joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104ef94
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push esi
push edi
call fcn.0104e959
mov edi, 0x10e2a1c
jmp 0x104efb8
push esi
push edi
call fcn.0108e8b4
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
call fcn.0104e959
mov esi, eax
test esi, esi
jne 0x104efa4
push edi
call fcn.0108e74e
pop edi
pop esi
jmp 0x107cc84
mov edi, edi
push ebx
or ebx, 0xffffffff
cmp dword [0x10de044], ebx
jne 0x107cc97
xor eax, eax
inc eax
pop ebx
ret
mov eax, dword [0x10e6c1c]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x107cce0
add dword [0x10e6b80], 1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, reloc.KERNEL32.dll_CompareStringW
jne 0x107ccd1
push ebx
push dword [0x10e6c1c]
call esi
push dword [0x10e6c1c]
call edi
and dword [0x10e6c1c], 0
mov eax, dword [0x10e6c24]
cmp eax, ebx
je 0x107ccf5
push eax
call fcn.010cb4da
mov dword [0x10e6c24], ebx
push 0x10e6b9c
call fcn.01077d0f
test ax, ax
jne 0x107cd09
call fcn.0107af9e
mov eax, dword [0x10e6c20]
test eax, eax
je 0x107cd22
cmp eax, ebx
je 0x107cd22
push eax
call fcn.010cb43e
mov dword [0x10e6c20], ebx
mov eax, dword [0x10e6c18]
test eax, eax
je 0x107cd3e
push ebx
push eax
call esi
push dword [0x10e6c18]
call edi
and dword [0x10e6c18], 0
call fcn.01078ce1
call fcn.01077d84
mov esi, dword [sym.imp.msvcrt.dll_free]
jmp 0x107cd7e
push ebx
lea eax, [edi + 0x14]
push eax
call fcn.0108e8b4
push ebx
call esi
pop ecx
push edi
call fcn.01077db2
mov ebx, eax
test ebx, ebx
jne 0x107cd50
push edi
push 0x10e6b40
call fcn.0108e8b4
push edi
call esi
pop ecx
call fcn.01077d84
mov edi, eax
test edi, edi
jne 0x107cd5e
jmp 0x107cdaf
push ebx
lea eax, [edi + 0x14]
push eax
call fcn.0108e8b4
push ebx
call esi
pop ecx
push edi
call fcn.01077db2
mov ebx, eax
test ebx, ebx
jne 0x107cd86
push edi
push 0x10e6b6c
call fcn.0108e8b4
push edi
call esi
pop ecx
call fcn.01077cb3
mov edi, eax
test edi, edi
jne 0x107cd94
jmp 0x107cde5
push ebx
lea eax, [edi + 0x14]
push eax
call fcn.0108e8b4
push ebx
call esi
pop ecx
push edi
call fcn.01077db2
mov ebx, eax
test ebx, ebx
jne 0x107cdbc
push edi
push 0x10e6bd4
call fcn.0108e8b4
push edi
call esi
pop ecx
call fcn.01077cc9
mov edi, eax
test edi, edi
jne 0x107cdca
jmp 0x107ce1b
push ebx
lea eax, [edi + 0x14]
push eax
call fcn.0108e8b4
push ebx
call esi
pop ecx
push edi
call fcn.01077db2
mov ebx, eax
test ebx, ebx
jne 0x107cdf2
push edi
push 0x10e6b54
call fcn.0108e8b4
push edi
call esi
pop ecx
call fcn.01077cdf
mov edi, eax
test edi, edi
jne 0x107ce00
call fcn.01078cf0
mov eax, dword [0x10de048]
cmp eax, 0xffffffff
je 0x107ce41
push eax
push dword [0x10de044]
call fcn.010cb546
push dword [0x10de044]
call fcn.010cb43e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [0x10de044], 0xffffffff
push 0x10e6b84
call esi
push 0x10e6bec
call esi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x104f1e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa78
mov eax, dword [0x10de03c]
push edi
lea ecx, [ebp - 0xa68]
push ecx
push 1
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa6c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f229
xor eax, eax
inc eax
jmp 0x104f3d4
push ebx
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
mov word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], di
mov word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], di
mov dword [ebp - 0xa64], edi
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
push edi
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0xa64]
mov dword [ebp - 0xa74], 0x64
push dword [ebp - 0xa68]
mov dword [ebp - 0xa60], reloc.KERNEL32.dll_GetProcessHeap
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0xa78], eax
jne 0x104f34c
shr dword [ebp - 0xa60], 1
mov eax, dword [ebp - 0xa60]
mov word [ebp + eax*2 - 0xcc], di
lea eax, [ebp - 0x194]
push 0x1009fa4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x104f300
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x25c]
push eax
call esi
push 0x1009f98
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0xcc]
push eax
call fcn.01082855
add esp, 0x10
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xa6c], 1
lea eax, [ebp - 0x194]
push 0x1009f84
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x104f326
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x65c]
push eax
call esi
pop ecx
pop ecx
lea eax, [ebp - 0x194]
push 0x1009f6c
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x104f34c
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xa5c]
push eax
call esi
pop ecx
pop ecx
inc dword [ebp - 0xa64]
cmp dword [ebp - 0xa78], edi
je 0x104f24b
cmp dword [ebp - 0xa6c], edi
je 0x104f3c4
cmp word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], di
jne 0x104f381
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x65c]
push eax
call esi
pop ecx
pop ecx
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x65c]
push 0x1009f64
push eax
call esi
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0x65c]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x65c]
push eax
push edi
push dword [ebp - 0xa70]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0104ea49
push dword [ebp - 0xa68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.01075bbb
