joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ca50
Capabilities:
Get disk size

Disassembly:
sub esp, 0x44
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
push ebx
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x1006cb6f
cmp byte [eax], bl
je 0x1006cb6f
lea edx, [esp + 0x3c]
sub edx, eax
jmp 0x1006caa0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1006caa0
lea esi, [esp + 0x3c]
call fcn.10049c80
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1006caf8
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x38]
push ecx
mov edx, esi
push edx
call eax
cmp eax, ebx
je 0x1006cb5b
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebx
push 0x400
push eax
push ecx
jmp 0x1006cb43
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp eax, ebx
je 0x1006cb5b
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x14]
push ebx
push 0x400
xor ecx, ecx
push ecx
push eax
call fcn.1011e460
push ebx
push 0x400
push edx
push eax
call fcn.1011e460
mov dword [esp + 0x1c], edx
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1010d699
add esp, 0x44
ret
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x44
ret
Function at 0x1006d340
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016c450
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0x200
mov dword [ebp - 0x1c], 0x80
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
jne 0x1006d3ba
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1017455c
call fcn.1011b2a8
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
push 0x200
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x1006d462
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + ecx]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x20], esi
je 0x1006d462
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push esi
lea edx, [ebp - 0x28]
push edx
push edi
mov eax, dword [ebp + 8]
push eax
xor eax, eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1006d452
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1006d462
mov ecx, dword [ebp - 0x28]
push ecx
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x1006d462
mov edx, dword [ebp - 0x1c]
lea eax, [edx + edx]
push eax
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x1006d3f1
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.10069e20
add esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.1006d4af
test esi, esi
je 0x1006d47e
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1006d48e
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006d9b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x11]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], bl
call fcn.10116880
add esp, 0xc
cmp esi, ebx
jne 0x1006da39
cmp ebp, ebx
je 0x1006da20
mov ecx, dword [str.Invalid_Buffer...]
mov dword [ebp], ecx
mov edx, dword [0x10158358]
mov dword [ebp + 4], edx
mov eax, dword [0x1015835c]
mov dword [ebp + 8], eax
mov ecx, dword [0x10158360]
mov dword [ebp + 0xc], ecx
mov dx, word [0x10158364]
mov word [ebp + 0x10], dx
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1010d699
add esp, 0x10c
ret
mov eax, dword [esp + 0x118]
push edi
push eax
lea ecx, [esp + 0x14]
push str..PhysicalDrive_d
push ecx
call fcn.1010d6a8
push ebx
push 3
push 3
push closesocket
lea edi, [esp + 0x2c]
call fcn.10033690
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x1006daa1
cmp ebp, ebx
je 0x1006da87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MyCreateFileA_failed___d_
push ebp
call fcn.1010d6a8
add esp, 0xc
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1010d699
add esp, 0x10c
ret
mov eax, dword [0x1019369c]
push ebx
cmp eax, ebx
je 0x1006dabb
lea edx, [esp + 0x10]
push edx
push 0x200
push esi
push edi
call eax
jmp 0x1006dacd
lea eax, [esp + 0x10]
push eax
push 0x200
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x1006dad8
mov ebx, 1
jmp 0x1006daf1
cmp ebp, ebx
je 0x1006daf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MyReadFile_failed___d_
push ebp
call fcn.1010d6a8
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x114]
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x10c
ret
Function at 0x1006e140
Capabilities:
Set file attributes

Disassembly:
mov eax, esi
call fcn.10044c10
cmp eax, 0xffffffff
jne 0x1006e14f
xor eax, eax
ret
test al, 7
je 0x1006e163
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1006e14c
mov eax, 1
ret
Function at 0x1006e520
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x104
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, ecx
mov eax, esi
mov byte [esp + 4], 0
call fcn.10044c10
cmp eax, 0xffffffff
je 0x1006e558
test al, 7
je 0x1006e558
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
call fcn.10033960
cmp eax, 1
jne 0x1006e57a
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.1010d699
add esp, 0x104
ret
push ebx
push esi
mov ebx, 0x14
call sym.EncDec.dll_IsFileOnFixedDrive
test eax, eax
jne 0x1006e58d
lea ebx, [eax + 1]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov eax, esi
call fcn.10033960
cmp eax, 1
je 0x1006e5dc
sub ebx, 1
jne 0x1006e594
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100
mov edi, eax
lea esi, [esp + 0x10]
call fcn.10049ce0
add esp, 4
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.1010d699
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
pop esi
xor ecx, esp
mov eax, 1
call fcn.1010d699
add esp, 0x104
ret

Function at 0x1006f620
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x10135608
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x80], ebx
xor eax, eax
cmp dword [esp + 0xa0], 0x10
mov dword [esp + 0x65], eax
mov dword [esp + 0x69], eax
mov dword [esp + 0x6d], eax
mov word [esp + 0x71], ax
mov byte [esp + 0x73], al
mov eax, dword [esp + 0x8c]
mov byte [esp + 0x64], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
jae 0x1006f6b7
lea eax, [esp + 0x8c]
mov ecx, dword [esp + 0x9c]
push eax
lea edx, [esp + 0x10]
call fcn.1006eb70
cmp eax, 1
jne 0x1006f6e2
lea edx, [esp + 0xc]
lea ecx, [esp + 0x64]
call fcn.1006ec90
test eax, eax
jne 0x1006f6e2
mov byte [esp + 0x64], bl
lea eax, [esp + 0x64]
push eax
mov ebx, esi
call fcn.1006f730
cmp dword [esp + 0xa0], 0x10
jb 0x1006f708
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.1010e8a3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.1010d699
add esp, 0x7c
ret 0x1c
Function at 0x1006f7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10135a28
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov dword [esp + 8], eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.10009000
call fcn.1006f620
cmp dword [esp + 0x34], 0x10
jb 0x1006f84a
mov ecx, dword [esp + 0x20]
push ecx
call fcn.1010e8a3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x1006f860
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x101359e8
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push esi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0x47c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x484], ebx
cmp dword [esp + 0x4a4], 0x10
mov eax, dword [esp + 0x490]
jae 0x1006f8be
lea eax, [esp + 0x490]
push 0x10148b5c
push eax
call fcn.1010ebfe
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x1006f908
push 2
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push 0x101532e0
mov ecx, edi
mov byte [edi + 4], bl
call fcn.100090e0
cmp dword [esp + 0x4a4], 0x10
jb 0x1006f9b8
mov eax, dword [esp + 0x490]
push eax
jmp 0x1006f9b0
push esi
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.1010eeb5
add esp, 0x10
cmp eax, ebx
je 0x1006f97c
lea esp, [esp]
lea edx, [esp + 0x78]
push edx
mov ecx, eax
lea edx, [esp + 0x14]
call fcn.1006eb70
push esi
push 0x400
lea eax, [esp + 0x80]
push 1
push eax
call fcn.1010eeb5
add esp, 0x10
cmp eax, ebx
jne 0x1006f950
lea edx, [esp + 0x10]
lea ecx, [esp + 0x68]
call fcn.1006ec90
push esi
call fcn.1010f263
add esp, 4
lea ecx, [esp + 0x68]
push ecx
mov ebx, edi
call fcn.1006f730
cmp dword [esp + 0x4a4], 0x10
jb 0x1006f9b8
mov edx, dword [esp + 0x490]
push edx
call fcn.1010e8a3
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x47c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.1010d699
add esp, 0x47c
ret 0x1c
Function at 0x10071460
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xe0
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0xe4]
push edi
mov edi, edx
xor edx, edx
cmp eax, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x1c], 0xc3d2e1f0
jle 0x100714c4
push esi
push eax
push ecx
lea esi, [esp + 0x10]
call fcn.10071270
add esp, 8
pop esi
lea ecx, [esp + 4]
call fcn.10071310
mov ecx, dword [esp + 0xe0]
pop edi
xor ecx, esp
call fcn.1010d699
add esp, 0xe0
ret

Function at 0x10071550
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x10135bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x1017455c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
push 1
call fcn.1010ea1a
add esp, 4
mov dword [esp + 0x3c], eax
xor ebx, ebx
mov dword [esp + 0x80], ebx
cmp dword [0x101a2bb8], ebx
jne 0x100715c2
push 0x101a2bbc
push str.MD5Log
mov ecx, str.SOFTWAREMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x101a2bb8], 1
call fcn.10031670
cmp dword [0x101a2bbc], ebx
je 0x100716a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebx
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x60], eax
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x68], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100715f6
sub eax, edi
push eax
push esi
call fcn.100090e0
xor ecx, ecx
xor edx, edx
call fcn.1006f9f0
mov edi, eax
cmp esi, ebx
je 0x10071661
cmp byte [esi], bl
je 0x10071661
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x38]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
test eax, eax
jge 0x10071635
fadd qword [0x10169598]
fdiv qword [0x10169580]
sub esp, 8
fstp qword [esp]
push esi
push str._MD5__File:_s___.2f_Secs_
push ebx
call fcn.10053700
mov eax, dword [esp + 0x50]
add esp, 0x14
push eax
call fcn.1010e8a3
mov eax, edi
jmp 0x100716ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x38]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
test eax, eax
jge 0x1007167d
fadd qword [0x10169598]
fdiv qword [0x10169580]
sub esp, 8
fstp qword [esp]
push str._MD5__Handle___.2f_Secs_
push ebx
call fcn.10053700
mov eax, dword [esp + 0x4c]
add esp, 0x10
push eax
call fcn.1010e8a3
mov eax, edi
jmp 0x100716ea
push ebx
push ebx
push edi
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x68], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100716c3
sub eax, edi
push eax
push esi
call fcn.100090e0
xor ecx, ecx
xor edx, edx
call fcn.1006f9f0
mov ecx, dword [esp + 0x3c]
push ecx
mov esi, eax
call fcn.1010e8a3
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10071a10
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0xc40
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0xc3c], eax
push ebx
push ebp
push edi
xor ebx, ebx
push 0x40f
lea eax, [esp + 0x1d]
mov edi, ecx
push ebx
push eax
mov dword [esp + 0x20], edi
mov byte [esp + 0x24], bl
call fcn.10116880
push 0x40f
lea ecx, [esp + 0x439]
push ebx
push ecx
mov byte [esp + 0x440], bl
call fcn.10116880
push 0x40f
lea edx, [esp + 0x855]
push ebx
push edx
mov byte [esp + 0x85c], bl
call fcn.10116880
add esp, 0x24
xor ebp, ebp
cmp edi, ebx
je 0x10071b9b
cmp byte [edi], bl
je 0x10071b9b
push esi
lea eax, [esp + 0x83c]
push str.TypeLib
push eax
call fcn.1010d6a8
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 9
push ebx
lea edx, [esp + 0x848]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x10071b80
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x410
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
xor esi, esi
mov byte [esp + 0x2c], bl
call ebp
test eax, eax
jne 0x10071b48
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x42c], bl
je 0x10071b2d
lea edx, [esp + 0x42c]
call fcn.1006e8d0
test eax, eax
je 0x10071b2d
mov ecx, edi
mov edi, edx
call fcn.10071bc0
test eax, eax
jne 0x10071b70
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0x410
lea ecx, [esp + 0x20]
push ecx
inc esi
push esi
push edx
mov byte [esp + 0x2c], bl
call ebp
test eax, eax
je 0x10071af0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ebp, ebx
pop edi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0xc3c]
xor ecx, esp
call fcn.1010d699
add esp, 0xc40
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 1
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0xc3c]
xor ecx, esp
call fcn.1010d699
add esp, 0xc40
ret
mov ecx, dword [esp + 0xc48]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0xc40
ret
Function at 0x10073070
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
push str.BDUpdateServiceCom.dll
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10193c28], eax
test eax, eax
jne 0x100730cc
test edi, edi
je 0x100730b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ESUPD__Failed_to_load_library_BDUpdateServiceCom.dll___GetLastError__:__d_
push edi
call fcn.1010d6a8
add esp, 0xc
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1010d699
add esp, 0x20c
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BDUpdSdkCreate
push eax
call esi
mov dword [0x10193e38], eax
mov eax, dword [0x10193c28]
push str.BDUpdSdkDestroy
push eax
call esi
mov ecx, dword [0x10193c28]
push str.BDUpdSdkSetOption
push ecx
mov dword [0x10193e3c], eax
call esi
mov edx, dword [0x10193c28]
push str.BDUpdSdkPerformUpdate
push edx
mov dword [0x10193e40], eax
call esi
mov dword [0x10193e44], eax
mov eax, dword [0x10193c28]
push str.BDUpdSdkPerformInstall
push eax
call esi
mov ecx, dword [0x10193c28]
push str.BDUpdSdkStop
push ecx
mov dword [0x10193e48], eax
call esi
cmp dword [0x10193e38], 0
mov dword [0x10193e4c], eax
je 0x10073210
cmp dword [0x10193e3c], 0
je 0x10073210
cmp dword [0x10193e40], 0
je 0x10073210
cmp dword [0x10193e44], 0
je 0x10073210
cmp dword [0x10193e48], 0
je 0x10073210
test eax, eax
je 0x10073210
push 0x103
lea edx, [esp + 0x111]
push 0
push edx
mov byte [esp + 0x118], 0
call fcn.10116880
add esp, 0xc
lea ecx, [esp + 0x10c]
call fcn.1004d810
test eax, eax
jne 0x100731f4
push 0x103
push eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
call fcn.10116880
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0xc]
call fcn.10049ce0
mov ecx, esi
push ecx
push str._GETUPD__Winsock_Load_Error__Reason:__s
push 0
call fcn.10053700
add esp, 0x10
pop esi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1010d699
add esp, 0x20c
ret
test edi, edi
je 0x10073222
push str._ESUPD__GetProcAddress_Failed_to_get_func_addr..
push edi
call fcn.1010d6a8
add esp, 8
mov ecx, dword [esp + 0x210]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x20c
ret
Function at 0x10076620
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x404
push 0xfffffffffffffffe
push 0x1016de60
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x3ff
push ebx
lea eax, [ebp + 1]
push eax
call fcn.10116880
add esp, 0xc
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x100766a5
push str._SetErrorStatus__Invalid_Url__
push 0x10193e68
call fcn.10053700
add esp, 8
mov dword [ebp - 4], 0xfffffffe
jmp 0x10076825
mov ecx, esi
lea edx, [ebp]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x100766b0
push 0x2f
lea ecx, [ebp]
push ecx
call fcn.1010d780
add esp, 8
mov esi, eax
cmp esi, ebx
jne 0x100766f0
lea edx, [ebp]
push edx
push str._SetErrorStatus__Invalid_url__A__:___s_
push 0x10193e68
call fcn.10053700
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x10076817
add esi, 2
cmp byte [esi], bl
jne 0x10076719
lea eax, [ebp]
push eax
push str._SetErrorStatus__Invalid_url__B__:___s_
push 0x10193e68
call fcn.10053700
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x10076817
push 0x2f
push esi
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x1007672a
mov byte [eax], bl
lea ecx, [ebp - 0x1c]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicroWorld
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x100767d1
mov dword [ebp - 0x20], 1
push 4
lea edx, [ebp - 0x20]
push edx
push 4
push ebx
push str.BDUpdDownloadFailed
mov eax, dword [ebp - 0x1c]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
cmp eax, ebx
je 0x10076788
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SetErrorStatus__Failed_to_set_value_BDUpdDownloadFailed___GetLastError__:__u_
jmp 0x100767dd
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10076790
sub eax, edx
inc eax
push eax
push esi
push 1
push ebx
push str.BDUpdDownloadHost
mov ecx, dword [ebp - 0x1c]
push ecx
call edi
cmp eax, ebx
je 0x100767ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._SetErrorStatus__Failed_to_set_value_BDUpdDownloadHost___HostName_:__s___GetLastError__:__u_
push 0x10193e68
call fcn.10053700
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
jmp 0x10076817
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SetErrorStatus__Failed_to_Open_RegKey_HKLMSoftwareMicroworld___GetLastError__:__u_
push 0x10193e68
call fcn.10053700
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x10076817
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x10076825
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x404
mov esp, ebp
pop ebp
ret