joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427160
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42727c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4271f5
cmp cl, 2
je 0x42719d
cmp cl, 3
jne 0x427265
mov byte [eax + 8], 1
jmp 0x427261
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c390
nop
lea eax, [0x61f4d8]
mov dword [esp], eax
call fcn.00409820
nop
mov eax, dword [0x61f4a4]
sub eax, dword [0x61f488]
mov dword [0x61f4a4], eax
mov eax, dword [0x61f494]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x61f494], ecx
nop
lea eax, [0x61f4d8]
mov dword [esp], eax
call fcn.00409a20
jmp 0x427261
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413580
nop
lea eax, [0x61f4d8]
mov dword [esp], eax
call fcn.00409820
nop
mov eax, dword [0x61f47c]
sub eax, dword [0x61f460]
mov dword [0x61f47c], eax
mov eax, dword [0x61f46c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x61f46c], ecx
nop
nop
lea eax, [0x61f4d8]
mov dword [esp], eax
call fcn.00409a20
add esp, 0x14
ret
lea eax, [0x4ca534]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00434a90
nop
call fcn.0045f100
jmp fcn.00427160
Function at 0x42cd80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ce52
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42cdbd
lea eax, [0x4c9517]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00439230
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42cdd1
test cl, cl
jmp 0x42ce3f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004606e7
lea ecx, [0x42ce60]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0045eff0
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42ce46
call fcn.00439360
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0045f100
jmp fcn.0042cd80
Function at 0x44fc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44fdf7
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44fded
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44fccc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44fccc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44fcdf
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44fdc2
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44fdb4
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44fdab
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44fd36
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44fd7f
mov eax, 1
cmp eax, ecx
ja 0x44fd6d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00460600
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44fda6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44fd72
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44fd3b
call fcn.004605a0
xor eax, eax
mov ecx, eax
call fcn.00460590
call fcn.00460600
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44fde8
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44fdb9
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44fce4
call fcn.004605a0
xor eax, eax
mov ecx, eax
call fcn.00460590
nop
call fcn.0045f100
jmp fcn.0044fc70
Function at 0x4541c0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4542c0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00454a50
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4b75e0]
mov dword [esp], ecx
call fcn.0040b8c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x61f570]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00453a40
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00452e60
add esp, 0x28
ret
call fcn.0045f100
jmp fcn.004541c0
Function at 0x457830
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4578cf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004606e7
lea ecx, [0x4578e0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045eff0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045f100
jmp fcn.00457830
Function at 0x4603c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x63b180]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45eb8b
je 0x45ebde
cmp ebx, 0x20
jbe 0x45ebe4
cmp ebx, 0x40
jbe 0x45ec2a
jmp 0x45eccb
test ebx, ebx
je 0x45ebd4
add eax, 0x10
test ax, 0xff0
je 0x45ebc0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4eb000]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4eb100]
jmp 0x45eba8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45eba8
pxor xmm1, xmmword [0x63b190]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x63b190]
pxor xmm2, xmmword [0x63b1a0]
pxor xmm3, xmmword [0x63b1b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x63b190]
pxor xmm2, xmmword [0x63b1a0]
pxor xmm3, xmmword [0x63b1b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45ed2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x63ae8d], 0
je 0x4603da
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45eb50
jmp fcn.004082d0
Function at 0x4603e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402b2e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004082d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045f100
jmp 0x402af0
cmp byte [0x63ae8d], 0
je 0x4603fb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45eb50
jmp 0x402af0
Function at 0x100049b0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.100f1600
mov eax, dword [0x102dbc04]
test eax, eax
jne 0x100049cc
xor eax, eax
add esp, 0x1008
ret
mov ecx, dword [esp + 0x100c]
push ebx
lea eax, [esp + 0x1014]
push ebp
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.100f15ab
mov ebx, dword [0x102dbc04]
add esp, 0xc
cmp ebx, 0xffffffff
mov ebp, eax
je 0x10004ab6
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x814]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x10004a4a
push esi
lea esi, [esp + 0x818]
mov al, byte [esp + edx + 0x18]
cmp al, 0xa
jne 0x10004a33
mov byte [esi], 0xd
inc esi
mov byte [esi], al
inc esi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x10004a27
pop esi
lea eax, [esp + 0x10]
push 0
push eax
lea edi, [esp + 0x81c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x820]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
jne 0x10004ab6
push eax
lea edx, [esp + 0xc]
push eax
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp + 8]
push 0
push str.SDI_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1008
ret
Function at 0x10013b00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x40]
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x44]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x30]
not ecx
dec ecx
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call fcn.100f0c67
mov edx, eax
mov eax, dword [0x1010d6e8]
mov dword [esp + 0x14], eax
lea edi, [ebx + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x17]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x48], esi
mov esi, edi
mov edi, dword [esp + 0x48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x30]
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x1010d6e4]
push ebx
mov word [esp + 0x27], cx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x38]
push ecx
push eax
push 0x1010d6d8
push edx
mov dword [esp + 0x60], edx
call fcn.100f0f37
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.100184a0
mov edi, dword [esp + 0x4c]
add esp, 0x28
mov ebx, eax
xor esi, esi
movsx eax, byte [esi + ebp + 4]
movsx ecx, byte [ebx + esi + 0x10]
xor eax, ecx
push eax
push str._2.2X
push edi
call fcn.100f0f37
add esp, 0xc
inc esi
add edi, 2
cmp esi, 6
jl 0x10013bd6
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
push eax
mov byte [edx + 0xc], 0
call fcn.100f0ab3
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100169e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x80c
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push 0x400
push eax
push ecx
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x420]
push 0x400
push ecx
push 0x1010db54
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp]
add esp, 0x80c
ret
Function at 0x100180e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.100fd07f
mov edi, eax
push 0x1010d9e0
lea esi, [edi + 4]
push esi
call fcn.100f1810
add esp, 0xc
add esi, eax
je 0x1001814d
push ebx
mov bl, byte [esi]
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10018131
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10018129
xor ebp, ebp
jmp 0x10018131
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test bl, bl
je 0x1001814c
mov byte [esi], bl
add esi, 2
push 0x1010d9e0
push esi
call fcn.100f1810
add esp, 8
add esi, eax
jne 0x10018107
pop ebx
test edi, edi
je 0x1001815a
push edi
call fcn.100f0ab3
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
ret
Function at 0x10019560
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x1001fc00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1001fc0b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1001fd0e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x101005f8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101005f8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101005f8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101005f8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101005f8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101005f8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101005f8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101005f8]
xor eax, edx
inc ecx
dec edi
jne 0x1001fc26
pop edi
test esi, esi
je 0x1001fd30
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101005f8]
xor eax, edx
inc ecx
dec esi
jne 0x1001fd12
pop esi
pop ebx
not eax
ret
Function at 0x10038bd6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x80000002
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0
je 0x10038bfa
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10039cfd
add esp, 8
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
push edx
push 1
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.1003d4b7
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x10038d0c
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10038cfb
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x52c], 0
je 0x10038c8a
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x52c]
push eax
call fcn.1003d4b7
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003d3e0
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x52c], eax
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x52c]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 0
je 0x10038cd9
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
cmp dword [ebp - 0xc], 0
jne 0x10038cfb
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x52c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10038d72
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10038d72
cmp dword [ebp - 0xc], 2
jne 0x10038d19
mov eax, 1
jmp 0x10038d72
cmp dword [ebp - 0xc], 5
jne 0x10038d6d
cmp dword [ebp + 8], 0
je 0x10038d6d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x10038d3f
xor ecx, ecx
test ecx, ecx
je 0x10038d3f
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x1c], eax
jmp 0x10038d46
mov dword [ebp - 0x1c], 0xffffffc1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], edx
push 0
push 0xff
push 0
push 0
push 0x193
push 0xffffffffffffffc1
mov eax, dword [ebp + 8]
push eax
call fcn.10032260
add esp, 0x1c
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10038e1e
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x80000002
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10039cfd
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10038efc
push 0
call fcn.10038f8a
add esp, 4
push 1
call fcn.10038f8a
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10038efc
mov eax, dword [ebp - 0xc]
push eax
call fcn.1003d4b7
add esp, 4
cmp dword [ebp + 8], 0
je 0x10038ef2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x10038ec4
xor edx, edx
test edx, edx
je 0x10038ec4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
jmp 0x10038ecb
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x14], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10032260
add esp, 0x1c
mov eax, 1
jmp 0x10038f86
mov edx, dword [ebp - 0xc]
push edx
call fcn.1003d4b7
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x10038f24
cmp dword [ebp + 0x14], 0
jne 0x10038f34
mov eax, dword [ebp + 0x10]
push eax
call fcn.100f1bf0
add esp, 4
test eax, eax
jne 0x10038f34
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10038f7a
cmp dword [ebp + 0x14], 0
je 0x10038f42
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x10038f54
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100f1bf0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 1
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret