joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100979a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1008]
push eax
push 0x1005438
push 0x80000001
mov dword [ebp - 0x1010], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100991c
push esi
push 3
mov esi, 0x400
push esi
lea eax, [ebp - 0x1004]
push eax
push 0
push 9
push 0x110a
push dword [0x101d090]
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
push eax
push dword [0x101d090]
call fcn.01002c60
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], eax
push 0x5c
push dword [ebp - 0x100c]
call dword [sym.imp.msvcrt.dll_5PJ01_P7RpJm_3rrz_nrwuP_]
pop ecx
pop ecx
test eax, eax
je 0x1009837
inc eax
inc eax
mov dword [ebp - 0x100c], eax
jne 0x1009819
push ebx
push dword [ebp - 0x100c]
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.01002d3f
lea eax, [ebp - 0x804]
push eax
mov ebx, 0x100800f
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x10098cd
xor eax, eax
cmp word [ebp - 0x804], ax
je 0x10098ac
push eax
push eax
lea ecx, [ebp - 0x1014]
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call fcn.01003313
test eax, eax
jne 0x10098de
push 0x10
push 0xac
push 0xab
push dword [ebp - 0x1010]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
push dword [ebp - 0x100c]
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.01002d3f
lea eax, [ebp - 0x804]
push eax
push ebx
push dword [ebp - 0x1010]
push 0x70
push dword [0x101d054]
call edi
cmp eax, 1
jne 0x100990e
jmp 0x1009861
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x1004]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 4
Function at 0x1009930
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
cmp ax, word [0x105d668]
jne 0x1009999
push 0x104
mov esi, 0x105d668
push esi
push 0x22
push dword [0x101d054]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1009980
mov word [0x105d668], ax
jmp 0x1009b37
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x105d870], eax
cmp word [0x105d668], di
je 0x1009b37
lea eax, [ebp - 0x180c]
push eax
push 0x1005438
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1009b37
lea eax, [ebp - 0x1808]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1818]
push eax
push edi
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x1804]
push eax
push edi
push dword [ebp - 0x180c]
mov esi, 0x400
mov dword [ebp - 0x1810], esi
mov dword [ebp - 0x1808], 0x800
mov dword [ebp - 0x1814], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1009b2b
push ebx
cmp dword [ebp - 0x1818], 1
jne 0x1009b2a
cmp dword [ebp - 0x1808], edi
jbe 0x1009b2a
push 0x5c
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_a._9_IbOB_:p1tcd__cz_sgizm_YcUa__4d6i__G_m_7]
mov ebx, eax
push 0x105d668
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_tcd__cz_sgizm_YcUa__4d6i__G_m_7X9QT9A_fS9H7]
cmp eax, edi
je 0x1009ad5
lea ecx, [ebp - 0x1004]
cmp eax, ecx
jne 0x1009ad5
cmp ebx, edi
je 0x1009ad5
mov ecx, dword [0x105d870]
lea eax, [eax + ecx*2]
cmp eax, ebx
jne 0x1009ad5
push esi
lea eax, [ebp - 0x804]
push eax
push 0x13
push dword [0x101d054]
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push edi
push esi
lea eax, [ebp - 0x804]
push eax
call fcn.01008d83
add ebx, 2
push ebx
push esi
lea eax, [ebp - 0x804]
push eax
call fcn.0101278a
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push edi
lea eax, [ebp - 0x1804]
push eax
push dword [ebp - 0x180c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x1814]
inc dword [ebp - 0x1814]
lea ecx, [ebp - 0x1808]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
lea ecx, [ebp - 0x1818]
push ecx
push edi
lea ecx, [ebp - 0x1810]
push ecx
lea ecx, [ebp - 0x1804]
push ecx
push eax
push dword [ebp - 0x180c]
mov dword [ebp - 0x1810], esi
mov dword [ebp - 0x1808], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1009a11
pop ebx
push dword [ebp - 0x180c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret
Function at 0x100b3db
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0x200
lea eax, [ebp - 0x404]
push eax
xor edi, edi
push 0
inc edi
call fcn.0100b35d
test eax, eax
je 0x100b445
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100b445
