
push 0x9c
push 0x10026a8
lea ecx, [ebp - 0x2c]
call fcn.0100c063
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
mov eax, 0xa3
cmp esi, edi
jne 0x100de64
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x100df8c
mov word [ebp - 0x28], ax
mov eax, 0xa4
cmp dword [ebp + 8], edi
je 0x100de54
push 0x20
pop edx
mov ecx, esi
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x28], ax
call fcn.0100e961
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov eax, 0xa9
jl 0x100de5b
mov word [ebp - 0x28], ax
mov eax, dword [esi + 8]
push ebx
lea eax, [eax + eax - 2]
mov dword [ebp - 4], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100df01
cmp ebx, 0xea
jne 0x100df68
mov edx, dword [ebp - 4]
and dword [ebp - 0x2c], 0
add edx, 3
lea eax, [ebx - 0x2b]
shr edx, 1
mov ecx, esi
mov word [ebp - 0x28], ax
call fcn.0100e961
mov dword [ebp - 0x2c], eax
test eax, eax
lea eax, [ebx - 0x24]
jl 0x100df87
mov word [ebp - 0x28], ax
mov eax, dword [esi + 8]
lea eax, [eax + eax - 2]
mov dword [ebp - 4], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov edx, dword [esi + 8]
mov ecx, esi
mov ebx, eax
call fcn.0100e6d2
test ebx, ebx
jne 0x100deb2
cmp dword [ebp - 8], 1
je 0x100df33
cmp dword [ebp - 8], 2
je 0x100df33
mov dword [ebp - 0x2c], 0x8000ffff
mov eax, 0xc9
jmp 0x100df87
mov edx, dword [ebp - 4]
mov eax, 0xc9
mov word [ebp - 0x28], ax
mov al, dl
not al
test al, 1
mov eax, 0xd5
jne 0x100df55
mov dword [ebp - 0x2c], 0x8000ffff
jmp 0x100df87
and dword [ebp - 0x2c], 0
shr edx, 1
mov ecx, esi
mov word [ebp - 0x28], ax
call fcn.0100e6d2
jmp 0x100df8b
test ebx, ebx
jle 0x100df78
and ebx, 0xffff
or ebx, 0x80070000
mov dword [ebp - 0x2c], ebx
mov eax, 0xbf
mov dword [ebp - 0x24], 1
mov word [ebp - 0x26], ax
pop ebx
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x100dfa4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 2
push 0x150
push 0x10026b8
lea ecx, [ebp - 0x24]
call fcn.0100c063
xor esi, esi
mov eax, 0x152
cmp dword [ebp + 8], esi
jne 0x100dfda
mov dword [ebp - 0x24], 0x80070057
mov word [ebp - 0x1e], ax
jmp 0x100e022
mov word [ebp - 0x20], ax
mov eax, 0x153
cmp dword [ebp + 0xc], esi
je 0x100dfcd
push 4
mov word [ebp - 0x20], ax
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jle 0x100e012
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x24], eax
cmp eax, esi
mov eax, 0x155
jl 0x100dfd4
mov word [ebp - 0x20], ax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.0100c22a
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x100f73a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1021480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100f773
test dword [eax + 0x1c], 0x20000000
je 0x100f773
push 0x1002b3c
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009101
push esi
xor esi, esi
inc esi
push esi
push 0x8a
push 0x1002bb8
lea ecx, [ebp - 0x3c]
call fcn.0100c063
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x5a
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x100f7a5
mov eax, 0x9c
jmp 0x100f7bb
cmp dword [ebp - 8], 2
jne 0x100f7b6
and dword [ebp - 0x3c], 0
mov eax, 0xa1
jmp 0x100f7be
mov eax, 0xa4
mov dword [ebp - 0x3c], esi
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x38], ax
call fcn.0100c22a
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100b7c7
leave
ret
Function at 0x1011377
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x10113a6
test dword [eax + 0x1c], 0x20000000
je 0x10113a6
push 0x1002b3c
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009101
push esi
push edi
push 1
push 0x1f0
push 0x1002fd4
lea ecx, [ebp - 0x30]
call fcn.0100c063
xor edi, edi
mov dword [ebp - 0xc], 0x1002828
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x1011420
mov ecx, dword [ebp + 8]
call fcn.0100e6bb
mov eax, 0x1f7
mov edx, 0x104
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x30], edi
mov word [ebp - 0x2c], ax
call fcn.0100e961
mov dword [ebp - 0x30], eax
cmp eax, edi
mov eax, 0x1f9
jl 0x101142c
mov word [ebp - 0x2c], ax
call fcn.0100d588
test eax, eax
je 0x1011446
push dword [ebp + 8]
call fcn.01011047
cmp eax, edi
mov dword [ebp - 0x30], eax
jge 0x1011435
mov eax, 0x205
jmp 0x101142c
mov dword [ebp - 0x30], 0x80070057
mov eax, 0x1f7
mov word [ebp - 0x2a], ax
jmp 0x10114df
mov eax, 0x206
mov dword [ebp - 0x30], edi
mov word [ebp - 0x2c], ax
jmp 0x10114df
mov esi, 0x211
push ebx
lea ebx, [esi + 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
jbe 0x1011489
mov edx, dword [ebp - 4]
mov ecx, esi
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0xc]
cmp eax, edx
jb 0x1011497
lea edx, [eax + 1]
call fcn.0100e961
cmp eax, edi
mov dword [ebp - 0x30], eax
jl 0x10114da
mov eax, ebx
mov word [ebp - 0x2c], ax
jmp 0x101144f
call fcn.0100d43e
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2a], si
jmp 0x10114de
call fcn.0100e6d2
push 0x5c
pop edx
lea ecx, [ebp - 0xc]
call fcn.0100f1ba
mov dword [ebp - 0x30], eax
cmp eax, edi
mov eax, 0x21c
jl 0x10114ce
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov word [ebp - 0x2c], ax
call fcn.0100f210
mov dword [ebp - 0x30], eax
cmp eax, edi
mov eax, 0x21e
jge 0x10114d4
mov word [ebp - 0x2a], ax
jmp 0x10114de
mov word [ebp - 0x2c], ax
jmp 0x10114de
mov word [ebp - 0x2a], bx
pop ebx
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0xc]
call fcn.0100e697
lea ecx, [ebp - 0x30]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x1013f81
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x1013fb0
test dword [eax + 0x1c], 0x20000000
je 0x1013fb0
push 0x1002b3c
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009101
push ebx
push esi
push 1
push 0x47f
push 0x10032c4
lea ecx, [ebp - 0x28]
call fcn.0100c063
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov ecx, 0x486
cmp dword [ebp + 0xc], ebx
jne 0x1013fe7
mov dword [ebp - 0x28], 0x80070057
mov word [ebp - 0x22], cx
jmp 0x1014102
push edi
mov edi, dword [ebp + 0x10]
mov word [ebp - 0x24], cx
mov ecx, 0x487
cmp edi, ebx
je 0x1014009
mov word [ebp - 0x24], cx
mov ecx, dword [ebp + 0x1c]
cmp dword [ebp + 0x18], ecx
jbe 0x1014019
mov ecx, 0x488
mov dword [ebp - 0x28], 0x80070057
mov word [ebp - 0x22], cx
jmp 0x1014101
mov esi, dword [ebp + 8]
mov eax, 0x488
mov word [ebp - 0x24], ax
lea eax, [esi + 4]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 0xc]
mov dword [esi + 0x40], edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi + 0x24], 1
call edi
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x101405a
push eax
mov dword [esi + 0x28], ebx
call fcn.010095c0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x38], eax
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x1014081
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x1014091
mov dword [esi + 0x44], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp + 0x20]
push esi
mov dword [esi + 0x44], eax
call edi
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x1012b84
push 0x8000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x1014125
call fcn.0100d43e
mov dword [ebp - 0x28], eax
mov eax, 0x4ab
mov word [ebp - 0x22], ax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10140df
push eax
mov dword [esi + 0x28], ebx
call fcn.010095c0
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x10140ef
mov dword [esi + 0x44], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
call fcn.01012ad1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
pop edi
mov esi, dword [ebp - 0x28]
cmp eax, ebx
je 0x1014115
cmp eax, 0xffffffff
je 0x1014115
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.0100c22a
mov eax, esi
pop esi
pop ebx
leave
ret 0x1c
mov eax, 0x4ab
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x24], ax
jmp 0x10140f5
Function at 0x1015a2c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01015f06
mov esi, eax
test esi, esi
jl 0x1015ad8
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1015a58
sub eax, ecx
push ebx
sar eax, 1
push edi
lea edi, [eax + eax + 2]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
lea ebx, [eax + edi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x1015a98
mov esi, 0xc000009a
jmp 0x1015ad6
mov dword [esi], 1
mov dword [esi + 8], 5
mov dword [esi + 4], ebx
mov eax, dword [ebp - 4]
push dword [eax + 8]
push eax
lea eax, [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push edi
push dword [ebp + 0x10]
lea eax, [eax + esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [eax], esi
xor esi, esi
pop edi
pop ebx
cmp dword [ebp - 4], 0
je 0x1015af5
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x1015bd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ecx, 0x101ebbe
xor esi, esi
mov eax, ecx
push edi
mov dword [ebp - 8], esi
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, si
jne 0x1015bea
mov edi, dword [ebp + 8]
sub eax, edx
sar eax, 1
mov ebx, eax
push ebx
push ecx
push edi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x1015d76
lea eax, [edi + ebx*2]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1015d76
mov ecx, dword fs:[0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub eax, edi
sar eax, 1
lea edi, [eax + eax]
lea eax, [edi + 2]
push eax
mov eax, dword [ecx + 0x30]
push 0
push dword [eax + 0x18]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jne 0x1015c5d
mov dword [ebp - 8], 0xc000009a
jmp 0x1015d32
push edi
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1015c76
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 0x16]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1015c8e
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x2e]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ecx, edi
