joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60206da8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
push ebx
xor ebx, ebx
cmp word [0x60221250], bx
jne 0x60206e16
mov al, byte [0x60221034]
test al, 2
push esi
push edi
je 0x6020d08d
push 0x60206e40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
cmp eax, ebx
je 0x60206ded
push 0x60206e24
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call ecx
mov ebx, eax
test bx, bx
je 0x6020d164
mov esi, 0x60221238
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov word [0x60221250], bx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov ax, word [0x60221250]
pop ebx
add ebp, 0x78
leave
ret
test al, 1
je 0x6020d0c2
xor eax, eax
mov word [ebp + 0x6c], bx
lea edi, [ebp + 0x70]
stosd dword es:[edi], eax
lea eax, [ebp + 0x6c]
push eax
push 0x6021d8de
push 1
push 0x10
push 0x6020d1d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
mov ebx, dword [ebp + 0x6c]
jmp 0x60206df1
test al, 0xc
je 0x6020d164
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp + 0x74]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x6020d174
push 0x80000003
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x70], 0x80
call esi
test eax, eax
jne 0x6020d114
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x14]
push eax
xor esi, esi
push esi
push esi
push esi
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6020d156
push 0x10
push esi
jmp 0x6020d148
lea eax, [ebp + 0x74]
push eax
push edi
push 0
push 0x6020d1a4
push 0x80000002
call esi
test eax, eax
jne 0x6020d156
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6020d156
push 0x10
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.60209bd4
add esp, 0xc
mov ebx, eax
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x60206df1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ebx, eax
jmp 0x60206dfa
Function at 0x60206f72
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
and dword [ebp - 4], 0
push ebx
push edi
mov edi, 0x60221238
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.60206da8
mov ebx, eax
cmp bx, 0x409
jne 0x6020d1da
push edi
mov dword [0x60221224], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x6020d262
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x6020d262
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x6020d2ec
lea eax, [ebp - 0x108]
push eax
call esi
movzx eax, bx
push eax
lea eax, [ebp - 0x414]
push 0x6020d31c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call esi
push 0x6020d2fc
lea eax, [ebp - 0x108]
push eax
call esi
test byte [0x60221034], 1
lea eax, [ebp - 0x20c]
je 0x6020d278
push 0x6020d304
jmp 0x6020d27d
push 0x6020d310
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.6021d904
test eax, eax
pop esi
je 0x6020d2d7
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.6021d904
test eax, eax
je 0x6020d2d7
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x60206f9f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
jmp 0x60206f9f

Function at 0x602084aa
Capabilities:
Find taskbar

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
push ebp
push esi
xor ebp, ebp
push ebp
push 0x60208530
mov esi, ecx
call ebx
cmp eax, ebp
mov dword [esi + 0x1c], eax
je 0x60208512
push esi
push 0x6020853e
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [esi + 0x20], ebp
je 0x60208512
push edi
push 0x60208520
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
mov dword [0x602212ec], eax
push dword [esi + 0x1c]
call edi
push ebp
push 0x60208518
mov dword [esi + 0x24], eax
call ebx
push ebp
push eax
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
jmp 0x6020850e
Function at 0x60208f10
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x602215c0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x60208fb9
call ebp
mov esi, eax
cmp esi, ebx
je 0x6020b5db
mov dword [0x602215c0], 1
cmp esi, ebx
je 0x6020b5f7
cmp word [esi], bx
mov eax, esi
je 0x60208f62
inc eax
inc eax
cmp word [eax], bx
jne 0x60208f54
inc eax
inc eax
cmp word [eax], bx
jne 0x60208f54
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x60208fa9
push ebp
call fcn.602095dc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x60208fa9
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x6020b604
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x6020b617
jmp 0x60208f45
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x6020b66b
mov dword [0x602215c0], 2
jmp 0x6020b61c
call ebp
mov esi, eax
cmp esi, ebx
je 0x6020b66b
jmp 0x60208f4d
push dword [esp + 0x10]
call fcn.602090aa
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x60208fa5
cmp eax, 2
jne 0x6020b66b
cmp edi, ebx
jne 0x6020b62c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x6020b66b
cmp byte [edi], bl
mov eax, edi
je 0x6020b63c
inc eax
cmp byte [eax], bl
jne 0x6020b632
inc eax
cmp byte [eax], bl
jne 0x6020b632
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.602095dc
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x6020b652
xor esi, esi
jmp 0x6020b65d
push ebp
push edi
push esi
call fcn.60213f23
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x60208fb2
xor eax, eax
jmp 0x60208fb2
Function at 0x6020921f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x60221490], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0xc], 2
sete al
test al, 1
je 0x602092d7
cmp dword [ebp - 0x18], 5
jb 0x602092d7
push 2
pop ecx
or eax, ecx
test al, 2
je 0x6020926c
cmp dword [ebp - 0x14], 1
jae 0x602092db
xor ecx, ecx
or eax, ecx
test al, 1
je 0x602092e2
xor ecx, ecx
or eax, ecx
test al, 9
je 0x602092ed
xor ecx, ecx
or eax, ecx
mov ecx, dword [0x60221490]
cmp ecx, 0x3a4
mov dword [0x60221034], eax
je 0x602092f2
cmp ecx, 0x3a8
je 0x602092f2
cmp ecx, 0x3b4
jbe 0x602092ab
cmp ecx, 0x3b6
jbe 0x602092f2
test al, 2
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
je 0x602092c5
push 0x52
call esi
test eax, eax
je 0x602092c5
or dword [0x60221034], 0x20
push 0x2a
call esi
test eax, eax
pop esi
jne 0x6020a527
add ebp, 0x78
leave
ret
xor ecx, ecx
jmp 0x60209260
mov ecx, 0x80
jmp 0x6020926e
cmp dword [ebp - 0x14], 0xa
jb 0x60209274
jmp 0x6020a51f
push 4
pop ecx
jmp 0x6020927e
or eax, 0x10
mov dword [0x60221034], eax
jmp 0x602092ab
push 8
pop ecx
jmp 0x60209276
test byte [0x60221034], 2
jne 0x6020a537
or dword [0x60221034], 0x20
or dword [0x60221034], 0x40
jmp 0x602092d2

Function at 0x60209a65
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x6020b33a
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 1
mov dword [0x6022149c], eax
call fcn.60209e53
test eax, eax
pop ecx
je 0x60209af9
mov eax, dword [0x6022149c]
xor ecx, ecx
mov cl, byte [0x6022149d]
and eax, 0xff
shr dword [0x6022149c], 0x10
mov dword [0x602214a4], eax
mov dword [0x602214a8], ecx
shl eax, 8
add eax, ecx
mov dword [0x602214a0], eax
call fcn.60209ee4
test eax, eax
je 0x6020b330
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6022198c], eax
call fcn.60208f10
mov dword [0x60221498], eax
call fcn.60209d7f
call fcn.60209930
call fcn.602096a0
call fcn.60209afd
inc dword [0x60221494]
push 1
pop eax
ret 0xc
xor eax, eax
jmp 0x60209af6
call fcn.60213bc3
jmp 0x60209af9
xor ecx, ecx
cmp eax, ecx
jne 0x6020b373
cmp dword [0x60221494], ecx
jle 0x60209af9
dec dword [0x60221494]
cmp dword [0x602241c8], ecx
jne 0x6020b35f
call fcn.60213957
call fcn.60213b42
call fcn.60213a1d
call fcn.60213bc3
jmp 0x60209af3
cmp eax, 3
jne 0x60209af3
push ecx
call fcn.60213aa2
pop ecx
jmp 0x60209af3
Function at 0x60209b46
Capabilities:
Get geographical location

Disassembly:
call fcn.6020921f
push 0x60221238
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test byte [0x60221034], 0x80
jne 0x60209b69
mov dword [0x60221228], 1
cmp dword [0x60221108], 0
jne 0x60209b93
cmp dword [0x60221228], 0
mov eax, dword [esp + 4]
je 0x60209bcd
push dword [esp + 8]
mov dword [0x6022110c], eax
push 0x60221110
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.60206da8
push 0xa
mov esi, 0x60221214
push esi
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0xa
push 0
push esi
call fcn.60209bd4
and dword [0x60221224], 0
add esp, 0xc
mov dword [0x60221220], eax
pop esi
ret 8
mov dword [0x60221108], eax
jmp 0x60209b93

Function at 0x6020e107
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x6020e1a4
xor esi, esi
push 0x80000002
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x6020e19b
push edi
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 0x6020e1d4
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x6020e191
mov eax, dword [ebp - 8]
inc eax
push ebx
push eax
call fcn.60201469
mov ebx, eax
test ebx, ebx
pop ecx
je 0x6020e190
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 4]
call esi
push 4
push ebx
push 0x6020e1cc
call fcn.602138be
add esp, 0xc
test eax, eax
jne 0x6020e189
mov dword [ebp - 0xc], 1
push ebx
call fcn.60201498
pop ecx
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x602119a7
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x28c
mov eax, dword [ebp + 0x7c]
cmp eax, 0x7d0
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
push edi
jne 0x602119ce
call sub.MSCTF.dll_TF_RunInputCPL
jmp 0x60211b59
cmp eax, 0xcf
jne 0x602119ed
mov ecx, dword [0x602212dc]
test ecx, ecx
je 0x60211b59
call fcn.6020eef9
jmp 0x60211b59
cmp eax, 0x3e8
jb 0x60211a03
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + 0x10]
mov ebx, dword [ecx + eax*4 - 0xfa0]
jmp 0x60211a11
cmp ecx, eax
jbe 0x60211b59
mov ecx, dword [esi + 0x14]
mov ebx, dword [ecx + eax*4]
xor edi, edi
cmp ebx, edi
je 0x60211b59
xor eax, eax
cmp dword [ebx + 0x94], edi
setne al
lea eax, [eax + eax + 1]
cmp eax, 1
mov dword [ebp + 0x70], eax
je 0x60211b1c
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x14]
cmp edx, edi
mov dword [ebp + 0x7c], edi
jle 0x60211a6b
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x60211a63
cmp ecx, ebx
je 0x60211a63
test byte [ecx + 0x2c], 4
jne 0x60211a63
cmp dword [ecx + 0x94], 0
jne 0x60211b14
inc edi
add eax, 4
cmp edi, edx
jl 0x60211a46
push 0x80
lea ecx, [ebp - 0x10]
mov eax, 0x140
push ecx
push eax
push dword [0x60221048]
mov dword [ebp - 0x14], eax
call fcn.6021db4c
push 0x200
lea ecx, [ebp - 0x214]
mov eax, 0x13f
push ecx
push eax
push dword [0x60221048]
mov dword [ebp - 0x218], eax
call fcn.6021db4c
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x6c]
push 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x214]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x60211b0a
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x104]
mov ecx, dword [eax]
push 8
push eax
call dword [ecx + 0x28]
push 0xf003f
push 0x6020d69c
push 0x80000001
lea ecx, [ebp + 0x7c]
call fcn.60207cf9
test eax, eax
jne 0x60211b0a
push 0x6020d688
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp + 0x7c]
call fcn.60207d2e
jmp 0x60211b59
lea ecx, [ebp + 0x7c]
call fcn.60207d2e
push dword [ebp + 0x70]
mov ecx, dword [esi + 8]
lea eax, [ebx + 0x1c]
mov edi, 0x9c
push eax
add ecx, edi
call fcn.60213268
cmp dword [ebp + 0x70], 1
jne 0x60211b48
mov ecx, dword [esi + 8]
push 1
lea eax, [ebx + 0x1c]
push eax
add ecx, edi
call fcn.6020599c
xor eax, eax
cmp dword [ebp + 0x70], 1
mov ecx, ebx
sete al
push eax
call fcn.602108ea
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x74
leave
ret 4
Function at 0x60212f76
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x40]
xor edi, edi
push eax
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push edi
push esi
push 0x60212f6a
push edi
push edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
je 0x60212fd6
push ebp
push 0x3c
pop ebp
jmp 0x60212fbc
mov eax, ebp
dec ebp
test eax, eax
je 0x60212fc1
push 0x1f4
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x3c], edi
je 0x60212fa9
cmp dword [esi + 0x3c], edi
pop ebp
jne 0x60212fcf
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0x38]
mov ecx, esi
call fcn.60212ec6
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x60212fe6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.60207cf9
cmp eax, esi
jne 0x6021305e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x60213027
lea eax, [ebp - 0x110]
push eax
call fcn.60212fe6
cmp eax, esi
jne 0x6021305d
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x60213017
call fcn.60207d2e
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.60207d2e
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x60213070
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 8]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 4]
je 0x6021317d
push edi
push edi
push 0xf003f
push edi
push edi
push 0x60207180
push 0x80000001
call fcn.6020eb84
test eax, eax
jne 0x6021317a
cmp ebx, edi
mov dword [ebp - 0xc], edi
jle 0x6021317a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x602130ca
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + 0xc]
imul esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add esi, dword [eax + 4]
lea eax, [ebp - 0x40]
push eax
push esi
mov dword [ebp - 8], edi
call fcn.602158a3
cmp dword [esi + 0x10], edi
jne 0x602130fc
cmp dword [esi + 0x20], edi
jne 0x602130fc
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 4]
call fcn.60212fe6
jmp 0x60213163
push edi
push edi
push 0xf003f
push edi
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.6020eb84
test eax, eax
jne 0x60213163
mov eax, dword [esi + 0x10]
cmp eax, edi
jne 0x6021312f
push 0x6020d7b0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x60213145
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push edi
push 0x6020d7b0
push dword [ebp - 8]
call ebx
xor eax, eax
cmp dword [esi + 0x20], edi
push 4
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push edi
push 0x6020d7bc
push dword [ebp - 8]
call ebx
lea ecx, [ebp - 8]
call fcn.60207d2e
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jl 0x602130c7
lea ecx, [ebp - 4]
call fcn.60207d2e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x60213ca4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x60221cb0
cmp edx, dword [eax]
je 0x60213cc6
add eax, 8
inc ecx
cmp eax, 0x60221d40
jl 0x60213cb7
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x60221cb0]
jne 0x60213df4
mov eax, dword [0x602241bc]
cmp eax, 1
je 0x60213dce
test eax, eax
jne 0x60213cf7
cmp dword [0x602241c0], 1
je 0x60213dce
cmp edx, 0xfc
je 0x60213df4
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x60213d2e
lea eax, [ebp - 0x1a4]
push 0x60213e44
push eax
call fcn.602090a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.602096d8
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x60213d71
lea eax, [ebp - 0x1a4]
push eax
call fcn.602096d8
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x60213e40
push edi
call fcn.602152b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x60213e24
push eax
call fcn.602090a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.6020b9e3
lea eax, [ebp - 0xa0]
push 0x60213e1e
push eax
call fcn.6020b9e3
push dword [esi + 0x60221cb4]
lea eax, [ebp - 0xa0]
push eax
call fcn.6020b9e3
push 0x12010
lea eax, [ebp - 0xa0]
push 0x60213df8
push eax
call fcn.602151f6
add esp, 0x2c
pop edi
jmp 0x60213df4
lea eax, [ebp + 8]
lea esi, [esi + 0x60221cb4]
push 0
push eax
push dword [esi]
call fcn.602096d8
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x60215b08
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], 0x100
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x60215b30
xor eax, eax
jmp 0x60215b96
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0xc], esi
jmp 0x60215b5c
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 4]
call fcn.60215b08
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x60215b78
mov dword [ebp - 8], 0x100
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
je 0x60215b3f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
cmp eax, esi
pop esi
jne 0x60215b96
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
leave
ret 8
Function at 0x60215b9a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x32]
push eax
push dword [ebp + 8]
call fcn.602158a3
test eax, eax
je 0x60215ccd
push ebx
push esi
push edi
mov esi, 0x60215cf4
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x60215c99
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push CopyImage
push edi
push edi
push edi
lea eax, [ebp - 0x38]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
je 0x60215cc8
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
inc eax
push eax
push dword [ebp + 0xc]
push 1
push edi
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
neg eax
sbb eax, eax
inc eax
and ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push CopyImage
push eax
push eax
push eax
push 0x60215ce4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
neg eax
sbb eax, eax
inc eax
and ebx, eax
je 0x60215c8e
push dword [ebp + 0x10]
call esi
inc eax
push eax
push dword [ebp + 0x10]
push 1
push 0
push 0
push dword [ebp + 8]
call edi
push dword [ebp + 0x14]
neg eax
sbb eax, eax
inc eax
and ebx, eax
call esi
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push 0x60215cd4
push dword [ebp + 8]
call edi
push dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
and ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x60215cc8
lea eax, [ebp - 0x38]
push eax
push 0x80000000
call fcn.60215b08
test eax, eax
jne 0x60215cc6
cmp dword [ebp + 0x18], edi
je 0x60215cc1
push dword [ebp + 0x18]
push 0x80000002
call fcn.60215b08
test eax, eax
jne 0x60215cc6
xor ebx, ebx
inc ebx
jmp 0x60215cc8
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14