joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c8da
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d62b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x81c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.005154cf
mov eax, dword [edi + 4]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.005154cf
mov eax, dword [edi + 0x14]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
lea eax, [edi + 0x1c]
push eax
call fcn.005154cf
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
call fcn.005154cf
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.005154cf
mov al, byte [edi + 0x28]
lea ecx, [esi + 0x2c]
mov byte [esi + 0x28], al
lea eax, [edi + 0x2c]
push eax
call fcn.005154cf
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call fcn.005154cf
mov eax, dword [edi + 0x34]
lea ecx, [esi + 0x44]
mov dword [esi + 0x34], eax
mov al, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
lea eax, [edi + 0x44]
push eax
call fcn.005154cf
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
call fcn.005154cf
mov eax, dword [edi + 0x4c]
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], eax
lea eax, [edi + 0x50]
push eax
call fcn.005154cf
lea eax, [edi + 0x54]
push eax
lea ecx, [esi + 0x54]
call fcn.005154cf
mov eax, dword [edi + 0x58]
lea ebx, [edi + 0x60]
mov dword [esi + 0x58], eax
mov al, byte [edi + 0x5c]
mov byte [esi + 0x5c], al
lea eax, [esi + 0x60]
cmp eax, ebx
je 0x61c9fc
mov ecx, eax
call fcn.0051a227
mov eax, dword [ebx]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x68], eax
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea eax, [edi + 0x6c]
push eax
lea ecx, [esi + 0x6c]
call fcn.005154cf
mov al, byte [edi + 0x70]
lea ecx, [esi + 0x74]
mov byte [esi + 0x70], al
lea eax, [edi + 0x74]
push eax
call fcn.005154cf
lea eax, [edi + 0x78]
push eax
lea ecx, [esi + 0x78]
call fcn.005bfcca
mov al, byte [edi + 0x84]
lea ecx, [esi + 0x88]
mov byte [esi + 0x84], al
lea eax, [edi + 0x88]
push eax
call fcn.005154cf
lea eax, [edi + 0x8c]
push eax
lea ecx, [esi + 0x8c]
call fcn.005154cf
lea eax, [edi + 0x90]
push eax
lea ecx, [esi + 0x90]
call fcn.005154cf
mov eax, dword [edi + 0x94]
lea ecx, [esi + 0x98]
mov dword [esi + 0x94], eax
lea eax, [edi + 0x98]
push eax
call fcn.005154cf
lea eax, [edi + 0x9c]
push eax
lea ecx, [esi + 0x9c]
call fcn.005154cf
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x61df07
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fb604
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x81c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
push 0x7725d4
mov dword [ebp - 0x14], eax
call fcn.0059de04
lea esi, [edi + 0x84]
mov ecx, esi
call fcn.005ab917
mov ecx, esi
call fcn.0054cac6
push str.CTcpConnections
lea ecx, [ebp - 0x20]
call fcn.0059de04
mov ecx, esi
call fcn.0054cb77
lea ecx, [edi + 0x3c]
call fcn.0061ded4
lea ecx, [edi + 0x30]
call fcn.0061fb70
lea ecx, [edi + 0x24]
call fcn.0061fd60
lea ecx, [edi + 0x18]
call fcn.00521aec
lea ecx, [edi + 0xc]
call fcn.00521aec
mov ecx, edi
call fcn.0052ed60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x61e0ab
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0x5e0
mov eax, 0x6fb61f
call fcn.00648bbe
mov edi, edx
mov esi, ecx
and dword [ebp - 4], 0
call fcn.006460e0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x5d8]
push 0x190
push 0
push eax
call fcn.0066f220
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x5ec]
lea ecx, [ebp - 0x5ec]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5e8]
push str._GetNameByIp_start
mov dword [ebp - 0x5e0], eax
call fcn.0059de04
lea eax, [ebp - 0x5d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x61e1ca
push str.GetNameByIp_WSAStartup
lea ecx, [ebp - 0x5ec]
call fcn.0059de04
push 2
pop ebx
push 0x6987
mov word [ebp - 0x448], bx
mov dword [ebp - 0x444], edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x446], ax
mov dword [ebp - 4], ebx
call fcn.006460e0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x34]
push 0xc
push 0x20
push eax
push 0x401
lea eax, [ebp - 0x438]
push eax
push 0x10
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x61e1a5
lea eax, [ebp - 0x438]
mov ecx, esi
push eax
call fcn.00519e64
jmp 0x61e1ba
mov edi, 0x741504
mov ecx, edi
call fcn.0051545a
push eax
push edi
mov ecx, esi
call fcn.00515b15
push str.GetNameByIp_getnameinfo
lea ecx, [ebp - 0x5ec]
call fcn.0059de04
call fcn.00648b0b
ret
Function at 0x62225f
Capabilities:
Initialize winsock library

Disassembly:
push 0x354
mov eax, 0x6fbe1a
call fcn.00648bbe
lea eax, [ebp - 0x314]
xor ebx, ebx
push eax
mov edi, 0x101
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
mov byte [ebp - 0x315], bl
call esi
test eax, eax
je 0x6222ba
lea eax, [ebp - 0x314]
push eax
push edi
call esi
push eax
push 0xd
push str.NetworkNewTreeNetworkShowMyIp.cpp
lea ecx, [ebp - 0x70]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0x70]
push eax
call fcn.00671426
push 0x38
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x360], 0x3c
push ebx
push eax
call fcn.0066f220
mov esi, dword [sym.imp.WS2_32.dll_WSALookupServiceBeginW]
lea eax, [ebp - 0x31c]
add esp, 0xc
mov dword [ebp - 0x34c], ebx
mov edi, 0xff1
push eax
push edi
lea eax, [ebp - 0x360]
push eax
call esi
test eax, eax
je 0x62232d
lea eax, [ebp - 0x31c]
push eax
push edi
lea eax, [ebp - 0x360]
push eax
call esi
push eax
push 0x15
push str.NetworkNewTreeNetworkShowMyIp.cpp
lea ecx, [ebp - 0xcc]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0xcc]
jmp 0x6222b4
mov edi, dword [sym.imp.WS2_32.dll_WSALookupServiceNextW]
cmp byte [ebp - 0x315], 0
jne 0x62241b
push ebx
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], ebx
push eax
push 0xff0
push dword [ebp - 0x31c]
call edi
cmp dword [ebp - 0x320], 0
je 0x62241b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x62241b
push dword [ebp - 0x320]
call fcn.006484f2
mov esi, eax
pop ecx
mov dword [ebp - 0x324], esi
push esi
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 1
push eax
push 0xff0
push dword [ebp - 0x31c]
call edi
cmp eax, 0x277e
je 0x62240c
cmp eax, 0x2776
je 0x62240c
test eax, eax
je 0x6223db
push eax
push 0x20
push str.NetworkNewTreeNetworkShowMyIp.cpp
lea ecx, [ebp - 0x128]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0x128]
jmp 0x6222b4
mov edx, dword [esi + 0x38]
mov ecx, ebx
test edx, edx
je 0x62240c
mov eax, dword [edx + 4]
test eax, eax
je 0x62240c
add eax, ecx
je 0x62240c
cmp dword [eax], 3
jne 0x6223fa
cmp dword [eax + 0x10], 2
je 0x622405
add ecx, dword [eax + 8]
cmp dword [eax + 8], 0
jne 0x6223e0
jmp 0x62240c
mov byte [ebp - 0x315], 1
push esi
mov byte [ebp - 4], bl
call fcn.006484ed
pop ecx
jmp 0x622333
push dword [ebp - 0x31c]
mov esi, dword [sym.imp.WS2_32.dll_WSALookupServiceEnd]
call esi
test eax, eax
je 0x62248c
push dword [ebp - 0x31c]
call esi
push eax
push 0x37
push str.NetworkNewTreeNetworkShowMyIp.cpp
lea ecx, [ebp - 0x184]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0x184]
jmp 0x6222b4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, byte [ebp - 0x315]
call fcn.00648b0b
ret
Function at 0x622c25
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ecx
push str.Wlanapi.dll
mov esi, ecx
call fcn.005a1d73
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
cmp dword [esi + 4], ebx
je 0x622d2f
push str.WlanOpenHandle
push dword [esi + 4]
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x622d2f
push str.WlanEnumInterfaces
push dword [esi + 4]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x622d2f
push str.WlanFreeMemory
push dword [esi + 4]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x622d2f
push str.WlanGetAvailableNetworkList
push dword [esi + 4]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x622d2f
push str.WlanScan
push dword [esi + 4]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x622d2f
push str.WlanCloseHandle
push dword [esi + 4]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x622d2f
push str.WlanGetProfile
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x622d2f
push str.WlanGetNetworkBssList
push dword [esi + 4]
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x622d2f
push str.WlanQueryInterface
push dword [esi + 4]
call edi
mov dword [esi + 0x28], eax
test eax, eax
je 0x622d2f
push str.WlanReasonCodeToString
push dword [esi + 4]
call edi
mov dword [esi + 0x2c], eax
test eax, eax
je 0x622d2f
push str.WlanGetNetworkBssList
push dword [esi + 4]
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x622d2f
inc ebx
push str.WlanRegisterNotification
push dword [esi + 4]
mov byte [esi + 0x34], bl
call edi
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x6255b5
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push ecx
push str.WinHttp.dll
mov esi, ecx
call fcn.005a1d73
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
cmp dword [esi + 4], ebx
je 0x625638
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push dword [esi + 4]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x625637
push str.WinHttpQueryOption
push dword [esi + 4]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x625637
push str.WinHttpCloseHandle
push dword [esi + 4]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x625637