leave
ret 8
Function at 0x104f3e6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x10de03c]
push ebx
push edi
lea ecx, [ebp - 0x5a8]
push ecx
xor ebx, ebx
xor edi, edi
inc ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push edi
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x59c], edi
mov dword [ebp - 0x5a0], edi
mov dword [ebp - 0x5a4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f435
mov eax, ebx
jmp 0x104f5bb
push esi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
mov dword [ebp - 0x598], edi
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0xcc]
push eax
push edi
push edi
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0x598]
mov dword [ebp - 0x5b4], 0x64
push dword [ebp - 0x5a8]
mov dword [ebp - 0x5ac], reloc.KERNEL32.dll_GetProcessHeap
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x5b0], eax
jne 0x104f56b
lea eax, [ebp - 0x194]
push 0x100a038
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f4d1
lea eax, [ebp - 0xcc]
push 0x100a018
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f4d1
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [ebp - 0x5a0], ebx
lea eax, [ebp - 0x194]
push 0x1009fa4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f516
push 0x1009f98
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0xcc]
push eax
call fcn.01082855
pop ecx
pop ecx
mov dword [ebp - 0x59c], eax
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [ebp - 0x5a4], ebx
lea eax, [ebp - 0x194]
push 0x1009f6c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x104f56b
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], di
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x594]
je 0x104f554
push dword [ebp + 0x10]
push 0x100a004
push eax
call esi
add esp, 0x10
jmp 0x104f56b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1009fc0
push eax
call esi
add esp, 0x1c
inc dword [ebp - 0x598]
cmp dword [ebp - 0x5b0], edi
je 0x104f442
cmp dword [ebp - 0x5a0], edi
pop esi
je 0x104f5ad
cmp dword [ebp - 0x5a4], edi
je 0x104f5ad
lea eax, [ebp - 0x594]
push eax
push edi
push dword [ebp - 0x59c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104ea49
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01075bbb
leave
ret 0x14
Function at 0x104f685
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push edi
lea ecx, [ebp - 0x4d8]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4d4], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f6d3
xor eax, eax
inc eax
jmp 0x104f797
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], edi
lea eax, [ebp - 0x4e8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x104f779
push dword [ebp - 0x4e0]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call esi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call esi
add esp, 0x18
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x4cc]
push eax
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], 1
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], 1
call fcn.0104f1e2
inc dword [ebp - 0x4d4]
inc dword [ebp - 0x4d0]
cmp ebx, edi
je 0x104f6e1
push dword [ebp - 0x4d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.01075bbb
leave
ret 4
Function at 0x104f7a9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push ebx
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104f7ed
xor eax, eax
inc eax
jmp 0x104f8e4
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104f8c2
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104f8a5
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104f89e
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104f8a5
inc esi
inc esi
cmp word [esi], bx
jne 0x104f880
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104f3e6
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104f7fb
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 0x10
Function at 0x104fa95
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fad9
xor eax, eax
inc eax
jmp 0x104fbcd
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fbab
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fb91
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fb8a
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fb91
inc esi
inc esi
cmp word [esi], bx
jne 0x104fb6c
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0104f7a9
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fae7
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 0xc
Function at 0x104fbf3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fc37
xor eax, eax
inc eax
jmp 0x104fd24
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fd02
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fceb
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fce4
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fceb
inc esi
inc esi
cmp word [esi], bx
jne 0x104fcc6
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
push dword [ebp + 8]
call fcn.0104fa95
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fc45
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 8
Function at 0x104fd36
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x10de03c]
push ebx
lea ecx, [ebp - 0x4d4]
push ecx
push 0x20019
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x104fd7a
xor eax, eax
inc eax
jmp 0x104fe64
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
mov dword [ebp - 0x4d0], ebx
lea eax, [ebp - 0x4e8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x4d0]
mov dword [ebp - 0x4dc], 0x64
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x4e0], eax
jne 0x104fe42
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4cc]
push 0x1004204
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4cc]
push eax
call edi
add esp, 0x18
cmp word [ebp - 0xcc], bx
lea esi, [ebp - 0xcc]
je 0x104fe2e
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x104fe27
mov ax, word [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x104fe2e
inc esi
inc esi
cmp word [esi], bx
jne 0x104fe09
push esi
call fcn.01082855
pop ecx
lea ecx, [ebp - 0x4cc]
push ecx
push eax
call fcn.0104fbf3
inc dword [ebp - 0x4d0]
cmp dword [ebp - 0x4e0], ebx
je 0x104fd88
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01075bbb
leave
ret 4

Function at 0x10508f4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, eax
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, dword [sym.imp.msvcrt.dll_fwrite]
jmp 0x105094e
mov eax, dword [ebp - 4]
sub eax, ebx
push esi
sar eax, 1
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
push esi
push 2
push 2
push 0x100548c
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
mov ebx, dword [ebp - 4]
add ebx, 2
push 0xa
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x105090f
cmp word [ebx], ax
je 0x1050976
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push 2
push ebx
call edi
mov eax, dword [esi + 0xc]
add esp, 0x10
and eax, 0x20
jne 0x1050978
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x1050d84
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, eax
call fcn.0102150d
mov esi, edi
shl esi, 3
cmp dword [esi + 0x10dd4ac], 0
mov ebx, eax
mov ax, word [esi + reloc.ADVAPI32.dll_RegDeleteValueW]
mov word [ebp - 0xc], ax
jne 0x1050ead
push edi
mov edi, 0x10e3358
mov ecx, edi
call fcn.010509ee
cmp word [esi + reloc.ADVAPI32.dll_RegDeleteValueW], 1
lea eax, [ebp - 8]
jne 0x1050de4
push 0x100a59c
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 4], 8
jmp 0x1050e06
and dword [ebp - 4], 0
push 0x100a598
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov word [ebx + reloc.ADVAPI32.dll_RegDeleteValueW], 1
mov word [esi + reloc.ADVAPI32.dll_RegDeleteValueW], 1
xor ebx, ebx
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
pop ecx
pop ecx
je 0x1050ead
push dword [ebp - 4]
push edi
call fcn.010829a3
cmp eax, ebx
mov dword [esi + 0x10dd4ac], eax
jne 0x1050e39
push edi
push 0xdbb
call fcn.010816e4
pop ecx
pop ecx
jmp 0x1050ead
push eax
mov byte [ebp - 2], CompareStringW
mov byte [ebp - 1], 0xfe
call dword [sym.imp.msvcrt.dll_ftell]
test eax, eax
pop ecx
jne 0x1050e64
push dword [esi + 0x10dd4ac]
lea eax, [ebp - 2]
push 2
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
call fcn.0102150d
cmp dword [eax + 0xbec], ebx
je 0x1050ead
cmp word [ebp - 0xc], 1
je 0x1050ead
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
push 1
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], LoadLibraryW
mov dword [ebp - 0x10], ebx
call fcn.01059f3c
test eax, eax
jl 0x1050ead
lea eax, [ebp - 0x2c]
push eax
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
lea eax, [ebp - 0x18]
push eax
call fcn.0105a0c7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105544d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10de03c]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
xor edi, edi
push edi
push 0x2000000
push edi
push 0x100205c
push edi
push 0x100b110
push reloc.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x20c], 7
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10554a4
xor eax, eax
inc eax
jmp 0x1055532
push esi
call fcn.0102159a
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push 0x10e3d78
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x14
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push edi
push 0x100b0ec
push dword [ebp - 0x208]
call esi
test eax, eax
jne 0x1055520
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push edi
push 0x100b0cc
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x1055523
xor edi, edi
inc edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.01075bbb
leave
ret
Function at 0x1055542
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10de03c]
push ebx
push esi
push edi
push reloc.KERNEL32.dll_LoadLibraryW
pop ecx
mov esi, 0x100b230
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
mov ebx, 0x2000000
push ebx
push eax
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x100205c
push esi
push eax
push 0x100b198
push reloc.KERNEL32.dll_WaitForSingleObject
call edi
test eax, eax
jne 0x10555ef
cmp dword [ebp - 0x50], 1
jne 0x10555c7
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax*4 + 4]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10555c7
xor esi, esi
inc esi
jmp 0x10555f6
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
push ebx
push eax
push esi
push eax
push 0x100a0f8
push WaitForSingleObject
call edi
test eax, eax
je 0x10555f4
xor eax, eax
inc eax
jmp 0x1055601
xor esi, esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret