joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020330
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x23c]
cmp dword [eax], 0xffffffff
jne 0x1002035e
mov eax, 6
jmp 0x10020490
push 0
push 0
push 0
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0x40
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020399
xor eax, eax
jmp 0x10020490
movzx ecx, word [ebp - 0x60]
cmp ecx, 0x5a4d
je 0x100203ac
xor eax, eax
jmp 0x10020490
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x64], edx
push 0
push 0
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100203ef
xor eax, eax
jmp 0x10020490
cmp dword [ebp - 8], 0x4550
je 0x100203ff
xor eax, eax
jmp 0x10020490
push 0
lea ecx, [ebp - 4]
push ecx
push 0x14
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020422
xor eax, eax
jmp 0x10020490
movzx edx, word [ebp - 0x1c]
cmp edx, 0x14c
jne 0x10020461
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020457
xor eax, eax
jmp 0x10020490
mov eax, dword [ebp - 0xc8]
jmp 0x10020490
push 0
lea ecx, [ebp - 4]
push ecx
push 0xf0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002048a
xor eax, eax
jmp 0x10020490
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret
Function at 0x100204a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x100204c7
jmp 0x1002058e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
je 0x100204e9
jmp 0x1002058e
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x14
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0x14c
jne 0x1002054f
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x80], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x84], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.imagehlp.dll_CheckSumMappedFile]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x40], eax
jmp 0x1002058e
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x94], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.imagehlp.dll_CheckSumMappedFile]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [edx + 0x40], eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100216e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1002171f
mov eax, 1
jmp 0x10021824
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0xa4], 1
je 0x10021742
cmp dword [ebp - 0xa4], 2
je 0x10021789
jmp 0x10021821
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 0
je 0x1002176b
cmp dword [ebp - 0xa8], 0xa
je 0x10021774
cmp dword [ebp - 0xa8], 0x5a
je 0x1002177d
jmp 0x10021784
mov dword [ebp - 4], 2
jmp 0x10021784
mov dword [ebp - 4], 4
jmp 0x10021784
mov dword [ebp - 4], 8
jmp 0x10021821
cmp dword [ebp - 0x9c], 5
jne 0x100217d6
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x100217bb
cmp dword [ebp - 0xac], 1
je 0x100217c4
cmp dword [ebp - 0xac], 2
je 0x100217cd
jmp 0x100217d4
mov dword [ebp - 4], 0x10
jmp 0x100217d4
mov dword [ebp - 4], 0x40
jmp 0x100217d4
mov dword [ebp - 4], 0x20
jmp 0x10021821
cmp dword [ebp - 0x9c], 6
jne 0x1002181a
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0xb0], ecx
cmp dword [ebp - 0xb0], 0
je 0x100217ff
cmp dword [ebp - 0xb0], 1
je 0x10021808
jmp 0x10021811
mov dword [ebp - 4], 0x80
jmp 0x10021818
mov dword [ebp - 4], 0x100
jmp 0x10021818
mov dword [ebp - 4], 0x1f0
jmp 0x10021821
mov dword [ebp - 4], 0x1f0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret

Function at 0x10021840
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa8], 0
push 0x98
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 5
jne 0x100218ae
cmp dword [ebp - 0xa0], 2
jne 0x100218ae
movzx edx, word [ebp - 0x14]
cmp edx, 2
jne 0x100218ac
mov eax, 1
jmp 0x100218c0
jmp 0x100218be
cmp dword [ebp - 0xa4], 6
jne 0x100218be
mov eax, 1
jmp 0x100218c0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret

Function at 0x100218d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa8], 0
push 0x98
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 5
jne 0x10021933
cmp dword [ebp - 0xa0], 0
jne 0x10021933
mov eax, 1
jmp 0x10021935
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret
Function at 0x100219f0
Capabilities:
Get file version info
Identify system language via api
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x234], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10021a44
push str.Failed_to_get_Version...
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
xor eax, eax
jmp 0x10021bb9
mov ecx, dword [ebp - 0xc]
add ecx, 0xa
push ecx
call fcn.1002b1c7
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10021a8d
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1002b28a
add esp, 4
xor eax, eax
jmp 0x10021bb9
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0x1004172c
mov eax, dword [ebp - 0x1c]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10021ac9
cmp dword [ebp - 0x10], 0x34
jne 0x10021ac9
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x234]
add eax, 0x20c
push eax
call fcn.1002aae0
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x20]
push edx
push str.VarFileInfoTranslation
mov eax, dword [ebp - 0x1c]
push eax
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov dword [ebp - 0x24], 0
jmp 0x10021af7
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
shr eax, 2
cmp dword [ebp - 0x24], eax
jae 0x10021ba8
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + edx*4 + 2]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + edx*4]
push ecx
push str.StringFileInfo_04x_04x_s
lea edx, [ebp - 0x230]
push edx
call fcn.1002b318
add esp, 0x14
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
test edx, edx
jne 0x10021b74
cmp dword [ebp - 0x28], 0
je 0x10021b74
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1002b3e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, ax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + eax*4]
cmp edx, eax
jne 0x10021ba3
cmp dword [ebp - 0x28], 0
je 0x10021ba1
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1002b3e0
add esp, 8
jmp 0x10021ba8
jmp 0x10021aee
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1002b28a
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret 8
Function at 0x10021cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.1002aa10
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.1002aa10
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x10021d19
mov edx, dword [ebp + 8]
push edx
call fcn.1002ae60
add esp, 4
test eax, eax
jne 0x10021d20
xor eax, eax
jmp 0x10021dd2
mov eax, dword [ebp + 8]
push eax
push str.CLSID_sInprocServer32
lea ecx, [ebp - 0x218]
push ecx
call fcn.1002b318
add esp, 0xc
lea edx, [ebp - 0x220]
push edx
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10021d68
xor eax, eax
jmp 0x10021dd2
mov dword [ebp - 0x21c], 0x104
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10021db3
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10021dd2
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x228]
call fcn.10021c00
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret 4
Function at 0x100220f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x1c]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x1002212b
jmp 0x10022212
mov eax, dword [ebp + 0x14]
push eax
push 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x10022156
jmp 0x10022212
mov ecx, dword [ebp + 0x18]
push ecx
push 0
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18], 0
jne 0x10022181
jmp 0x10022212
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x1c]
add ecx, 4
push ecx
push 0
push 4
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x100221af
jmp 0x10022212
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x100221d7
jmp 0x10022212
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.1002aa10
add esp, 0xc
push 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.1002aae0
add esp, 0xc
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 1
mov eax, 1
jmp 0x1002221c
mov ecx, dword [ebp - 8]
call fcn.10022320
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10022230
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x1002225e
jmp 0x10022307
mov eax, dword [ebp + 0x10]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
jne 0x10022287
jmp 0x10022307
mov eax, dword [ebp + 0x14]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
jne 0x100222aa
jmp 0x10022307
mov eax, dword [ebp + 8]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x100222ce
jmp 0x10022307
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x100222f6
jmp 0x10022307
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 1
mov eax, 1
jmp 0x10022311
mov ecx, dword [ebp - 4]
call fcn.10022320
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10022630
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x10022650
xor eax, eax
jmp 0x10022764
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.1002aa10
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.1002aa10
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x460]
push edx
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 0x460], 0x44
cmp dword [ebp + 0xc], 0
jne 0x100226bd
mov eax, dword [ebp + 8]
push eax
push str.__s_
lea ecx, [ebp - 0x408]
push ecx
call fcn.1002b318
add esp, 0xc
jmp 0x100226d9
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.__s___s
lea ecx, [ebp - 0x408]
push ecx
call fcn.1002b318
add esp, 0x10
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x460]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1002270c
xor eax, eax
jmp 0x10022764
cmp dword [ebp + 0x10], 0
je 0x10022745
cmp dword [ebp + 0x14], 0
je 0x10022721
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10022745
cmp dword [ebp + 0x14], 0
je 0x10022745
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret
Function at 0x10023610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov ecx, 0x13
mov esi, str.SYSTEMCurrentControlSetControlClass36FC9E60_C465_11CF_8056_444553540000
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x60]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10023777
mov dword [ebp - 0x64], 7
mov byte [ebp - 0x168], 0
push 0xff
push 0
lea edx, [ebp - 0x167]
push edx
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 8], 0x100
push 0x100
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.1002aa10
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x64]
push eax
push 0
push str.UpperFilters
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100236ed
cmp dword [ebp + 8], 0
je 0x100236e4
mov edx, dword [ebp - 8]
sub edx, 1
push edx
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1002aae0
add esp, 0xc
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 4], edx
push 0x100
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.1002aa10
add esp, 0xc
mov dword [ebp - 8], 0x100
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x64]
push eax
push 0
push str.LowerFilters
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002376d
cmp dword [ebp - 8], 0
je 0x1002376d
cmp dword [ebp - 8], 0x100
jae 0x1002376d
cmp dword [ebp + 8], 0
je 0x10023760
mov edx, dword [ebp - 8]
sub edx, 1
push edx
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
push ecx
call fcn.1002aae0
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx - 1]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret

Function at 0x100250c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100250d6
xor eax, eax
jmp 0x1002511e
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x100
jge 0x100250eb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 8], eax
jmp 0x100250f2
mov dword [ebp - 8], 0x100
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10025130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004fa70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
mov eax, dword [ebp - 0x20c]
cmp dword [eax + 4], 0
jne 0x10025159
xor eax, eax
jmp 0x100251ae
push 0x100
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.1002bcbe
add esp, 0xc
mov byte [ebp - 0x109], 0
lea eax, [ebp - 0x208]
push eax
call fcn.1002ae60
add esp, 4
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ae45
mov esp, ebp
pop ebp
ret 8

Function at 0x100251c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0x10041720
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100251f4
xor eax, eax
jmp 0x10025241
cmp dword [ebp + 0x14], 0
je 0x10025232
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1002ae60
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10025232
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10025241
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10025250
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0x10041720
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10025284
xor eax, eax
jmp 0x100252bd
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100252ae
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100252bd
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret