joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065da
xor eax, eax
test eax, eax
je 0x4065ed
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065ed
xor ecx, ecx
jmp 0x4065f0
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406719
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x45fd8c], 0
push esi
jne 0x406750
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40672a
mov dword [ecx*4 + 0x45fd88], eax
inc ecx
cmp ecx, 0x100
jl 0x406725
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406781
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x45fd88]
xor eax, esi
inc ecx
dec edx
jne 0x406763
pop edi
not eax
pop esi
ret 0xc
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x352626ab
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x296a3351
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408322
pop dword [ebp - 0x14]
mov eax, 0xe2a7a5ee
sub eax, 0xe26722cc
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x5c5b2454
add dword [ebp - 0x24], 0xf1f720f7
mov dword [ebp - 0x20], 0x6990756
add dword [ebp - 0x20], 0x2b9a44ef
mov dword [ebp - 0x1c], 0x3b431f7
sub dword [ebp - 0x1c], 0xb767edc9
mov dword [ebp - 0x18], 0xc9548639
add dword [ebp - 0x18], 0x36ab79c7
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc11af185
add eax, 0x3f25dec7
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x10dfee1a
sub dword [ebp - 0x24], 0x9c6d84c4
mov dword [ebp - 0x20], 0xdbc692dc
add dword [ebp - 0x20], 0x65a5ce99
mov dword [ebp - 0x1c], 0x3768b416
add dword [ebp - 0x1c], 0x2c06b856
mov dword [ebp - 0x18], 0x9077f765
sub dword [ebp - 0x18], 0x9077f765
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a607
push 0
call eax
mov ecx, 0x4bb9
mov edx, eax
mov ebx, 0x22b2f34f
sub ebx, 0x2271434f
add ebx, dword [ebp - 0x14]
mov edi, 0x25bfe123
xor dword [ebp - 0xc], esi
mov esi, dword [ebx]
sub dword [ebp - 8], 0xd9034fa1
sub esi, edi
add dword [ebp - 8], ecx
mov dword [edx], esi
add edx, 0x18b6fc08
add edx, 0xe74903fc
add ebx, 0xdd0082fa
sub ebx, 0xdd0082f6
loop 0x408433
add eax, 0xe2ef3bf6
sub eax, 0xe2ee1a3f
mov ebx, eax
add eax, 5
mov ecx, 0x28101420
sub ecx, 0x27d01420
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x100013bd
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100013c5
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 2
push 0
push dword [esp + 0x18]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 8

Function at 0x100013f6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x1000140c
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.SACOhelper.dll_public:_int___thiscall_CRegistry::WriteExpandString_wchar_t_const___wchar_t_const__
jmp 0x1000143f
mov eax, dword [ebp + 0xc]
push esi
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10001413
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 0xc

Function at 0x10001443
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x1005aea1
call fcn.100596da
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x1000150c
cmp dword [ebp - 0x10], 1
je 0x1000148b
cmp dword [ebp - 0x10], 2
jne 0x1000150c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov ebx, eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax + 1]
push eax
push 0
push ebx
call sub.MSVCR90.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x10001500
cmp dword [ebp - 0x10], 1
je 0x100014db
cmp dword [ebp - 0x10], 2
jne 0x10001500
push ebx
lea ecx, [ebp + 8]
call dword [0x1006ce70]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push ebx
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x1000150e
xor eax, eax
call fcn.100597b2
ret 8

Function at 0x10001516
Capabilities:
Set registry value

Disassembly:
push 4
push dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x100015a7
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 0xc
Function at 0x10001752
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x100a8050]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x18
mov eax, 0x1005ae3f
call fcn.100596da
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x40c]
mov esi, ecx
xor edi, edi
push 0x10074b84
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [0x1006ce70]
xor eax, eax
mov dword [ebp - 4], edi
push 0x3fe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
mov dword [ebp - 0x1c], edi
push edi
push ebx
push dword [esi + 8]
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001804
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001804
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call sub.mfc90u.dll_CStringArray::SetSize
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jbe 0x1000185a
cmp esi, edi
je 0x1000185a
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x10001854
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ecx + 8]
call sub.mfc90u.dll_CStringArray::SetAtGrow_1
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x1000180b
cmp dword [ebp - 0x10], edi
je 0x1000186b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x10001872
xor edi, edi
inc edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.1005883e
add ebp, 0x404
leave
ret 8
Function at 0x10001928
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov edi, ecx
push dword [edi + 8]
call esi
cmp dword [ebp - 4], 2
mov edx, dword [ebp + 0x10]
sete cl
mov byte [edx], cl
test eax, eax
jne 0x100019b8
cmp dword [ebp - 4], 1
je 0x1000196f
cmp dword [ebp - 4], 2
jne 0x100019b8
push dword [ebp - 8]
call sub.mfc90u.dll_new__
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 8]
call esi
test eax, eax
jne 0x100019aa
cmp dword [ebp - 4], 1
je 0x1000199e
cmp dword [ebp - 4], 2
jne 0x100019aa
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call dword [0x1006ce1c]
push dword [ebp + 0x10]
call sub.mfc90u.dll_delete__
xor eax, eax
pop ecx
inc eax
jmp 0x100019ba
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x100019c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005ae15
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
push 2
mov edi, 0x1000
push edi
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0x10
push edi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call sub.mfc90u.dll_CMemFile::CMemFile
xor ebx, ebx
push ebx
push edi
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xa0], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x3c]
mov byte [esp + 0x90], 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
lea ecx, [esp + 0x3c]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x14]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 3
xor esi, esi
cmp dword [esp + 0x10], esi
je 0x10001a91
push dword [esp + 0x10]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
cmp ebx, esi
jne 0x10001a98
xor esi, esi
inc esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x90], 0
call fcn.10057d9e
or dword [esp + 0x90], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10057d92
mov eax, esi
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001ad4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005ade4
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov esi, 0x1000
push esi
call dword [sym.imp.MSVCR90.dll_malloc]
push esi
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x24], eax
call sub.MSVCR90.dll_memset
add esp, 0x10
push 0x10
push esi
push dword [esp + 0x1c]
lea ecx, [esp + 0x28]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push esi
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0xa8], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x44]
mov byte [esp + 0x98], 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
lea ecx, [esp + 0x44]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x1c]
call sub.mfc90u.dll_CMemFile::GetLength
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.mfc90u.dll_CMemFile::Detach
push esi
push eax
push 3
push ebx
push dword [ebp + 8]
mov dword [esp + 0x28], eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x18], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], 3
cmp dword [esp + 0x14], ebx
je 0x10001bb6
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
xor esi, esi
cmp dword [esp + 0x18], ebx
jne 0x10001bbf
inc esi
lea ecx, [esp + 0x44]
mov byte [esp + 0x98], bl
call fcn.10057d9e
or dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10057d92
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001bfa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005adb3
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CDWordArray::CDWordArray
push 2
xor ebx, ebx
push 0x1e
mov dword [esp + 0xb0], ebx
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0xffffffffffffffff
push 5
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call sub.mfc90u.dll_CDWordArray::SetSize
cmp dword [esp + 0x20], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
jg 0x10001c6e
call sub.mfc90u.dll_AfxThrowInvalidArgException
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
cmp dword [esp + 0x20], 1
mov ecx, dword [eax + 0xc]
jle 0x10001c69
mov edx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
cmp dword [esp + 0x20], 2
mov ecx, dword [eax]
jle 0x10001c69
mov edx, dword [esp + 0x1c]
mov dword [edx + 8], ecx
cmp dword [esp + 0x20], 3
mov eax, dword [eax + 8]
jle 0x10001c69
mov ecx, dword [esp + 0x1c]
push 0x10
push 0x1e
push dword [esp + 0x1c]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x38]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push 0x1000
push ebx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xb8], 1
call sub.mfc90u.dll_CArchive::CArchive
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 2
call sub.mfc90u.dll_CDWordArray::Serialize
lea ecx, [esp + 0x54]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x2c]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x30]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi + 0x18], edi
xor edi, edi
inc edi
cmp dword [esp + 0x14], 0
mov ebx, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
je 0x10001d38
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0xa8], 1
call fcn.10057d9e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.10057d92
or dword [esp + 0xa8], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10057dc2
test ebx, ebx
jne 0x10001d73
mov eax, edi
jmp 0x10001d75
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001d8d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005adb3
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CDWordArray::CDWordArray
push 2
xor ebx, ebx
push 0x14
mov dword [esp + 0xb0], ebx
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
push 0xffffffffffffffff
push 5
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], eax
call sub.mfc90u.dll_CDWordArray::SetSize
cmp dword [esp + 0x20], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov ecx, dword [ecx]
jg 0x10001e02
call sub.mfc90u.dll_AfxThrowInvalidArgException
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
cmp dword [esp + 0x20], 1
mov eax, dword [eax]
mov eax, dword [eax + 4]
jle 0x10001dfd
mov ecx, dword [esp + 0x1c]
push 0x10
push 0x14
push dword [esp + 0x18]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x38]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push 0x1000
push ebx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xb8], 1
call sub.mfc90u.dll_CArchive::CArchive
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 2
call sub.mfc90u.dll_CDWordArray::Serialize
lea ecx, [esp + 0x54]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x2c]
call sub.mfc90u.dll_CMemFile::GetLength
mov edi, eax
push edi
lea ecx, [esp + 0x30]
call sub.mfc90u.dll_CMemFile::Detach
push eax
push 3
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 2
cmp dword [esp + 0x10], ebx
je 0x10001eaf
push dword [esp + 0x10]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0xa8], 1
call fcn.10057d9e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], bl
call fcn.10057d92
or dword [esp + 0xa8], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10057dc2
xor eax, eax
cmp dword [esp + 0x14], ebx
jne 0x10001eea
inc eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001f02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005ad77
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, ecx
mov edi, 0x1000
push 2
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x1c]
mov edx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
cmp edx, ebx
jne 0x10002009
cmp ecx, 3
jne 0x10002009
push ebx
push eax
push dword [esp + 0x1c]
lea ecx, [esp + 0x30]
call sub.mfc90u.dll_CMemFile::CMemFile
push ebx
push edi
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0xb0], ebx
call sub.mfc90u.dll_CArchive::CArchive
mov esi, dword [ebp + 0xc]
mov byte [esp + 0xa0], 1
mov ecx, esi
mov dword [esp + 0x50], ebx
call sub.mfc90u.dll_CStringList::RemoveAll
mov eax, dword [esi]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call dword [eax + 8]
lea ecx, [esp + 0x4c]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x24]
call sub.mfc90u.dll_CMemFile::Close
lea ecx, [esp + 0x4c]
mov byte [esp + 0xa0], bl
call fcn.10057d9e
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.10057d92
cmp dword [esp + 0x14], ebx
je 0x1000201a
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
xor eax, eax
cmp dword [esp + 0x20], ebx
sete al
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000203b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005ad77
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x100a8050]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 8]
mov edi, 0x1000
push 2
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVCR90.dll_calloc]
pop ecx
pop ecx
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x20]
mov edx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
xor esi, esi
mov dword [esp + 0x1c], edx
cmp edx, esi
jne 0x10002169
cmp ecx, 3
jne 0x10002169
push esi
push eax
push dword [esp + 0x18]
lea ecx, [esp + 0x30]
call sub.mfc90u.dll_CMemFile::CMemFile
push esi
push edi
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0xb0], esi
call sub.mfc90u.dll_CArchive::CArchive
or edi, 0xffffffff
push edi
mov byte [esp + 0xa4], 1
push esi
mov ecx, ebx
mov dword [esp + 0x58], esi
call sub.mfc90u.dll_CByteArray::SetSize
push edi
push 0xa
mov ecx, ebx
call sub.mfc90u.dll_CByteArray::SetSize
mov eax, dword [ebx]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebx
call dword [eax + 8]
push edi
push dword [esp + 0x1c]
mov ecx, ebx
call sub.mfc90u.dll_CByteArray::SetSize
lea ecx, [esp + 0x4c]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x24]
call sub.mfc90u.dll_CMemFile::Close
lea ecx, [esp + 0x4c]
mov byte [esp + 0xa0], 0
call fcn.10057d9e
lea ecx, [esp + 0x24]
mov dword [esp + 0xa0], edi
call fcn.10057d92
cmp dword [esp + 0x10], esi
je 0x1000217a
push dword [esp + 0x10]
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
xor eax, eax
cmp dword [esp + 0x1c], esi
sete al
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8