joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ca80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xffff0000
push ebx
push esi
movzx eax, cx
mov esi, ecx
sub esi, eax
test eax, eax
push edi
mov edi, dword [ebp + 8]
cmove esi, ecx
cmp esi, edi
jbe 0x1006cb3e
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x1006cad4
mov esi, 0x4fff0000
jmp 0x1006cb3a
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006cb3e
cmp dword [ebp - 0x10], 0x10000
jne 0x1006cb25
cmp dword [ebp - 0x14], 0x10000
jb 0x1006cb25
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x1006cb40
sub esi, 0x10000
jmp 0x1006cb3a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov esi, ecx
movzx eax, si
sub esi, eax
test eax, eax
cmove esi, ecx
cmp esi, edi
ja 0x1006cac0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066f71
mov esp, ebp
pop ebp
ret

Function at 0x1006cb60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
push edi
test eax, eax
je 0x1006cb85
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1006cc20
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop word [eax + eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x1006cbb4
mov esi, 0x80010000
jmp 0x1006cc1c
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006cc20
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x1006cc07
cmp ecx, 0x10000
jb 0x1006cc07
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x1006cc22
add esi, 0x10000
jmp 0x1006cc1c
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x1006cc1c
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x1006cba0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066f71
mov esp, ebp
pop ebp
ret
Function at 0x1006cc40
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x1006cc5c
mov ebx, 0x10000
lea edi, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x1006cc6f
mov edi, 0xfff80000
mov eax, dword [0x100f855c]
mov ecx, dword [0x100f8558]
test eax, eax
jne 0x1006cc89
test ecx, ecx
je 0x1006cc9c
mov eax, ecx
mov dword [0x100f855c], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x1006cc9c
cmp edx, ebx
jb 0x1006cc9c
cmp edx, edi
jbe 0x1006cda0
mov eax, ecx
mov dword [0x100f855c], eax
test ecx, ecx
je 0x1006ccca
test eax, eax
je 0x1006ccbe
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1006ccbe
cmp ecx, ebx
jb 0x1006ccbe
cmp ecx, edi
jbe 0x1006cda0
mov eax, dword [eax + 4]
mov dword [0x100f855c], eax
test eax, eax
jne 0x1006ccab
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x1006ccf2
lea eax, [esi - 0x40000000]
push eax
push ebx
call fcn.1006ca80
add esp, 8
test eax, eax
jne 0x1006cd5c
cmp esi, 0x40000000
jae 0x1006cd08
lea eax, [esi + 0x40000000]
push edi
push eax
call fcn.1006cb60
add esp, 8
test eax, eax
jne 0x1006cd5c
cmp esi, 0x40000000
jbe 0x1006cd2a
lea eax, [esi - 0x40000000]
push esi
push eax
call fcn.1006cb60
add esp, 8
test eax, eax
jne 0x1006cd5c
cmp esi, 0x40000000
jae 0x1006cd40
lea eax, [esi + 0x40000000]
push eax
push esi
call fcn.1006ca80
add esp, 8
test eax, eax
jne 0x1006cd5c
push esi
push ebx
call fcn.1006ca80
add esp, 8
test eax, eax
jne 0x1006cd5c
push edi
push esi
call fcn.1006cb60
add esp, 8
test eax, eax
je 0x1006cdc8
mov dword [eax], 0x52727464
xor edx, edx
mov dword [eax + 8], 0
mov esi, 0x38b
mov ecx, dword [0x100f8558]
mov dword [eax + 4], ecx
lea ecx, [eax + 0xffa8]
mov dword [0x100f855c], eax
mov dword [0x100f8558], eax
nop dword [eax]
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
sub esi, 1
jne 0x1006cd90
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x1006cdc8
cmp esi, edi
ja 0x1006cdc8
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.1008e100
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1006ce00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100eaff0
push 0x1008f820
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100f2384]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
push 0x1c
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x1006ce99
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1006ce99
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x1006ce99
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x1006ce99
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1006cea2
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
Function at 0x1006d330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100f8568], 0
jne 0x1006d3ae
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x100f8568
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x1006d3ae
push esi
mov esi, dword [0x100f8558]
mov dword [0x100f8578], eax
mov dword [0x100f8574], eax
mov dword [0x100f856c], eax
mov dword [0x100f8570], eax
test esi, esi
je 0x1006d39d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x1006d387
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
Function at 0x1006d870
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100f856c]
test eax, eax
jne 0x1006d8f2
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x1006d891
xor eax, eax
pop edi
pop ebp
ret 4
push esi
push 8
call fcn.10066f87
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006d8a7
lea edi, [eax + 8]
jmp 0x1006d8c6
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1006d8de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 8
push esi
call fcn.10066bf2
add esp, 8
pop esi
mov dword [0x100f856c], edi
mov eax, edi
mov dword [0x100f8570], 0
pop edi
pop ebp
ret 4
mov eax, dword [0x100f8574]
mov dword [esi + 4], edi
mov dword [esi], eax
xor eax, eax
mov dword [0x100f8574], esi
pop esi
pop edi
pop ebp
ret 4

