joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4231d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4233c3
sub esp, 0x28
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408170
lea eax, [0x5337c4]
mov dword [esp], eax
call fcn.00412530
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
nop
lea ecx, [0x53383c]
mov dword [esp], ecx
call fcn.00408370
mov eax, dword [esp + 0x24]
mov byte [eax + 6], 1
lea edi, [eax + 8]
mov ecx, dword [0x54f3d0]
test ecx, ecx
jne 0x42323c
mov ecx, dword [esp + 0x30]
mov dword [eax + 8], ecx
jmp 0x423249
mov ecx, eax
mov eax, dword [esp + 0x30]
call fcn.00456430
mov eax, ecx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x54f3d0]
test ecx, ecx
jne 0x42326e
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 0x14], ecx
jmp 0x42328c
lea ecx, [eax + 0x10]
mov edi, ecx
mov ebx, eax
mov eax, dword [esp + 0x38]
call fcn.00456430
lea edi, [ebx + 0x14]
mov eax, dword [esp + 0x3c]
call fcn.00456430
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00422f20
movzx eax, byte [esp + 8]
test al, al
je 0x423375
mov eax, dword [0x54f25c]
test eax, eax
je 0x42336c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040d9f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0xc]
nop
inc dword [ecx + 0x78]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx + 0x54]
test byte [ebx], al
test byte [eax], al
mov dword [esp], edx
lea eax, [ebx + 0x954]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], eax
call fcn.00418fe0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 4
lea eax, [0x518220]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00418eb0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x42336c
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x42336c
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x40], 1
add esp, 0x28
ret
nop
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408170
nop
mov eax, dword [0x5337e0]
sub eax, dword [0x5337c4]
mov dword [0x5337e0], eax
mov eax, dword [0x5337d0]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov dword [0x5337d0], ecx
nop
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408370
mov byte [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00455030
jmp fcn.004231d0
Function at 0x423500
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42361c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x423595
cmp cl, 2
je 0x42353d
cmp cl, 3
jne 0x423605
mov byte [eax + 8], 1
jmp 0x423601
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00428a50
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408170
nop
mov eax, dword [0x533808]
sub eax, dword [0x5337ec]
mov dword [0x533808], eax
mov eax, dword [0x5337f8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5337f8], ecx
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408370
jmp 0x423601
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00411690
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408170
nop
mov eax, dword [0x5337e0]
sub eax, dword [0x5337c4]
mov dword [0x5337e0], eax
mov eax, dword [0x5337d0]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5337d0], ecx
nop
nop
lea eax, [0x53383c]
mov dword [esp], eax
call fcn.00408370
add esp, 0x14
ret
lea eax, [0x49c516]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00430980
nop
call fcn.00455030
jmp fcn.00423500
Function at 0x439eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.00439e50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.004349d0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x439f23
cmp dword [eax + 4], ecx
jae 0x439f51
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x43a080]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.00454f20
mov eax, dword [esp + 0xc]
movzx ecx, byte [0x533888]
test cl, cl
je 0x439f7e
lea eax, [0x4a4fc4]
mov dword [esp], eax
call fcn.00454f20
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439e50
lea eax, [0x529cbc]
mov dword [esp], eax
call fcn.00401c00
mov eax, dword [esp + 4]
test eax, eax
je 0x439fb6
lea eax, [0x4a4eb8]
mov dword [esp], eax
call fcn.00454f20
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439e50
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x1178]
test ecx, ecx
je 0x439ff2
lea eax, [0x4a4f84]
mov dword [esp], eax
call fcn.00454f20
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00439e50
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00401e00
mov eax, dword [0x529cb0]
test eax, eax
je 0x43a063
lea eax, [0x4a4eb4]
mov dword [esp], eax
call fcn.00454f20
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00439e50
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
Function at 0x440ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x440cce
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d50
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x52b380]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401c00
mov eax, dword [esp + 4]
test eax, eax
je 0x440cb3
mov eax, dword [esp + 0x1c]
lea ecx, [0x52b380]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00408170
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401c00
mov eax, dword [esp + 4]
test eax, eax
je 0x440ca1
mov eax, dword [esp + 0x1c]
lea ecx, [0x52b380]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.004410e0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x440bc4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d50
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00408370
mov eax, dword [esp + 0x24]
test eax, eax
je 0x440c9d
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x440c21
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.00453330
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x440cb7
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x440c5b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00440ce0
movzx eax, byte [esp + 4]
test al, al
je 0x440c57
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x440c5b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.00440750
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x440c9d
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x440c9d
lea eax, [0x4a4f18]
mov dword [esp], eax
call fcn.00454ec0
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00408370
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x4a019c]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00430980
nop
call fcn.00455030
jmp fcn.00440ad0
Function at 0x448180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x448303
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4482fb
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4481dc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4481dc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4481ef
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4482d0
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4482c2
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4482bb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x448246
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44828f
mov eax, 1
cmp eax, ecx
ja 0x44827d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00456520
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x4482b6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x448282
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44824b