push str.WinHttpGetDefaultProxyConfiguration
push dword [esi + 4]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x625637
push str.WinHttpGetIEProxyConfigForCurrentUser
push dword [esi + 4]
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x625637
inc ebx
pop edi
mov byte [esi + 0x1c], bl
mov eax, esi
pop esi
pop ebx
ret
Function at 0x63faf8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x46c
mov eax, 0x6fe24d
call fcn.00648b50
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 4], ebx
push dword [edi + 4]
push dword [edi]
call fcn.0059ad80
mov eax, dword [edi]
lea ecx, [ebp - 0x470]
push 0x20019
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov dword [edi + 4], eax
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0051e4ac
test eax, eax
jne 0x63fd2c
mov eax, ebx
mov dword [ebp - 0x450], ebx
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x454], 0x100
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x63fd2a
test eax, eax
jne 0x63fd18
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov byte [ebp - 4], 1
call fcn.00515e26
push eax
lea ecx, [ebp - 0x44c]
call fcn.00515c3a
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp - 0x458], 0x104
call fcn.0051545a
push eax
push esi
lea ecx, [ebp - 0x44c]
call fcn.00515b15
mov esi, 0x741508
mov ecx, esi
call fcn.0051545a
push eax
push esi
lea ecx, [ebp - 0x44c]
call fcn.00517d9c
lea ecx, [ebp - 0x210]
call fcn.0051545a
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x44c]
call fcn.00517d9c
mov esi, dword [ebp - 0x44c]
lea ecx, [ebp - 0x464]
push 0x20019
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0051e4ac
test eax, eax
jne 0x63fcfd
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x418]
push eax
push str.ProfileImagePath
lea ecx, [ebp - 0x464]
call fcn.0051e3d6
test eax, eax
jne 0x63fcfd
push 7
pop ecx
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x438], ebx
mov word [ebp - 0x448], ax
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], ebx
mov word [ebp - 0x430], ax
lea eax, [ebp - 0x418]
mov byte [ebp - 4], 3
push eax
call fcn.0053893d
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x430]
call fcn.00538b75
lea eax, [ebp - 0x210]
push eax
call fcn.0053893d
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x448]
call fcn.00538b75
lea eax, [ebp - 0x448]
mov ecx, edi
push eax
call fcn.0059386c
push ebx
push 1
lea ecx, [ebp - 0x430]
call fcn.00529114
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.00529114
lea ecx, [esi - 0x10]
call fcn.00515ed6
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], bl
call fcn.0051e50a
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
jmp 0x63fb5a
mov bl, 1
lea ecx, [ebp - 0x470]
call fcn.0051e50a
mov al, bl
call fcn.00648afa
ret
Function at 0x63fd3f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x248
mov eax, 0x6fe29c
call fcn.00648b50
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x24c], 0x104
jb 0x63fd89
mov eax, dword [eax]
push 0x20019
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x248]
call fcn.0051e4ac
test eax, eax
je 0x63fdb5
lea ecx, [ebp - 0x248]
call fcn.0051e50a
xor al, al
jmp 0x63ff26
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x63ff19
mov eax, ebx
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x23c], eax
jbe 0x63ff17
push ebx
push ebx
push ebx
xor ecx, ecx
mov dword [ebp - 0x24c], 0x104
push ebx
mov word [ebp - 0x218], cx
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x63fefe
mov dword [ebp - 0x238], ebx
call fcn.00515e26
push eax
lea ecx, [ebp - 0x234]
call fcn.00515c3a
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 1
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0051e3d6
push dword [ebp - 0x238]
lea ecx, [ebp - 0x234]
call fcn.005159ef
lea ecx, [ebp - 0x238]
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0051e3d6
push 0xffffffffffffffff
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.0051d5f9
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x230]
call fcn.00538a60
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x234]
mov ecx, esi
push eax
call fcn.0064010a
push edi
mov esi, eax
call fcn.0053893d
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00538b75
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00529114
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
mov esi, dword [ebp - 0x254]
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp eax, dword [ebp - 0x23c]
jb 0x63fdee
mov bl, 1
lea ecx, [ebp - 0x248]
call fcn.0051e50a
mov al, bl
call fcn.00648afa
ret 0xc
Function at 0x640417
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x78