Function at 0x1006dee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x1006deef
pop ebp
jmp fcn.1006e7e0
xor eax, eax
pop ebp
ret 0xc
Function at 0x1006eae0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf533
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x1006eb85
cmp word [esi], di
je 0x1006eb85
test eax, eax
je 0x1006eb41
cmp word [eax], di
je 0x1006eb41
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x1006eb85
jmp 0x1006eb80
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1008e100
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x1006eb85
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1006ebfc
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x1006ebe7
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x1006ebb5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x1006ebd6
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1006ec1c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x1006ebe7
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1006ebfc
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret 0x30
call fcn.10043e25
int3

Function at 0x1006f770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x1006f785
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006f790
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10070110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x100701d7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10070125
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100718d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf7e3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x100f23a4]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10071820
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10071ab1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.1008e100
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100d2154
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10071ab1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x100719a5
cmp eax, 2
jne 0x10071ab1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x100719c6
test cl, 1
jne 0x10071ab1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x100719cc
jmp 0x10071ab1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10071ab1
call fcn.10006280
mov ecx, eax
test ecx, ecx
je 0x10071adc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.1006fd10
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100d215c
push eax
call fcn.10071f50
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.10070110
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x10071a95
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10071a36
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10071af0
push dword [0x100f23ac]
lea eax, [ebp - 0x74]
push dword [0x100f23a8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10071a72
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10071a8e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10071ab3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10071ab1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x10071abe
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100058e0
int3
Function at 0x10071c50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf818
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f2384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100f23a4]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10071820
test eax, eax
je 0x10071d78
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10071d23
cmp dword [esi], 0
je 0x10071d16
push 0x100d2008
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10071ce3
mov eax, 1
jmp 0x10071d44
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071d1c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x10071d44
cmp dword [esi + 4], 0
jne 0x10071d23
mov eax, 1
jmp 0x10071d44
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10071d6e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10071d56
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x10071d7b
xor ebx, ebx
jmp 0x10071e1f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x10071e1f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10071dd8
mov ecx, dword [ebx]
test ecx, ecx
je 0x10071e3e
push ecx
push eax
call fcn.10091d0e
add esp, 8
test eax, eax
je 0x10071dd8
mov edx, dword [edi]
test edx, edx
je 0x10071dd8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10071db0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10071de3
lea eax, [edx + 0xd]
jmp 0x10071e18
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10071df0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100d2154
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x10071e2a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100058e0
int3
Function at 0x100734d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10073541
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1007350f
cmp eax, 2
jne 0x1007352b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1007353b
test ecx, ecx
je 0x10073536
test cl, 1
jne 0x1007352b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1007353b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10074bd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x10074dd4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10074dd4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.1008e100
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x10074da9
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10074d98
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x10074d62
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10074d5a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.1008e100
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.10074df0
add esp, 0x18
test eax, eax
je 0x10074d5a
cmp byte [ebp - 0x68], 0
je 0x10074d1c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x10074d5a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x10074d49
mov al, byte [esi + ecx]
test al, al
je 0x10074d49
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10074d30
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10074c70
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x10074dd4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.10075dc0
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.10066f71
mov esp, ebp
pop ebp
ret
Function at 0x10074f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100f2384]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1007508f
cmp dword [ebp + 0xc], 0x20
jb 0x1007508f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.1008e100
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x100d255c
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1007508f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10074fa0
sub ecx, edx
cmp ecx, 0x40
jne 0x1007508f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x10074fdc
mov al, byte [esi + ecx]
test al, al
je 0x10074fdc
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10074fc6
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x10075019
mov al, byte [esi + ecx]
test al, al
je 0x10075019
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10075000
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.1008e100
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.100750a0
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x1007508f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.10075dc0
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066f71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10066f71
mov esp, ebp
pop ebp
ret