joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406bb1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x406bec

Function at 0x406c2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, dword [edx + 0x87d8b4c]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.00406b71
call 0x56937523
push ebx
call fcn.00406bb1
pop ecx
test eax, eax
pop ecx
je 0x406d04
push edi
push esi
push ebx
call fcn.00406bf1
add esp, 0xc
call fcn.00406b71
and al, bh
xchg ebx, eax
arpl word [ebx - 0x97a878a], cx
je 0x406d04
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.00406b71
and al, byte [edx + 0x468b0bd0]
and byte [ebx], al
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40700c

Function at 0x407024
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00406b71
sti
xchg esi, eax
invalid

Function at 0x40720c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x407225
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x407220
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40720a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x407212
cmp edx, ebx
jne 0x407360
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4071e1
add eax, dword [eax + 4]
jmp 0x4071ce
mov dword [ebp + 0xc], ebx
jmp 0x407230
Function at 0x407284
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x407248
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x407266
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4072c4
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4072ab
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4072b4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4072be
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4072a0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40722a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x407311
dec eax
je 0x407308
sub eax, 3
je 0x4072ff
mov dword [ebp - 4], 0x40
jmp 0x40732e
mov dword [ebp - 4], 4
jmp 0x407314
mov dword [ebp - 4], 0x20
jmp 0x407314
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x407360
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4072e0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00406b71
lodsd eax, dword [esi]
push edi
xchg esp, eax
add edi, edi
jne 0x40736b
push 1
push esi
call edi
mov eax, esi
jmp 0x40736c
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4094d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409532
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094fe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40950c
cmp edi, 1
jle 0x40950c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408fbc
test eax, eax
jne 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409532
inc edi
dec esi
jne 0x4094ee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x10001050
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x100019e8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100019a4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100019c2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10001a20
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
add byte [eax], al
add byte [eax - 0x77], al
jge 0x100019ff
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10001a07
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10001a10
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10001a1a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100019fc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10001986
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10001a6d
dec eax
je 0x10001a64
sub eax, 3
je 0x10001a5b
mov dword [ebp - 4], 0x40
jmp 0x10001a8a
mov dword [ebp - 4], 4
jmp 0x10001a70
mov dword [ebp - 4], 0x20
jmp 0x10001a70
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10001abc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10001a3c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100012cd
mov dword [0xffb466fe], eax
jne 0x10001ac7
push 1
push esi
call edi
mov eax, esi
jmp 0x10001ac8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100053ef
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
call fcn.10004d67
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
jmp 0x1000543c
push 0x1006e3ec
lea eax, [ebp - 0xc]
push eax
call fcn.1001bc30
add esp, 8
jmp 0x10005455
push 0x1006e3f0
lea eax, [ebp - 0xc]
push eax
call fcn.1001bc30
add esp, 8
jmp 0x10005455
cmp dword [ebp - 0x58], 1
je 0x1000540b
cmp dword [ebp - 0x58], 2
je 0x10005421
jmp 0x10005455
push 0x1006e3f4
lea eax, [ebp - 0x50]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100054f6
cmp dword [ebp - 0x10], 2
jne 0x100054df
lea eax, [ebp - 0xc]
push eax
call fcn.1001bd20
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100054da
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100054fd
jmp 0x100054f6
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100054fd
xor eax, eax
jmp 0x100054fd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005673
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100056f0
cmp dword [ebp - 8], 2
jne 0x100056cc
push 0x1006e404
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.1001bc30
add esp, 8
xor eax, eax
jmp 0x10005803
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10005803
mov dword [ebp - 8], 0xea
mov dword [ebp - 0xc], pe_nt_image_headers32
jmp 0x1000570a
add dword [ebp - 0xc], 0x80
cmp dword [ebp - 8], 0xea
jne 0x10005767
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xea
jne 0x10005762
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.1001bff0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x10005703
cmp dword [ebp - 8], 0
je 0x100057c1
cmp dword [ebp - 8], 2
jne 0x10005793
push 0x1006e408
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.1001bc30
add esp, 8
jmp 0x100057c1
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x10005803
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100057fc
push 0x2002000
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10005803
xor eax, eax
jmp 0x10005803
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005808
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000585c
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100058f5
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100058b3
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x100058f5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100058ee
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100058f5
xor eax, eax
jmp 0x100058f5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100058fa
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000594e
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100059ed
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100059ab
cmp dword [ebp - 4], 2
je 0x100059ab
cmp dword [ebp - 4], 3
je 0x100059ab
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10004
call fcn.100042e2
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x100059ed
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100059e6
push 0x2002007
call fcn.1000427e
add esp, 4
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100059ed
xor eax, eax
jmp 0x100059ed
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100059f2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.1001c260
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x1006e40c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005a72
push 0x10001
call fcn.100042e2
add esp, 4
push 0x2002012
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x10005c6d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x1006e444
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005ad9
push 0x10006
call fcn.100042e2
add esp, 4
push 0x2002012
call fcn.1000427e
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x10005c6d
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x10005bab
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.1001c1a0
add esp, 4
push 0x1006e448
lea eax, [ebp - 0x808]
push eax
call fcn.1001bee0
add esp, 8
test eax, eax
jne 0x10005b81
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x10005ad9
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x1006e454
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005c22
push 0x10006
call fcn.100042e2
add esp, 4
push 0x2002012
call fcn.1000427e
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x10005c6d
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005c66
push 0x10002
call fcn.100042e2
add esp, 4
push 0x2002012
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x10005c6d
xor eax, eax
jmp 0x10005c6d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005c72
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.1001c260
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x1006e458
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005cf2
push 0x10001
call fcn.100042e2
add esp, 4
push 0x2002011
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x10005f03
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x1006e490
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005d2f
mov byte [ebp - 0x2f28], 0
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x10005e01
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.1001c1a0
add esp, 4
push 0x1006e494
lea eax, [ebp - 0x808]
push eax
call fcn.1001bee0
add esp, 8
test eax, eax
jne 0x10005dd7
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x10005d2f
push 0x1006e4a0
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bc30
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.1001bd20
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x1006e4ac
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005eb8
push 0x10006
call fcn.100042e2
add esp, 4
push 0x2002011
call fcn.1000427e
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x10005f03
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x10005efc
push 0x10002
call fcn.100042e2
add esp, 4
push 0x2002011
call fcn.1000427e
add esp, 4
mov eax, 0xffffffff
jmp 0x10005f03
xor eax, eax
jmp 0x10005f03
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005ffa
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000601b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10006020
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10006054
push 0x20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
jmp 0x1000605c
pop edi
pop esi
pop ebx
leave
ret