push ecx
push 0
push dword [eax + 0x18]
mov dword [ebp + 8], ecx
call ebx
mov esi, eax
test esi, esi
je 0x1015c51
push dword [ebp + 8]
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ebx, [edi + esi]
mov dword [esi], 3
mov dword [esi + 0x14], edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1015cdc
push dword [ebp - 0xc]
sub eax, ecx
sar eax, 1
inc eax
push eax
lea eax, [esi + 0x18]
push eax
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [ebp - 4]
add esp, 0xc
push 2
pop edx
mov dword [ebx], edx
lea ecx, [eax + 2]
mov di, word [eax]
add eax, edx
test di, di
jne 0x1015d06
push dword [ebp - 4]
sub eax, ecx
sar eax, 1
inc eax
push eax
add ebx, 0x14
push ebx
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], ecx
cmp dword [ebp - 4], 0
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x1015d51
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
cmp dword [ebp - 8], 0
jge 0x1015d6c
test esi, esi
je 0x1015d6c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 8], 0xc000000d
jmp 0x1015d6c
Function at 0x1016ec0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
push edi
push 2
xor esi, esi
pop edi
xor edx, edx
xor ebx, ebx
mov dword [ebp - 4], esi
cmp ecx, edi
jne 0x1016eeb
lea ecx, [eax + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
jmp 0x1016ef9
cmp ecx, 6
jne 0x1016f0e
lea ecx, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ecx
add ecx, 0x10
mov dword [ebp + 8], ecx
mov ecx, dword [ecx]
cmp ecx, esi
je 0x1016ff5
cmp ecx, 6
je 0x1016f18
mov esi, 0xc000000d
jmp 0x1017048
push 0x38
lea ecx, [eax + 0x38]
mov eax, dword [eax + 8]
pop edx
mov dword [ebp - 0x18], edx
cmp eax, 0x5c
jb 0x1016f0e
mov ebx, dword [ecx + 8]
add ebx, edx
cmp eax, ebx
jb 0x1016f0e
cmp dword [ecx], esi
jne 0x1016f0e
cmp dword [ecx + 0x10], 5
jne 0x1016f0e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push ecx
call fcn.01016a04
mov esi, eax
test esi, esi
jl 0x101702b
cmp dword [ebp - 8], 0x2e
jb 0x1017051
mov ebx, dword [ebp - 4]
cmp dword [ebx], 3
jne 0x1017051
mov eax, dword [ebx + 0x14]
add eax, ebx
cmp dword [eax], edi
jne 0x1017051
add eax, 0x14
mov dword [ebp - 0x14], eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, edi
test cx, cx
jne 0x1016f82
sub eax, edx
sar eax, 1
add ebx, 0x18
lea esi, [eax + eax]
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, edi
test dx, dx
jne 0x1016f9b
sub eax, ecx
sar eax, 1
lea edi, [eax + eax + 2]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [edi + esi]
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1016fd3
mov esi, 0xc0000017
jmp 0x101702b
push esi
push dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 8]
push edi
add esi, eax
push ebx
push esi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 8]
add esp, 0x18
xor esi, esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1017001
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101700d
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1017019
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1017022
mov dword [eax], edx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x101702b
mov dword [eax], ebx
cmp dword [ebp - 4], 0
je 0x1017048
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, 0xc000000d
jmp 0x101702b
Function at 0x101742e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [ebp + 0x10], 1
je 0x101744b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.010158da
pop ebp
ret 0x14
test byte [ebp + 0x10], 2
je 0x1017461
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.010159b2
jmp 0x1017447
pop ebp
jmp fcn.01016a04

Function at 0x1017a48
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.010197d8
Function at 0x1018a7a
Capabilities:
Access peb ldr_data
Query or enumerate registry key

Disassembly:
push 0x14
push 0x101f578
call fcn.0100b984
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000023
je 0x1018abd
cmp eax, ebx
jl 0x1018b36
mov dword [ebp - 0x1c], 0xc000000d
jmp 0x1018b36
mov eax, dword fs:[0x18]
push dword [ebp - 0x20]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x1018ae2
mov dword [ebp - 0x1c], 0xc000009a
jmp 0x1018b36
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push esi
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x1018b36
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0xc]
inc ecx
inc ecx
push ecx
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
je 0x1018ad9
push dword [esi + 0xc]
lea eax, [esi + 0x10]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0xc]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
cmp esi, ebx
je 0x1018b4e
mov eax, dword fs:[0x18]
push esi
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x1c], 0xc000017d
jne 0x1018b89
mov dword [ebp - 4], ebx
int3
mov eax, dword [ebp - 0x1c]
call fcn.0100b9c9
ret 8