mov eax, 0x6fe448
call fcn.00648b50
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
call fcn.00515e26
push eax
lea ecx, [ebp - 0x74]
call fcn.00515c3a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x74]
mov edi, 0x104
push edi
mov dword [ebp - 0x80], edi
call fcn.005159ef
push edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00515aea
lea eax, [ebp - 0x7c]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebx + 0x14]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x64052c
push 0xffffffffffffffff
lea ecx, [ebp - 0x74]
call fcn.0051d5f9
inc dword [ebx + 0x14]
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebx + 0x18]
call fcn.005154cf
mov ecx, dword [ebx + 0xc]
sub ecx, 0x10
call fcn.00515476
add eax, 0x10
mov dword [ebp - 0x78], eax
mov esi, 0x741508
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0051545a
push eax
push esi
lea ecx, [ebp - 0x78]
call fcn.00517d9c
mov esi, dword [ebp - 0x74]
lea ecx, [ebp - 0x78]
push dword [esi - 0xc]
push esi
call fcn.00517d9c
call fcn.0058e340
mov edi, dword [ebp - 0x78]
neg eax
mov ecx, dword [ebp - 0x84]
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push edi
push dword [ebx + 0x10]
call fcn.0051e4ac
test eax, eax
je 0x640518
push eax
push 0x2a
push str.MiscRegKeyEnumerator.cpp
lea ecx, [ebp - 0x70]
call fcn.006c3cf0
push 0x7fc4ec
lea eax, [ebp - 0x70]
push eax
call fcn.00671426
lea ecx, [edi - 0x10]
call fcn.00515ed6
lea ecx, [esi - 0x10]
call fcn.00515ed6
mov al, 1
jmp 0x640539
mov eax, dword [ebp - 0x74]
lea ecx, [eax - 0x10]
call fcn.00515ed6
xor al, al
call fcn.00648afa
ret 4
Function at 0x646190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c6ce0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x81c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x81c574]
cmp eax, 0xffffffff
je 0x6461fe
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6461fe
mov eax, dword [0x81c574]
cmp eax, 0xffffffff
jne 0x6461d5
xor eax, eax
jmp 0x6461dc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x6461fe
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x646790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71516e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x81c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x81c574]
cmp eax, 0xffffffff
jne 0x6467c6
xor ebx, ebx
jmp 0x6467cf
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
mov dword [ebp - 4], 0
setne cl
test cl, cl
je 0x64681b
lea edi, [ebx + 0x14]
cmp dword [edi + 4], 0
mov esi, dword [ebx + 0xc]
sete al
test al, al
je 0x64685a
test esi, esi
jne 0x646860
push 0x645950
push 0x8331a8
call fcn.00517ca9
mov eax, dword [0x81c574]
add esp, 8
cmp eax, 0xffffffff
je 0x64681b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x646848
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x646848
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x6468a5
nop
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x64688b
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x646860
lea edi, [ebx + 0x14]
cmp dword [ebx + 0x18], 0
je 0x6467e5
nop
mov esi, dword [edi]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x6468c8
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x6468c8
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00545a15
cmp dword [ebx + 0x18], 0
jne 0x6468b0
jmp 0x6467e5
Function at 0x646940
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x6469a0
push 0
push 0
call fcn.0068c2a5
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x646969
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x646987
cmp eax, 0xffffffff
je 0x646987
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x64bb70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor ecx, ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
sub ebx, edi
xor ebp, ebp
inc ebx
shr ebx, 1
cmp edi, dword [esp + 0x18]
cmova ebx, ecx
test ebx, ebx
je 0x64bbb3
movzx ecx, word [edi]
lea edi, [edi + 2]
mov edx, esi
mov eax, esi
shl edx, 6
add ecx, 0x9e3779b9
shr eax, 2
inc ebp
add edx, eax
add ecx, edx
xor esi, ecx
cmp ebp, ebx
jne 0x64bb92
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x65cce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ecx, ecx
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
sub ebp, edi
xor ebx, ebx
cmp edi, dword [esp + 0x18]
cmova ebp, ecx
test ebp, ebp
je 0x65cd21
nop
movsx ecx, byte [edi]
lea edi, [edi + 1]
mov edx, esi
mov eax, esi
shl edx, 6
add ecx, 0x9e3779b9
shr eax, 2
inc ebx
add edx, eax
add ecx, edx
xor esi, ecx
cmp ebx, ebp
jne 0x65cd00
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret