joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015914
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01012a30
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10159a9
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1023c9c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x10159a9
cmp eax, 1
je 0x10159c1
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10159a9
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x101597e
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x10159a5
xor eax, eax
inc eax
jmp 0x10159dd
cmp esi, ebx
jae 0x10159ad
xor eax, eax
jmp 0x10159dd
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1023c9c]
jmp 0x10159c3
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1015b3e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1023f58], ebx
push esi
push edi
jne 0x1015bbe
push 0x1002440
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1015bf9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002434
push edi
call esi
test eax, eax
mov dword [0x1023f58], eax
je 0x1015bf9
push 0x1002424
push edi
call esi
push 0x1002410
push edi
mov dword [0x1023f5c], eax
call esi
cmp dword [0x1023c9c], 2
mov dword [0x1023f60], eax
jne 0x1015bbe
push 0x10023f4
push edi
call esi
test eax, eax
mov dword [0x1023f68], eax
je 0x1015bbe
push 0x10023dc
push edi
call esi
mov dword [0x1023f64], eax
mov eax, dword [0x1023f64]
test eax, eax
je 0x1015c03
call eax
test eax, eax
je 0x1015bea
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1023f68]
test eax, eax
je 0x1015bea
test byte [ebp - 8], 1
jne 0x1015c03
cmp dword [0x1023ca8], 4
jb 0x1015bfd
or byte [ebp + 0x12], 0x20
jmp 0x1015c22
xor eax, eax
jmp 0x1015c32
or byte [ebp + 0x12], 4
jmp 0x1015c22
mov eax, dword [0x1023f5c]
test eax, eax
je 0x1015c22
call eax
mov ebx, eax
test ebx, ebx
je 0x1015c22
mov eax, dword [0x1023f60]
test eax, eax
je 0x1015c22
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1023f58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1016dfe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x1016e1c
xor eax, eax
jmp 0x1016f8a
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1025580]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1016e4f
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.010188a3
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1016f21
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
jbe 0x1016f5c
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
mov dword [ebp - 8], edi
cmp ecx, dword [ebp + 0x10]
jae 0x1016eaa
mov edx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1016e9b
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 8]
mov byte [eax], dl
inc eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x400
jl 0x1016e7e
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1016eea
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp eax, edi
jl 0x1016ef3
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1016e6f
jmp 0x1016ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x1016f85
cmp dword [ebp - 4], edi
je 0x1016f5c
push 5
pop esi
cmp dword [ebp - 4], esi
jne 0x1016f4e
call fcn.0101820c
mov dword [eax], 9
call fcn.01018215
mov dword [eax], esi
jmp 0x1016f57
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1016f43
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
jmp 0x1016ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1016ef5
push dword [ebp - 4]
call fcn.0101821e
pop ecx
or eax, 0xffffffff
jmp 0x1016f88
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1016f71
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x1016f71
xor eax, eax
jmp 0x1016f88
call fcn.0101820c
mov dword [eax], 0x1c
call fcn.01018215
mov dword [eax], edi
jmp 0x1016f57
sub eax, dword [ebp - 0x14]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x101932b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10194f1
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x1025580]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10194f1
test cl, 0x48
je 0x1019391
mov al, byte [eax + 5]
cmp al, 0xa
je 0x1019391
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10193e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x10193cb
call fcn.0101820c
mov dword [eax], 9
call fcn.01018215
mov dword [eax], esi
jmp 0x10193db
cmp eax, 0x6d
je 0x10194f1
push eax
call fcn.0101821e
pop ecx
or eax, 0xffffffff
jmp 0x10194f3
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x10194ec
test edx, edx
je 0x1019406
cmp byte [ebx], 0xa
jne 0x1019406
or al, 4
jmp 0x1019408
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10194e6
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10194d6
cmp al, 0xd
je 0x101943c
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10194c8
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1019456
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x1019451
add dword [ebp + 0x10], 2
jmp 0x10194aa
mov dword [ebp + 0x10], eax
jmp 0x10194c4
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101947e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10194c4
cmp dword [ebp - 0xc], 0
je 0x10194c4
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x101949f
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10194aa
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x10194c7
cmp ebx, dword [ebp + 0xc]
jne 0x10194af
cmp byte [ebp - 1], 0xa
jne 0x10194af
mov byte [ebx], 0xa
jmp 0x10194c7
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01016cdf
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10194c8
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1019420
jmp 0x10194e6
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x10194e6
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10194f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10197e7
Capabilities:
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x2a4
push esi
push edi
lea eax, [ebp - 0x34]
push eax
call fcn.01019b80
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x134]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x134]
mov esi, 0x100
push eax
mov dword [ebp + 0x68], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x10198d3
push dword [ebp + 0x68]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01019bc0
lea eax, [ebp + 0x40]
push eax
call fcn.0101f346
test eax, eax
jne 0x101985a
push 0x14
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01019bc0
push 0x25
push 0x10197c2
lea eax, [ebp - 0x34]
push eax
call fcn.01019bc0
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01019ce0
lea eax, [ebp - 0x34]
push eax
call fcn.01019b80
push dword [ebp + 0x7c]
lea eax, [ebp - 0x34]
push dword [ebp + 0x78]
push eax
call fcn.01019bc0
push 0x14
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01019bc0
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.01019ce0
dec esi
jne 0x1019877
lea eax, [ebp + 0x54]
push eax
push 0x10
lea eax, [ebp - 0x238]
push eax
call fcn.01019a6d
mov edi, dword [ebp + 0x74]
push 0x40
pop ecx
lea esi, [ebp - 0x238]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
inc eax
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc
Function at 0x1019920
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x1019a5b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x1019a30
test eax, eax
jne 0x1019a30
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x1019970
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x1019a5b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x1019a30
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x1019ce0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
mov edx, dword [esi + 0x30]
mov eax, edx
and eax, 0x3f
mov ebx, 0x40
sub ebx, eax
cmp ebx, 8
push edi
ja 0x1019d02
add ebx, 0x40
lea ecx, [ebx - 6]
mov ebp, ecx
shr ecx, 2
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 0x2c]
mov eax, edx
shl ecx, 3
shr eax, 0x1d
or ecx, eax
mov dword [esp + 0x10], ecx
lea ecx, [edx*8]
push 2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + ebx + 0x18]
push eax
mov byte [esp + 0x24], 0x80
mov dword [esp + 0x20], ecx
call fcn.0101b450
push ebx
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.01019bc0
mov edx, dword [esp + 0x68]
push 5
lea edi, [esi + 0x18]
push edi
push edx
call fcn.0101b450
xor eax, eax
mov dword [edi], 0x67452301
pop edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], 0xefcdab89
mov dword [esi + 0x20], 0x98badcfe
mov dword [esi + 0x24], 0x10325476
mov dword [esi + 0x28], 0xc3d2e1f0
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x101b6cc
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
je 0x101b789
mov ax, word [esi]
test ax, ax
je 0x101b789
cmp ax, 0x3b
je 0x101b789
cmp ax, 0x22
je 0x101b789
cmp ax, 0x3c
je 0x101b789
cmp ax, 0x3e
je 0x101b789
cmp ax, 0x2a
je 0x101b789
cmp ax, 0x2b
je 0x101b789
cmp ax, 0x3d
je 0x101b789
cmp ax, 0x7c
je 0x101b789
cmp ax, 0x3f
je 0x101b789
cmp ax, 0x2c
je 0x101b789
cmp ax, 0x20
je 0x101b789
cmp ax, 9
je 0x101b789
cmp ax, 0x3a
je 0x101b74f
inc esi
inc esi
mov ax, word [esi]
test ax, ax
jne 0x101b6e6
xor eax, eax
inc eax
jmp 0x101b78b
cmp dword [esp + 0x10], 0
je 0x101b789
inc esi
inc esi
mov ax, word [esi]
test ax, ax
mov edi, esi
je 0x101b789
movzx eax, ax
push eax
call fcn.01012bda
inc esi
inc esi
test eax, eax
pop ecx
je 0x101b789
mov ax, word [esi]
test ax, ax
jne 0x101b762
sub esi, edi
and esi, 0xfffffffe
xor eax, eax
cmp esi, 0xa
setle al
jmp 0x101b78b
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x101be57
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x10241d8], 0
je 0x101be77
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x101bea5
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x214]
call fcn.0101daa2
push dword [ebp + 0xc]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0101d8b8
mov eax, esi
pop esi
leave
ret 8

