joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105e183
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1079e94]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push esi
mov dword [ebp - 4], eax
inc edi
call dword [sym.imp.msvcrt.dll_wcslen]
add eax, 4
cmp eax, 0x104
pop ecx
jb 0x105e1c2
push 0x8007006f
push 0x2600197
push esi
call fcn.0105364b
jmp 0x105e226
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push 0x10113d4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x105e226
test byte [ebp - 0x45c], 0x10
je 0x105e21d
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x105e200
jmp 0x105e21f
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0104b509
leave
ret 4

Function at 0x105e23b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x1079e94]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x464], ebx
call dword [sym.imp.msvcrt.dll_wcslen]
mov edi, eax
lea eax, [edi + 4]
cmp eax, 0x104
pop ecx
jb 0x105e285
mov esi, 0x8007006f
push esi
push 0x2880197
mov dword [ebp - 0x460], esi
push ebx
jmp 0x105e38b
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push 0x10113d4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x468], eax
jne 0x105e2e9
call fcn.0106d6ff
test eax, eax
mov dword [ebp - 0x460], eax
je 0x105e2e9
push eax
push 0x2930197
call fcn.01053610
jmp 0x105e390
and dword [ebp - 0x460], 0
mov esi, 0x8007006f
test byte [ebp - 0x45c], 0x10
jne 0x105e34e
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add eax, edi
cmp eax, 0x104
pop ecx
jb 0x105e32e
push esi
push 0x29e0197
push dword [ebp - 0x464]
mov dword [ebp - 0x460], esi
call fcn.0105364b
jmp 0x105e34e
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp + edi*2 - 0x20c]
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x105e2f5
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x460], 0
je 0x105e390
push dword [ebp - 0x460]
push 0x2a60197
push dword [ebp - 0x464]
call fcn.0105364b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x460]
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 4
Function at 0x105ec4d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x105ec95
push eax
call fcn.0106d6ca
mov esi, eax
push esi
push 0x4900197
push ebx
call fcn.0105364b
jmp 0x105ed15
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp + 0xc], eax
jne 0x105ecb8
mov esi, 0x8007000e
push esi
push 0x4970197
call fcn.01053610
jmp 0x105ed07
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x105ece2
push eax
call fcn.0106d6ca
mov esi, eax
push esi
push 0x49e0197
push ebx
call fcn.0105364b
jmp 0x105ed07
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.01054d52
mov esi, eax
cmp esi, edi
je 0x105ecff
push esi
push 0x4a20197
jmp 0x105ecb1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp dword [ebp + 0xc], edi
je 0x105ed15
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x105f38a
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push 2
push 0x1001fe8
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.01069add
mov esi, eax
cmp esi, edi
je 0x105f3c9
push esi
push 0x6cc0197
push dword [ebp + 8]
call fcn.0105364b
jmp 0x105f3e8
push 0x1011430
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp esi, edi
je 0x105f3e8
push esi
push 0x6cf0197
call fcn.01053610
cmp dword [ebp - 4], edi
je 0x105f3f6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x105f404
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x105feda
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x1079e94]
and dword [ebp - 0x66c], 0
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
push esi
mov esi, dword [ebp + 0xc]
and dword [esi], 0
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x670], edi
call ebx
add eax, 6
cmp eax, 0x104
pop ecx
jb 0x105ff32
mov eax, 0x8007006f
push eax
push 0xbf50197
push edi
mov esi, eax
call fcn.0105364b
jmp 0x1060091
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x101148c
push eax
call edi
lea eax, [ebp - 0x20c]
push 0x1001e98
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x668], eax
je 0x1060002
test byte [ebp - 0x664], 0x10
je 0x105ffa6
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x105ff84
jmp 0x105ffed
lea eax, [ebp - 0x638]
push eax
mov dword [ebp - 0x66c], 1
call ebx
cmp eax, 0x104
pop ecx
jb 0x105ffd7
mov eax, 0x8007006f
push eax
push 0xc070197
push dword [ebp - 0x670]
jmp 0x105ff26
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x66c], 0
jne 0x1060014
mov esi, 0x80070002
push esi
push 0xc130197
call fcn.01053610
jmp 0x1060091
cmp dword [ebp - 0x66c], 1
jbe 0x106002a
mov esi, 0x8007010b
push esi
push 0xc180197
jmp 0x106000d
push dword [ebp - 0x670]
call ebx
lea ecx, [ebp - 0x414]
push ecx
mov dword [ebp - 0x668], eax
call ebx
pop ecx
pop ecx
mov ecx, dword [ebp - 0x668]
add ecx, eax
lea eax, [ecx + ecx + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi], eax
jne 0x106006b
mov esi, 0x8007000e
push esi
push 0xc240197
jmp 0x106000d
push dword [ebp - 0x670]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push 0x1006b9c
push dword [esi]
call edi
lea eax, [ebp - 0x414]
push eax
push dword [esi]
call edi
add esp, 0x18
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 8
Function at 0x1060613
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1079e94]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor edx, edx
cmp esi, edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x258], edx
mov dword [edi], edx
je 0x106064b
mov dword [esi], edx
lea ebx, [ebp - 0x258]
push ebx
push edx
push eax
push ecx
call fcn.01054a52
mov ebx, eax
test ebx, ebx
je 0x1060670
push ebx
push 0x810197
call fcn.01053610
jmp 0x1060720
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x260], eax
jne 0x1060695
xor ebx, ebx
jmp 0x1060720
test byte [ebp - 0x254], 0x10
jne 0x10606e4
test esi, esi
mov dword [edi], 1
je 0x10606e4
lea eax, [ebp - 0x25c]
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x264]
call fcn.01054a52
mov ebx, eax
test ebx, ebx
jne 0x10606fd
push dword [ebp - 0x25c]
call fcn.0105e3db
test eax, eax
jne 0x106070a
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1060695
jmp 0x1060712
push ebx
push 0x980197
call fcn.01053610
jmp 0x1060714
mov eax, dword [ebp - 0x25c]
mov dword [esi], eax
xor ebx, ebx
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x258], 0
je 0x1060735
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0104b509
leave
ret 0x10
Function at 0x1064771
Capabilities:
Get common file path
Write file on windows

Disassembly:
push 0x124
push 0x1011e90
call fcn.0104b8c0
mov eax, dword [0x1079e94]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x130], ebx
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 4], eax
cmp dword [0x107c6e4], eax
jne 0x10647c5
push 0x107c6c4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x107c6e4], 1
or dword [ebp - 4], 0xffffffff
jmp 0x10647ef
cmp dword [0x107c6e4], 0
je 0x106480d
push 0x107c6c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x12c], 1
cmp byte [ebx], 0x2b
jne 0x106481d
inc ebx
mov dword [ebp - 0x124], 1
push 0x104
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x106492b
cmp byte [ebp + eax - 0x121], 0x5c
je 0x1064857
lea edi, [ebp - 0x120]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1064848
mov esi, 0x1011e88
movsw word es:[edi], word [esi]
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106485b
sub eax, edx
lea edi, [ebp - 0x120]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106486b
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp - 0x124], esi
mov eax, 0x1011e84
jne 0x1064897
mov eax, 0x1011e80
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.msvcrt.dll_fopen]
pop ecx
pop ecx
mov dword [0x107c6dc], eax
cmp eax, esi
je 0x10648f8
cmp dword [ebp - 0x124], esi
je 0x1064921
push 2
push esi
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1064909
push dword [0x107c6dc]
call dword [sym.imp.msvcrt.dll_ftell]
pop ecx
cmp eax, 0x80000
jl 0x1064909
push dword [0x107c6dc]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov dword [0x107c6dc], esi
mov dword [ebp - 0x124], esi
jmp 0x1064883
push 0x80004005
push 0x1890192
call fcn.01053610
jmp 0x106492b
push dword [0x107c6dc]
push 1
push 0x4a
push 0x1011dc0
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0x128], 1
cmp dword [ebp - 0x12c], 0
je 0x106493f
push 0x107c6c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x128], 0
je 0x1064970
push 0x3b4
push 0x1a4
push 0x192
call fcn.010645de
push 0x106465f
call sub.certcli.dll_Ordinal_242
mov dword [0x107c6e8], 0x10646b6
mov ecx, dword [ebp - 0x1c]
call fcn.0104b509
call fcn.0104b8fb
ret 4
Function at 0x1065f4e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1079e94]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
or dword [esi], 0xffffffff
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
mov dword [ebp - 4], eax
call fcn.01064eb2
test ebx, ebx
jne 0x1065fcd
mov ebx, 0xf6
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x100e43c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1065fb2
cmp eax, ebx
jae 0x1065fb2
lea eax, [ebp - 0x20c]
push 0x1012188
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
jmp 0x1066026
mov eax, 0x80070002
push eax
push 0x4ca0191
mov dword [ebp - 0x210], eax
call fcn.01053610
jmp 0x10660eb
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
jne 0x106602c
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
inc eax
cmp eax, 0x104
pop ecx
jb 0x1066003
mov eax, 0x800700ce
push eax
mov dword [ebp - 0x210], eax
push 0x4d60191
jmp 0x10660e5
lea eax, [ebp - 0x20c]
push 0x1012180
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea ebx, [ebp - 0x20c]
push ebx
call fcn.01065269
test eax, eax
mov dword [ebp - 0x210], eax
je 0x1066047
push eax
push 0x4de0191
jmp 0x10660e5
push 2
pop eax
jmp 0x106606a
call fcn.0106d6ff
cmp eax, 0xe0000100
mov dword [ebp - 0x210], eax
jne 0x10660b9
cmp dword [ebp - 0x218], 2
jne 0x10660b9
xor eax, eax
inc eax
and dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push eax
push 0
push ebx
mov dword [ebp - 0x218], eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov dword [esi], eax
mov eax, dword [ebp - 0x214]
mov dword [edi], eax
cmp dword [esi], 0xffffffff
je 0x106604c
xor esi, esi
push esi
push esi
push ebx
push 0x3b2
push esi
push 0x4fc
push 0x191
call fcn.01064378
mov dword [ebp - 0x210], esi
jmp 0x10660eb
mov ecx, dword [edi]
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
push 0
push ebx
push 0x3b3
push eax
push 0x4f9
push 0x191
call fcn.01064378
push dword [ebp - 0x210]
push 0x4fa0191
push ebx
call fcn.0105364b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0xc
Function at 0x1068e47
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x18], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
jne 0x1068e84
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01068d54
mov esi, eax
cmp esi, edi
je 0x1068e89
push esi
push 0x6901b5
call fcn.01053610
jmp 0x1068ed1
mov eax, dword [ebp + 8]
jmp 0x1068e8c
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
je 0x1068eb0
push esi
push 0x7601b5
jmp 0x1068e7d
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, 2
je 0x1068ecf
cmp esi, edi
je 0x1068ecf
push esi
push 0x7b01b5
jmp 0x1068e7d
xor esi, esi
cmp dword [ebp - 4], edi
je 0x1068edf
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], edi
je 0x1068eed
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0106d6ca
pop edi
pop esi
leave
ret 0x14
Function at 0x1068f1f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0x2c], ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x1068f68
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01068d54
mov esi, eax
cmp esi, ebx
je 0x1068f68
push esi
push 0x12401b5
call fcn.01053610
jmp 0x1069028
cmp dword [ebp + 8], ebx
je 0x1068f98
lea eax, [ebp - 4]
push eax
push 0x80000002
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
cmp esi, ebx
je 0x1068f9f
push esi
push 0x12a01b5
push dword [ebp + 8]
call fcn.0105364b
jmp 0x1069028
mov dword [ebp - 4], 0x80000002
cmp dword [ebp + 0x2c], ebx
mov eax, dword [ebp + 0xc]
jne 0x1068faa
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x28]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x1068fd3
push esi
push 0x13901b5
jmp 0x1068f5e
cmp dword [ebp + 0x1c], ebx
je 0x1069026
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov ecx, dword [ebp + 0x20]
je 0x1068fe6
cmp edi, ebx
jne 0x1069005
cmp ecx, ebx
jbe 0x1069005
cmp ecx, 2
jbe 0x1068ffd
cmp ecx, 7
jne 0x1069005
mov eax, 0x1001b20
push 4
jmp 0x1069004
mov eax, 0x1001fe8
push 2
pop edi
push edi
push eax
push ecx
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x1069026
push esi
push 0x15301b5
jmp 0x1068f5e
xor esi, esi
cmp dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1069041
cmp dword [ebp - 4], 0x80000002
je 0x1069041
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x106904f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
je 0x1069059
push dword [ebp - 0xc]
call edi
push esi
call fcn.0106d6ca
pop edi
pop esi
pop ebx
leave
ret 0x28
Function at 0x106909b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, esi
push edi
mov dword [ebp - 4], esi
je 0x10690b9
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x10690c2
mov dword [eax], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
jmp 0x1069118
test esi, esi
jne 0x1069138
cmp dword [ebp - 8], 7
mov eax, dword [ebp - 0xc]
je 0x10690e7
cmp dword [ebp - 8], 1
jne 0x10690f9
test al, 1
mov dword [ebp - 4], 4
je 0x10690f9
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 4]
add eax, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1069172
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov edi, eax
test edi, edi
je 0x10690d4
push 2
push edi
push 0x1a501b5
push dword [ebp + 0xc]
call fcn.01053590
jmp 0x1069182
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edi, [edx + esi]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x106915d
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1069169
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor edi, edi
jmp 0x1069182
mov edi, 0x8007000e
push edi
push 0x1bc01b5
call fcn.01053610
push edi
call fcn.0106d6ca
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x106ac40
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call fcn.01054594
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x106ac7d
push eax
push 0x2090199
call fcn.01053610
jmp 0x106ad3e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 8]
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x106acb3
call fcn.0106d6ff
push eax
push 0x2160199
jmp 0x106ad35
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x106acd6
mov eax, 0x8007000e
push eax
push 0x21f0199
jmp 0x106ad35
push dword [ebp - 0x18]
push ebx
call esi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x14], esi
jne 0x106acf2
mov eax, 0x8007000e
push eax
push 0x2280199
jmp 0x106ad35
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 8]
push ebx
call edi
test eax, eax
jne 0x106ad19
call fcn.0106d6ff
push eax
push 0x2350199
jmp 0x106ad35
mov eax, dword [ebp - 0x20]
add eax, 0x40
push eax
push esi
call fcn.0106d381
test eax, eax
jne 0x106ad3d
call fcn.0106d6ff
push eax
push 0x23d0199
mov dword [ebp - 4], eax
call fcn.01053610
pop edi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x106ad4e
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], ebx
je 0x106ad58
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x14], ebx
je 0x106ad62
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x106ddfd
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x1079e94]
push ebx
mov edx, dword [ebp + 8]
push esi
mov ebx, dword [ebp + 0xc]
push edi
push 0xf
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x670]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x66c], eax
lea eax, [ebp - 0x630]
mov dword [ebp - 0x660], eax
mov eax, 0x104
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x670]
push eax
push 0x80000000
xor esi, esi
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x644], ecx
push esi
lea ecx, [ebp - 0x220]
push edx
mov dword [ebx], esi
mov dword [ebp - 0x670], 0x3c
mov dword [ebp - 0x668], 0xa
mov dword [ebp - 0x63c], ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x106dea3
call fcn.0106d6ff
mov edi, eax
jmp 0x106df0d
xor edi, edi
mov dword [ebp - 0x634], edi
lea eax, [ebp - 0x634]
push eax
push esi
push edi
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.WININET.dll_InternetCreateUrlW]
test eax, eax
jne 0x106ded8
call fcn.0106d6ff
mov edi, eax
cmp edi, 0x8007007a
jne 0x106df02
test esi, esi
jne 0x106df06
xor edi, edi
cmp esi, edi
jne 0x106def9
push dword [ebp - 0x634]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
je 0x106defd
shr dword [ebp - 0x634], 1
jmp 0x106deab
mov dword [ebx], esi
jmp 0x106df0d
mov edi, 0x8007000e
test esi, esi
je 0x106df0d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 8

Function at 0x106e7a8
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push edi
push 3
xor ebx, ebx
pop edi
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0xc], edi
push edi
jmp 0x106e7eb
call fcn.0106d6ff
cmp eax, 0x80070002
mov dword [ebp - 8], eax
jne 0x106e813
cmp dword [ebp - 0xc], edi
jne 0x106e849
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0xc], ebx
push ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x106e7ce
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x106e81c
mov dword [ebp - 8], 0x8007000e
jmp 0x106e83e
cmp eax, 0x800700ea
jne 0x106e849
jmp 0x106e7f7
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x106e834
call fcn.0106d6ff
mov dword [ebp - 8], eax
jmp 0x106e83e
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor edi, edi
mov dword [ebp - 8], ebx
cmp edi, ebx
je 0x106e849
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4