joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x10018b8b
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x100189f7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10018a37
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x10018a37
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x10018a22
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.10018690
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x10018a37
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x10018b1b
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.10017e60
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x10018ae4
cmp ecx, 3
jb 0x10018ae4
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x10018a80
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x10018b36
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x10018b36
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.10017e60
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x10018b6d
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x10018b4d
lea ecx, [eax + esi + 0x1af70]
jmp 0x10018b4f
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 0
sub edi, eax
push ecx
mov eax, esi
call fcn.10017cb0
mov ecx, dword [esi + 0x6af84]
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x10018b7e
call fcn.10018830
cmp dword [esi + 0x6af90], 0
jne 0x100189a0
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x10018b9e
lea ecx, [eax + esi + 0x1af70]
jmp 0x10018ba0
xor ecx, ecx
mov edi, dword [esi + 0x6af84]
push 1
sub edi, eax
push ecx
mov eax, esi
call fcn.10017cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x10019787
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1001985d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001d290]
add ecx, 8
sub edx, 8
dec esi
jne 0x100197a0
pop edi
test edx, edx
je 0x1001987a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1001d290]
inc ecx
dec edx
jne 0x10019861
not eax
pop esi
ret
Function at 0x10019aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
je 0x10019b6c
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, ecx
jb 0x10019b4b
add ecx, ecx
cmp ecx, eax
jbe 0x10019ad0
mov edi, ecx
mov dword [ebp - 4], edi
jmp 0x10019ad5
mov dword [ebp - 4], eax
mov edi, eax
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x10019b0a
push edi
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x10019b17
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 0x300
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x20], edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x18]
push edi
push eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x10019b97
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x10019e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x58]
push edi
test ecx, ecx
je 0x10019ea7
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x10019ee4
sub edi, eax
cmp edi, edx
jbe 0x10019e7e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x4c]
add dword [esi + 0x60], edi
add dword [esi + 0x48], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.10019780
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10019edd
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10019ee4
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.10019780
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1001a060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov dword [ebp - 4], 0
lea ebx, [esi + 0x68]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x1001a0a7
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x1001a0fa
sub edi, eax
cmp edi, 0x4000
jbe 0x1001a095
mov edi, 0x4000
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [esi + 0x60], edi
jmp 0x1001a0c8
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1001a0f3
push 0
lea ecx, [ebp - 8]
push ecx
push 0x4000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001a0fa
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x4c]
add dword [esi + 0x48], edi
mov edx, edi
mov ecx, ebx
call fcn.10019780
mov dword [esi + 0x4c], eax
test edi, edi
je 0x1001a0fa
cmp edi, 0xffffffff
je 0x1001a0fa
push edi
push ebx
call fcn.10019aa0
cmp eax, edi
jne 0x1001a109
add dword [ebp - 4], edi
jmp 0x1001a075
mov dword [esi + 0xc], 0x1000000
mov edx, dword [ebp - 4]
pop edi
mov dword [esi + 0x64], edx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x60000
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a8d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0x10]
sub esp, 0x35c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp edx, ebx
je 0x1001a8f1
mov dword [esp + 0x10], edx
jmp 0x1001a8fb
lea eax, [esi + 0x800]
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x1001a913
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a904
sub eax, edi
mov dword [esp + 0x18], eax
jmp 0x1001a917
mov dword [esp + 0x18], ebx
cmp edx, ebx
je 0x1001a92f
mov eax, edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a920
sub eax, edx
mov dword [esp + 0x14], eax
jmp 0x1001a933
mov dword [esp + 0x14], ebx
cmp esi, ebx
je 0x1001aae0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001a940
sub eax, edx
add eax, 0x104
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001aae0
push esi
push str._s
push 0x104
push edi
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x1001aad9
mov edi, dword [ebp + 8]
cmp byte [esp + 0x4c], 0x2e
je 0x1001aac5
mov ecx, dword [ebp + 0x10]
mov eax, str._s_s
test ecx, ecx
jne 0x1001a9b6
mov eax, 0x1001c294
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x4c]
push edx
push ecx
push eax
mov eax, dword [esp + 0x1c]
push eax
call ebx
lea ecx, [esp + 0x5c]
push ecx
push esi
push str._s_s
push esi
call ebx
add esp, 0x20
test byte [esp + 0x20], 0x10
je 0x1001aa45
test edi, edi
jne 0x1001aa01
mov eax, dword [esp + 0x10]
push eax
push esi
push edi
mov dword [0x10023440], 0x10000
call fcn.1001a8d0
jmp 0x1001aaad
cmp dword [edi], 2
je 0x1001aa21
mov eax, dword [esp + 0x10]
push eax
push esi
push edi
mov dword [0x10023440], 0x80000
call fcn.1001a8d0
jmp 0x1001aaad
mov edx, dword [esp + 0x10]
mov ebx, dword [edi + 4]
push 4
push 0
push edx
call fcn.1001a120
mov dword [0x10023440], eax
mov eax, dword [esp + 0x10]
push eax
push esi
push edi
call fcn.1001a8d0
jmp 0x1001aaad
test edi, edi
jne 0x1001aa55
mov dword [0x10023440], 0x10000
jmp 0x1001aaad
cmp dword [edi], 2
je 0x1001aa66
mov dword [0x10023440], 0x80000
jmp 0x1001aaad
mov ebx, dword [edi + 4]
push 0x208
lea ecx, [esp + 0x164]
push 0
push ecx
call sub.MSVCRT.dll_memset
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0x104
push edx
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 2
push esi
lea ecx, [esp + 0x168]
push ecx
call fcn.1001a120
mov dword [0x10023440], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov byte [edx + esi], 0
mov byte [eax + ecx], 0
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001a99a
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ac10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x1001ac39
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x1001f100]
inc esi
xor eax, edx
dec ecx
jne 0x1001ac24
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x16bec90
Capabilities:
Encode data using xor

Disassembly:
jmp 0x16bec9a
pushal
call 0x16beca0
pop ebp
sub ebp, 0x10
sub ebp, 0x12bec90
jmp 0x16becb6
mov eax, 0x12bec90
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x3266fbb2
xor byte [eax], dl
inc eax
dec ecx
jne 0x16beccd
jmp 0x16bece0
cmp dword [edi + 0x39], edi
cmp ecx, dword [esi + 0x33b2b2b2]
jae 0x16bed35
mov dl, 0xb2
mov dl, 0xb1
jg 0x16becfb
mov ah, 0xb2
mov dl, 0xb2
or byte [edx + 0x45b2b2b2], bl
push eax
mov cl, 0x7a
cmp dword [ebx], esi
mov esi, 0xb1b2b2b2
mov dl, 0xb1
ja 0x16bece9
aas
salc
xchg esi, eax
dec esi
cmp esi, dword [esi + 0x43c6da96]
xchg ebx, eax
mov dl, 0xda
scasb al, byte es:[edi]
dec ecx
mov ebx, 0x969eb3b3
ficomp dword [0x5a3c3308]
mov bh, 0xb2
mov dl, 0xb2
pop ebx
pushfd
mov dl, 0xb2
mov dl, 0x3f
salc
xchg esi, eax
dec esi
cmp ebx, dword [esi + 0x395e3996]
aaa
mov edx, 0x39b2b2b2
daa
mov esi, 0x39b2b2b2
aas
mov byte [0x73b2b2b2], al
pop ebx
mov al, 0x83
mov al, 0x31
jo 0x16bed03
sti
mov ebp, 0x4d4d4637
dec ebp
out dx, eax
jo 0x16bed15
mov dl, 0x39
xchg esi, eax
mov dh, 0xb2
mov dl, 0xb2
fcmovb st(0), st(6)
inc ebx
xchg ebx, eax
mov dl, 0xda
scasb al, byte es:[edi]
dec ecx
mov ebx, 0x969eb3b3
aas
salc
xchg esi, eax
dec esi
cmp edi, dword [esi - 0x4d48a56a]
mov dl, 0xb2
pop ebx
xchg dword [eax + 0x3fe7b2b2], esi
ficom word [esi - 0x4138b24e]
dec ebp
invalid
Function at 0x1002fed6
Capabilities:
Copy file

Disassembly:
push 0x724
mov eax, 0x1005f727
call fcn.1004555b
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
mov edi, dword [ebp + 8]
mov dword [ebp - 0x72c], edi
mov dword [ebp - 0x728], esi
jb 0x1002ff01
mov eax, dword [esi]
jmp 0x1002ff03
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x1002ff0d
mov ecx, dword [edi]
jmp 0x1002ff0f
mov ecx, edi
xor edx, edx
cmp byte [ebp + 0x10], dl
sete dl
push edx
push eax
push ecx
mov dword [ebp - 0x730], edx
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
jne 0x1002ffd7
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
call ebx
cmp eax, 5
jne 0x1002ffa0
and dword [ebp - 4], 0
push 1
push 0x80
push esi
call fcn.100319b7
cmp dword [esi + 0x14], 8
jb 0x1002ff56
mov ecx, dword [esi]
jmp 0x1002ff58
mov ecx, esi
cmp dword [edi + 0x14], 8
jb 0x1002ff62
mov eax, dword [edi]
jmp 0x1002ff64
mov eax, edi
push dword [ebp - 0x730]
push ecx
push eax
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
jne 0x1002ffd7
or dword [ebp - 4], 0xffffffff
jmp 0x1002ffa0
push esi
push edi
push 0x10003e08
call ebx
push eax
push 0xf
lea ecx, [ebp - 0x724]
call fcn.100319b7
mov esi, eax
push 0x100629b4
lea eax, [ebp - 0x39c]
mov ecx, 0xe2
lea edi, [ebp - 0x39c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100319b7
call fcn.100455b4
ret 0xc

Function at 0x100319b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100319c6
pop dword [ebp - 0x28]
mov eax, 0x206718a1
add eax, 0xef9c0125
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x619fa18d
add dword [ebp - 0x38], 0xecb2a3be
mov dword [ebp - 0x34], 0x9efd2bcc
add dword [ebp - 0x34], 0x93362079
mov dword [ebp - 0x30], 0xc14c604b
sub dword [ebp - 0x30], 0x75001c1d
mov dword [ebp - 0x2c], 0x871ca8b
add dword [ebp - 0x2c], 0xf78e3575
lea eax, [ebp - 0x38]
push eax
mov eax, 0x8f1e2a05
add eax, 0x80e1e883
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x81cbb022
add dword [ebp - 0x38], 0xf2a6b934
mov dword [ebp - 0x34], 0x5819f0b9
add dword [ebp - 0x34], 0xe95270bc
mov dword [ebp - 0x30], 0x90876b72
sub dword [ebp - 0x30], 0x2d17ff06
mov dword [ebp - 0x2c], 0x65452e9c
sub dword [ebp - 0x2c], 0x65452e9c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x5b219700
add eax, 0xb4de7b4c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x4ca05
push 0
call eax
mov ecx, 0x539c
mov edi, eax
mov edx, 0x100d2400
add edx, dword [ebp - 0x28]
mov esi, 0xa1784f98
xor dword [ebp - 0x1c], 0x9bbf9ccc
mov ebx, dword [edx]
mov dword [ebp - 8], 0x15ba2b13
xor ebx, esi
xor dword [ebp - 0xc], edx
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x10031ad6
add eax, 0x14143
mov ebx, eax
add eax, 0xde6c693c
add eax, 0x219396c9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10032013
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x74c
mov eax, 0x1005f975
call fcn.10045525
mov edi, ecx
cmp dword [edi + 0x24], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x758], eax
jne 0x10032068
push 0x10004bf0
push 0x3a
lea ecx, [ebp - 0x73c]
call fcn.100319b7
mov esi, eax
push 0x100629b4
lea eax, [ebp - 0x3b4]
mov ecx, 0xe2
lea edi, [ebp - 0x3b4]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100319b7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x744], 7
mov dword [ebp - 0x740], 1
jb 0x10032086
mov eax, dword [esi]
jmp 0x10032088
mov eax, esi
lea ecx, [ebp - 0x740]
push ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x744]
push ecx
push ebx
push eax
push dword [edi + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x100321de
cmp dword [ebp - 0x744], 7
jne 0x100321de
test ecx, ecx
je 0x100320dd
push esi
lea eax, [edi + 8]
push eax
push 0x10004ac0
push ecx
push 0xf
lea ecx, [ebp - 0x73c]
call fcn.100319b7
jmp 0x10032048
mov eax, dword [ebp - 0x740]
add eax, 2
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x754], ebx
mov dword [ebp - 0x750], ebx
mov dword [ebp - 0x74c], ebx
push eax
lea ecx, [ebp - 0x754]
mov dword [ebp - 4], ebx
call fcn.100319b7
mov ebx, dword [ebp - 0x750]
sub ebx, dword [ebp - 0x754]
mov dword [ebp - 4], 1
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x754]
cmp dword [esi + 0x14], 8
jb 0x10032136
mov ecx, dword [esi]
jmp 0x10032138
mov ecx, esi
lea edx, [ebp - 0x740]
push edx
push eax
lea eax, [ebp - 0x744]
push eax
push 0
push ecx
push dword [edi + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x10032167
push esi
lea ecx, [edi + 8]
push ecx
push 0x10004ac0
push eax
jmp 0x100320cb
mov edi, dword [ebp - 0x758]
xor esi, esi
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x754]
and dword [ebp - 0x1c], 0
xor ecx, ecx
lea eax, [eax + esi*2]
mov word [ebp - 0x2c], cx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
call fcn.100319b7
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100319b7
mov eax, dword [ebp - 0x1c]
push 0
inc eax
push 1
lea ecx, [ebp - 0x2c]
add esi, eax
mov byte [ebp - 4], 1
call fcn.100319b7
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x754]
cmp byte [ecx + esi*2], 0
jne 0x1003216f
lea ecx, [ebp - 0x754]
call fcn.1005ec72
mov al, 1
jmp 0x100321e0
xor al, al
call fcn.100455a8
ret 8
Function at 0x1003d123
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100611af
call fcn.100454bc
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x1003d14c
cmp dword [0x1009b850], edi
je 0x1003d236
push 2
pop ebx
jmp 0x1003d166
cmp edi, 1
jne 0x1003d236
mov eax, ebx
call fcn.1003e014
test al, al
je 0x1003d236
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.1003e036
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x1003d218
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1003d1ad
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
call fcn.1003d80d
test eax, eax
je 0x1003d24a
push 0x1c049f
push 0
call fcn.100319b7
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x10069528], 0
push ebx
mov ecx, 0x1009b860
call fcn.100319b7
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.1003d924
mov esi, eax
test esi, esi
je 0x1003d199
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.1003e057
inc edi
cmp edi, 2
jl 0x1003d134
mov eax, esi
call fcn.10045594
ret 0x18
push ebx
mov ecx, 0x1009b860
call fcn.100319b7
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x1003d22a
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x1003d285
cmp dword [ebp - 0x20], 3
jne 0x1003d280
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x1003d280
and cl, 0xf
cmp cl, 4
je 0x1003d285
push 2
pop esi
jmp 0x1003d22a
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.1003e057
xor eax, eax
jmp 0x1003d242
Function at 0x1003d70e
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x10061220
call fcn.100454bc
mov esi, dword [ebp + 8]
cmp esi, dword [0x1009b858]
jne 0x1003d72c
xor al, al
jmp 0x1003d805
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x1003d73d
xor ecx, ecx
cmp dword [0x1009b850], ecx
jmp 0x1003d748
mov eax, esi
call fcn.1003e014
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x1003d725
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.1003e036
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x1003d7c6
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003d77c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.1003d80d
test eax, eax
je 0x1003d7eb
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.100319b7
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x1009b860
mov dword [eax + 0x10069528], ebx
call fcn.100319b7
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.1003d924
mov ebx, eax
test ebx, ebx
je 0x1003d770
jmp 0x1003d7f8
push dword [ebp + 8]
mov ecx, 0x1009b860
call fcn.100319b7
lea ecx, [ebp + 0xf]
call fcn.1003e057
test ebx, ebx
sete al
call fcn.10045594
ret 8