Function at 0x101c293
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [0x10241d8], 0
je 0x101c2b3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x101c2f2
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x218]
push dword [ebp + 0xc]
call fcn.0101dadb
mov eax, dword [ebp - 4]
push dword [ebp - 0x214]
add eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x218]
call fcn.0101da4e
lea ecx, [ebp - 0x218]
mov esi, eax
call fcn.0101daf8
mov eax, esi
pop esi
leave
ret 8

Function at 0x101c365
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x10241d8], 0
je 0x101c382
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x101c3ad
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x214]
call fcn.0101daa2
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0101d8b8
mov eax, esi
pop esi
leave
ret 4
Function at 0x101c4fd
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [0x10241d8], 0
push edi
je 0x101c520
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
jmp 0x101c560
push esi
mov esi, dword [ebp + 0xc]
push dword [esi]
lea ecx, [ebp - 0x218]
push dword [ebp + 8]
call fcn.0101dadb
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, eax
test edi, edi
je 0x101c554
lea ecx, [ebp - 0x218]
call fcn.0101da1f
mov dword [esi], eax
lea ecx, [ebp - 0x218]
call fcn.0101daf8
pop esi
mov eax, edi
pop edi
leave
ret 8

Function at 0x101c6ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x10241d8], ebx
je 0x101c6c1
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_LoadStringW]
push esi
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jg 0x101c6cd
xor eax, eax
jmp 0x101c728
mov eax, dword [ebp + 0xc]
shr eax, 4
push 6
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x101c71e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x101c71e
and dword [ebp + 0xc], 0xf
je 0x101c705
mov ecx, dword [ebp + 0xc]
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x101c6fb
movzx ebx, word [eax]
lea ecx, [esi - 1]
cmp ebx, ecx
jl 0x101c711
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
mov ecx, ebx
lea esi, [eax + 2]
rep movsw word es:[edi], word [esi]
pop edi
mov eax, dword [ebp + 0x10]
and word [eax + ebx*2], 0
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x101c83f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x10241d8], 0
je 0x101c85f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101c88d
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x214]
call fcn.0101daa2
push dword [ebp - 0x210]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0101d8b8
mov eax, esi
pop esi
leave
ret 8
Function at 0x101c891
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
cmp dword [0x10241d8], 0
je 0x101c8c6
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101c951
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
push edi
jne 0x101c8d7
lea esi, [ebp - 4]
mov edi, dword [ebp + 0x14]
push dword [edi]
lea ecx, [ebp - 0x434]
push dword [ebp + 0x10]
call fcn.0101dadb
push dword [esi]
lea ecx, [ebp - 0x21c]
push dword [ebp + 0x1c]
call fcn.0101dadb
push dword [ebp + 0x24]
push esi
push dword [ebp - 0x218]
push dword [ebp + 0x18]
push edi
push dword [ebp - 0x430]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [ebp - 0x434]
mov ebx, eax
call fcn.0101da4e
lea ecx, [ebp - 0x21c]
mov dword [edi], eax
call fcn.0101da4e
lea ecx, [ebp - 0x21c]
mov dword [esi], eax
call fcn.0101daf8
lea ecx, [ebp - 0x434]
call fcn.0101daf8
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x20

Function at 0x101c955
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
xor esi, esi
cmp dword [0x10241d8], esi
je 0x101c98f
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
jmp 0x101ca65
push edi
mov edi, dword [ebp + 0x14]
push dword [edi]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x10]
call fcn.0101dadb
cmp dword [ebp + 0x20], esi
je 0x101ca1c
mov esi, dword [ebp + 0x24]
mov eax, dword [esi]
shr eax, 1
push eax
push dword [ebp + 0x20]
lea ecx, [ebp - 0x218]
call fcn.0101dadb
push esi
push dword [ebp - 0x214]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp - 0x42c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test ebx, ebx
jne 0x101ca0f
cmp dword [ebp + 0x14], 1
jne 0x101c9fc
lea ecx, [ebp - 0x218]
call fcn.0101da1f
shl eax, 1
mov dword [esi], eax
jmp 0x101ca0f
cmp dword [ebp + 0x14], 3
jne 0x101ca0f
push dword [esi]
lea ecx, [ebp - 0x218]
call fcn.0101da59
lea ecx, [ebp - 0x218]
call fcn.0101daf8
jmp 0x101ca3c
push dword [ebp + 0x24]
lea eax, [ebp + 0x14]
push esi
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp - 0x42c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test ebx, ebx
jne 0x101ca4d
lea ecx, [ebp - 0x430]
call fcn.0101da4e
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop edi
je 0x101ca5a
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
lea ecx, [ebp - 0x430]
call fcn.0101daf8
pop esi
mov eax, ebx
pop ebx
leave
ret 0x20
Function at 0x101cad1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
cmp dword [0x10241d8], 0
je 0x101cb00
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x101cbee
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x430]
call fcn.0101daa2
mov esi, dword [ebp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg esi
sbb esi, esi
lea eax, [ebp + 0xc]
and esi, eax
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x101cbde
cmp dword [ebp - 4], eax
jbe 0x101cbc5
cmp dword [ebp - 4], 2
ja 0x101cbc5
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x101cb5a
mov eax, dword [eax]
shr eax, 1
jmp 0x101cb5c
xor eax, eax
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x21c]
call fcn.0101dadb
mov eax, dword [ebp - 8]
push esi
push dword [ebp - 0x218]
add eax, eax
push dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x101cb9e
lea ecx, [ebp - 0x21c]
call fcn.0101daf8
jmp 0x101cbde
cmp dword [ebp - 0x218], 0
je 0x101cbb5
lea ecx, [ebp - 0x21c]
call fcn.0101da1f
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x101cb91
mov ecx, dword [ebp + 0xc]
add ecx, ecx
mov dword [eax], ecx
jmp 0x101cb91
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
lea ecx, [ebp - 0x430]
call fcn.0101d8b8
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18

Function at 0x101cbf2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
cmp dword [0x10241d8], 0
je 0x101cc1e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101cc98
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x428]
call fcn.0101daa2
cmp dword [ebp + 0x14], 1
mov esi, dword [ebp + 0x18]
je 0x101cc40
cmp dword [ebp + 0x14], 2
je 0x101cc40
xor eax, eax
jmp 0x101cc42
mov eax, esi
push eax
lea ecx, [ebp - 0x214]
call fcn.0101daa2
cmp dword [ebp - 0x210], 0
je 0x101cc63
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x210]
inc eax
jmp 0x101cc66
mov eax, dword [ebp + 0x1c]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x424]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0101d8b8
lea ecx, [ebp - 0x428]
call fcn.0101d8b8
mov eax, esi
pop esi
leave
ret 0x18