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x404]
push eax
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 4

Function at 0x100b4cd
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 3
push 0x110a
push ebx
mov dword [ebp - 0x210], edi
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
test eax, eax
jne 0x100b509
inc eax
jmp 0x100b5df
push esi
xor esi, esi
push esi
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
push ebx
call fcn.01002c60
lea ecx, [ebp - 0x208]
push ecx
push 8
push esi
lea ecx, [ebp - 0x204]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100b543
xor eax, eax
jmp 0x100b5de
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0xff
sub edi, eax
push edi
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x20c], esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x100b5af
inc dword [ebp - 0x20c]
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.0100b1da
push eax
lea eax, [ebp - 0x204]
push eax
push 0xffff0001
push dword [ebp - 0x210]
push ebx
call fcn.0100b182
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x100b56e
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
push 0
push 0x1113
push ebx
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x100bd6d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push eax
push dword [0x101d090]
call fcn.01002c60
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea esi, [eax + eax + 2]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100be06
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x100be00
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
lea ecx, [ebp - 0x404]
push ecx
push eax
call sub.msvcrt.dll_3exi_bC2LraF_KSuvt
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 8
Function at 0x100d5c4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [0x101d090]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
mov dword [0x101d068], 0x88
cmp dword [ebp + 0xc], ebx
je 0x100d617
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
call 0x10086ed
push eax
call fcn.01002732
test eax, eax
je 0x100d617
mov dword [0x101d068], 0x89
jmp 0x100d677
push esi
push edi
push 1
mov edi, 0x100d67c
push edi
call fcn.0100cc01
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
cmp eax, ebx
je 0x100d66e
cmp eax, 6
je 0x100d65f
xor ecx, ecx
cmp eax, 0x522
sete cl
add ecx, 0x8d
mov dword [0x101d068], ecx
jmp 0x100d669
mov dword [0x101d068], 0x8f
push dword [ebp + 8]
call esi
push ebx
push edi
call fcn.0100cc01
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100d6a5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x105d104]
push ebx
push edi
xor edi, edi
cmp eax, edi
je 0x100d730
cmp dword [0x101d0ec], 4
jne 0x100d6fd
push esi
push edi
push edi
push 0x20000
mov esi, 0x101d100
push esi
push eax
push 0x103d100
push edi
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
je 0x100d726
cmp ebx, dword [ebp - 4]
jmp 0x100d724
push edi
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push 0x103d100
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100d726
mov eax, dword [0x105d104]
add eax, eax
cmp eax, dword [ebp - 4]
je 0x100d730
mov dword [0x101d068], 0x8d
mov dword [0x105d104], edi
pop edi
pop ebx
leave
ret
Function at 0x100df99
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 9
push 0x110a
push dword [0x101d090]
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
mov dword [ebp - 0x258], eax
mov dword [0x101d068], 0x88
cmp ebx, esi
je 0x100e009
push esi
push ebx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call 0x10086ed
push eax
call fcn.01002732
test eax, eax
je 0x100e009
mov dword [0x101d068], 0x89
jmp 0x100e135
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x105d100], eax
cmp eax, 0xffffffff
je 0x100e11b
push esi
lea ecx, [ebp - 0x260]
push ecx
push 2
push 0x100e148
push eax
mov dword [0x105d104], esi
mov dword [0x105d108], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001ed0
call fcn.0100dabc
push 0x1005540
call fcn.0100dabc
push 0x100e150
call fcn.0100dabc
push 0x100e15c
call fcn.0100dabc
cmp ebx, esi
je 0x100e09c
push ebx
push 0x128
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
jmp 0x100e103