call fcn.004564c0
xor eax, eax
call fcn.004564b0
call fcn.00456520
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x4482f6
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x4482c7
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x4481f4
call fcn.004564c0
xor eax, eax
call fcn.004564b0
nop
call fcn.00455030
jmp fcn.00448180
Function at 0x44f5c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44f65f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004565e7
lea ecx, [0x44f670]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00454f20
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00455030
jmp fcn.0044f5c0
Function at 0x4562f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x54f480]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x454abb
je 0x454b0e
cmp ebx, 0x20
jbe 0x454b14
cmp ebx, 0x40
jbe 0x454b5a
jmp 0x454bfb
test ebx, ebx
je 0x454b04
add eax, 0x10
test ax, 0xff0
je 0x454af0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4c4ba0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4c4ca0]
jmp 0x454ad8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x454ad8
pxor xmm1, xmmword [0x54f490]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x54f490]
pxor xmm2, xmmword [0x54f4a0]
pxor xmm3, xmmword [0x54f4b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x54f490]
pxor xmm2, xmmword [0x54f4a0]
pxor xmm3, xmmword [0x54f4b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x454c5a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x54f1cf], 0
je 0x45630a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x454a80
jmp fcn.00406db0
Function at 0x10016874
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001694a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x3303
mov dword [ebp - 0x20], 0x10007e78
cmp dword [ebp - 0xc], 0x349f
jle 0x100168fe
and dword [ebp - 4], 0
jmp 0x100168b6
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4a43
jge 0x100168f6
and dword [ebp - 8], 0
jmp 0x100168cc
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3d7
jge 0x100168f4
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x100168c5
jmp 0x100168af
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10016912
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x10016932
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10016932
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0xc], 0x30b3
jge 0x10016948
mov edx, dword [ebp - 0x20]
mov ecx, 0x1008fbf8
call fcn.1002574f
jmp 0x10016970
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x2599
push 0x7603
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
call fcn.10020da5
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10016bb9
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10016c18
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10016bef
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10016bed
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10016c16
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10016c16
push 0x4ddf
push 0x55f6
push 0
push 0xb0f
push 0
call fcn.100217f9
add esp, 0x14
jmp 0x10016c2a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 1
call fcn.10014beb
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001c67e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c6a3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
call fcn.1001c85f
pop ecx
pop ecx
jmp 0x1001c85b
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x153c
mov dword [ebp - 0x3c], 0x10008b60
cmp dword [ebp - 0x28], 0x17df
jle 0x1001c72a
and dword [ebp - 0x10], 0
jmp 0x1001c6cd
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x26e
jge 0x1001c72a
and dword [ebp - 8], 0
jmp 0x1001c6e3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4a74
jge 0x1001c728
and dword [ebp - 0xc], 0
jmp 0x1001c6f9
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x68d8
jge 0x1001c726
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1001c6f2
jmp 0x1001c6dc
jmp 0x1001c6c6
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001c837
mov byte [ebp - 1], 0
mov dword [ebp - 0x24], 0x6e72
mov dword [ebp - 0x38], 0x10008bb0
cmp dword [ebp - 0x24], 0x7009
jle 0x1001c810
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
and dword [ebp - 0x14], 0
jmp 0x1001c76e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3bf5
jge 0x1001c810
and dword [ebp - 0x18], 0
jmp 0x1001c788
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2bce
jge 0x1001c80b
and dword [ebp - 0x1c], 0
jmp 0x1001c79e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4c8
jge 0x1001c806
and dword [ebp - 0x20], 0
jmp 0x1001c7b4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x22b9
jge 0x1001c804
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov ecx, edx
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
and ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x64]
call fcn.100229d5
jmp 0x1001c7ad
jmp 0x1001c797
jmp 0x1001c781
jmp 0x1001c767
lea eax, [ebp - 1]
push eax
push 0
push 0x13d0
call fcn.1001bdca
add esp, 0xc
cmp dword [ebp - 0x24], 0x6d22
jge 0x1001c835
push dword [ebp - 0x38]
call fcn.10074e83
pop ecx
jmp 0x1001c845
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 0x28], 0x11ed
jge 0x1001c85b
mov edx, dword [ebp - 0x3c]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov esp, ebp
pop ebp
ret
Function at 0x10020a7e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10020b50
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10020aaf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10020b4b
mov dword [ebp - 0x1c], 0x490a
mov dword [ebp - 0x2c], 0x10009140
cmp dword [ebp - 0x1c], 0x4a7f
jle 0x10020b2f
and dword [ebp - 4], 0
jmp 0x10020ad3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x75f8
jge 0x10020b2f
and dword [ebp - 8], 0
jmp 0x10020ae9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5fe4
jge 0x10020b2d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar eax, cl
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x60]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x60]
call fcn.100229d5
jmp 0x10020ae2
jmp 0x10020acc
push 0
push 0
call dword [sym.imp.USER32.dll_RemovePropA]
cmp dword [ebp - 0x1c], 0x47e8
jge 0x10020b4b
push dword [ebp - 0x2c]
call fcn.10074e83
pop ecx
jmp 0x10020c3e
mov dword [ebp - 0x20], 0x4743
mov dword [ebp - 0x34], 0x10009160
cmp dword [ebp - 0x20], 0x4b06
jle 0x10020c1e
and dword [ebp - 0xc], 0
jmp 0x10020b78
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xf81
jge 0x10020c1e
and dword [ebp - 0x10], 0
jmp 0x10020b92
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2eb9
jge 0x10020c19
and dword [ebp - 0x14], 0
jmp 0x10020ba8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1ec8
jge 0x10020c14
and dword [ebp - 0x18], 0
jmp 0x10020bbe
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a29
jge 0x10020c12
mov dword [ebp - 0x38], 0x1008f5ec
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x78]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x78]
call fcn.100229d5
jmp 0x10020bb7
jmp 0x10020ba1
jmp 0x10020b8b
jmp 0x10020b71
push 0x1915
push 0
call fcn.10014beb
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0x4714
jge 0x10020c3e
push dword [ebp - 0x34]
call fcn.10074e83
pop ecx
mov esp, ebp
pop ebp
ret