push dword [ebp - 0x258]
call 0x10086ed
push 0x1001654
mov dword [ebp - 0x258], eax
mov edi, 0x128
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
push 0x100163c
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.01002d3f
lea eax, [ebp - 0x254]
push eax
push eax
push dword [ebp - 0x258]
call fcn.010027cc
push eax
call fcn.0100dd21
call fcn.0100d6a5
push dword [0x105d100]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100e125
mov dword [0x101d068], 0x8a
cmp ebx, esi
je 0x100e135
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x100fb8e
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [0x105d4d4], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x208], ebx
cmp dword [esi + 0x20], edi
je 0x100fd5e
lea eax, [ebp - 0x204]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x258]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x250], edi
push 0x1073
push dword [0x101d094]
mov dword [ebp - 0x240], 0x100
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
mov eax, dword [esi + 0x20]
cmp word [eax], di
jne 0x100fc20
mov dword [ebp - 0x210], 0x4b
mov dword [ebp - 0x208], edi
jmp 0x100fd37
lea ecx, [ebp - 0x218]
push ecx
push edi
push ecx
push edi
push eax
push dword [0x101d0a8]
call fcn.01003313
mov dword [ebp - 0x208], edi
cmp eax, 2
je 0x100fc50
mov dword [ebp - 0x210], 0x4a
jmp 0x100fd37
lea eax, [ebp - 0x214]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call fcn.01003313
cmp dword [ebp - 0x20c], ebx
je 0x100fc90
cmp dword [ebp - 0x20c], 2
je 0x100fc90
cmp dword [ebp - 0x20c], 7
je 0x100fc90
xor eax, eax
jmp 0x100fc93
push 2
pop eax
mov ecx, dword [ebp - 0x214]
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x100fd25
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
mov dword [ebp - 0x210], 0x49
call fcn.01003313
test eax, eax
jne 0x100fd1c
push dword [ebp - 0x214]
push ebx
push dword [ebp - 0x20c]
push edi
push dword [esi + 0x20]
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100fd1c
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x100fd1c
mov dword [ebp - 0x208], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100fd2f
mov dword [ebp - 0x210], 0x76
cmp dword [ebp - 0x208], edi
jne 0x100fd5e
lea eax, [ebp - 0x204]
push eax
movzx eax, word [ebp - 0x210]
push 0x10
push 0x48
push eax
push dword [ebp - 0x21c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
Function at 0x101059b
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x218], eax
cmp dword [0x101d0a8], edi
je 0x1010778
push ebx
mov dword [ebp - 0x214], 1
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push dword [0x101d0d0]
push 0x100
push eax
call fcn.010062be
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push edi
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call fcn.01003313
mov ebx, dword [ebp + 0xc]
push 3
pop esi
test eax, eax
jne 0x101065f
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 0x64
jb 0x10105d4
cmp dword [ebp - 0x214], 0x64
jne 0x10106e1
mov eax, 0xaa
push 0x10
movzx eax, ax
push 0xa8
push eax
push dword [ebp - 0x218]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
jmp 0x1010776
cmp ebx, edi
jbe 0x10106b0
push 2
pop ecx
cmp ebx, ecx
jbe 0x10106a4
cmp ebx, esi
je 0x101069c
push 4
pop eax
cmp ebx, eax
je 0x1010691
cmp ebx, 7
je 0x10106a4
cmp ebx, 0xb
jne 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x210], 8
jmp 0x10106b0
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x210], eax
jmp 0x10106b0
mov dword [ebp - 0x210], edi
jmp 0x10106b0
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1010629
mov eax, 0xa9
jmp 0x101063b
push edi
push edi
push 0x1004
push dword [0x101d094]
mov dword [ebp - 0x258], esi
mov esi, dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x244], eax
call esi
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], edi
cmp ebx, 1
je 0x101072d
cmp ebx, 2
je 0x101072d
mov dword [ebp - 0x23c], 5
cmp ebx, 7
jne 0x1010737
mov dword [ebp - 0x23c], 4
lea eax, [ebp - 0x258]
push eax
push edi
push 0x104d
push dword [0x101d094]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x1010776
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [0x101d094]
call fcn.01010222
push esi
push dword [0x101d094]
call fcn.0100fde7
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 8
Function at 0x1010b49
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
push edi
mov edi, dword [0x101d094]
xor ebx, ebx
push ebx
push ebx
push 0x1032
push edi
mov dword [ebp - 0x20c], eax
call esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x34
push 0x34
movzx eax, ax
push 0x33
push eax
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
cmp eax, 6
jne 0x1010c9d
push ebx
push ebx
push 0xb
push edi
call esi
or dword [ebp - 0x208], 0xffffffff
push 2
mov dword [ebp - 0x210], ebx
push 0xffffffffffffffff
jmp 0x1010c5e
test ebx, ebx
je 0x1010c02
and dword [ebp - 0x244], 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0x1073
push edi
mov dword [ebp - 0x234], 0x100
call esi
jmp 0x1010c0b
xor eax, eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x204]
push eax
push dword [0x101d0a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1010c46
cmp ebx, eax
je 0x1010c32
push eax
push ebx
push 0x1008
push edi
call esi
jmp 0x1010c56
push 1
push eax
push eax
push eax
push edi
call fcn.01010222
and dword [ebp - 0x208], 0
jmp 0x1010c56
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x208], ebx
push 2
push dword [ebp - 0x208]
push 0x100c
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1010bcf
push 0
push 1
push 0xb
push edi
call esi
cmp dword [ebp - 0x210], 0
je 0x1010c9d
push 0x10
push 0x58
push 0x59
push dword [ebp - 0x20c]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4

Function at 0x1010cb3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push 0
push 0x1032
push dword [0x101d094]
call dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
test eax, eax
jbe 0x1010cde
cmp eax, 1
je 0x1010ce2
push 0
call dword [sym.imp.USER32.dll__ja_wLPbbUV___v8m0H2huz4fdL]
pop ebp
ret 8
pop ebp
jmp fcn.0101078c
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x96c]
sub esp, 0x9ec
mov eax, dword [0x4163e0]
xor eax, ebp
mov dword [ebp + 0x968], eax
mov eax, dword [ebp + 0x974]
push ebx
push esi
push edi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
mov edi, ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
movzx eax, word [ebp - 0x80]
push eax
push str._04d__02d__02d__02d:_02d:_02d._03d
lea eax, [ebp + 0x928]
push 0x40
push eax
call fcn.00403b47
add esp, 0x28
cmp dword [ebp + 0x978], 0
lea eax, [ebp + 0x398]
sete bl
test esi, esi
lea ebx, [ebx*4 + 0x45]
jne 0x401098
push 0x400
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x4010a8
push esi
push edi
push 0x400
push eax
call fcn.00403b2c
add esp, 0x10
cmp dword [0x416004], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x401153
push 0x3e8
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
mov eax, str._LOG_MUTEX_LOCKED_
je 0x4010e3
mov eax, 0x412200
lea ecx, [ebp + 0x398]
push ecx
push eax
push dword [0x416008]
push dword [ebp - 0x70]
call edi
push eax
movsx eax, bl
push eax
lea eax, [ebp + 0x928]
push eax
push str._s_t_c_t_d_t_s_t_s_t_s_s_r_n
lea eax, [ebp - 0x68]
push 0x400
push eax
call fcn.00403b47
add esp, 0x28
push 2
push 0
push 0
push dword [0x416004]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004039f0
pop ecx
push eax
lea eax, [ebp - 0x68]
push eax
push dword [0x416004]
call esi
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push str..mailslotAVITrace
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x6c], eax
je 0x401205
lea eax, [ebp + 0x398]
push eax
push dword [ebp - 0x70]
call edi
push eax
push dword [0x416008]
movsx eax, bl
push eax
lea eax, [ebp + 0x928]
push eax
push str._s__c__s__4d___8s__s
lea eax, [ebp + 0x798]
push 0x190
push eax
call fcn.00403b47
inc dword [0x41600c]
lea eax, [ebp + 0x798]
push eax
mov byte [ebp + 0x927], 0
call fcn.004039f0
add esp, 0x28
inc eax
push 0
mov dword [0x416018], eax
lea eax, [ebp - 0x70]
push eax
push 0x10
push 0x41600c
push dword [ebp - 0x6c]
call esi
push 0
lea eax, [ebp - 0x70]
push eax
push dword [0x416018]
lea eax, [ebp + 0x798]
push eax
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x968]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403bf4
add ebp, 0x96c
leave
ret