joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018ae20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x140]
mov edx, dword [ebx + 0x144]
mov esi, dword [ebx + 0x14c]
shld edx, eax, 3
mov dword [ebp - 0x28], ecx
shl eax, 3
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x148]
shld esi, eax, 3
mov dword [ebp - 0x1c], edx
shl eax, 3
mov dword [ebp - 0x20], eax
lea eax, [edi - 4]
mov dword [ebp - 0x18], esi
cmp eax, 0xc
ja 0x1018afa0
push edi
lea eax, [ebx + 0x150]
push eax
push ecx
call fcn.100e1b00
mov eax, dword [ebp - 0x24]
add esp, 0xc
or eax, dword [ebp - 0x1c]
mov ecx, esi
mov edx, dword [ebp - 0x20]
jne 0x1018aea5
mov eax, edx
or eax, ecx
je 0x1018af8d
mov esi, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x12], al
mov eax, esi
mov byte [ebp - 0x11], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x10], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov edx, dword [ebp - 0x24]
shrd eax, esi, 8
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0xe], al
mov byte [ebp - 0xf], cl
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, esi
mov byte [ebp - 9], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 5], dl
mov byte [ebp - 8], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
shrd eax, esi, 8
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
xor eax, eax
nop dword [eax]
movzx ecx, byte [ebp + eax - 0x14]
xor byte [ebx + eax + 0x170], cl
movzx ecx, byte [ebp + eax - 0x13]
xor byte [ebx + eax + 0x171], cl
movzx ecx, byte [ebp + eax - 0x12]
xor byte [ebx + eax + 0x172], cl
movzx ecx, byte [ebp + eax - 0x11]
xor byte [ebx + eax + 0x173], cl
add eax, 4
cmp eax, 0x10
jb 0x1018af30
lea esi, [ebx + 0x170]
push esi
push esi
push ebx
call fcn.1018aaa0
add esp, 0xc
xor ecx, ecx
test edi, edi
je 0x1018af8d
mov edx, dword [ebp - 0x28]
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x1018af82
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x1018b080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x20], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
test edx, edx
je 0x1018b248
lea eax, [esi + 0x170]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
movups xmmword [esi + 0x160], xmm0
push edi
lea edi, [esi + 0x160]
movups xmmword [esi + 0x170], xmm0
mov dword [esi + 0x180], eax
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
cmp edx, 0xc
jne 0x1018b11e
movq xmm0, qword [ebx]
movq qword [edi], xmm0
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov byte [esi + 0x16f], 1
jmp 0x1018b1d3
lea ecx, [edx*8]
mov eax, ecx
shr eax, 0x18
movups xmmword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 7], al
mov al, dl
shr ecx, 8
shl al, 3
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
test edx, edx
je 0x1018b189
nop dword [eax + eax]
mov esi, 0x10
cmp edx, esi
cmovb esi, edx
xor ecx, ecx
test esi, esi
je 0x1018b16b
mov al, byte [ecx + ebx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x1018b160
push edi
push edi
push dword [ebp - 0x18]
call fcn.1018aaa0
mov edx, dword [ebp + 0x14]
add esp, 0xc
sub edx, esi
add ebx, esi
mov dword [ebp + 0x14], edx
test edx, edx
jne 0x1018b150
mov esi, dword [ebp - 0x18]
xor ecx, ecx
nop dword [eax + eax]
movzx eax, byte [ebp + ecx - 0x14]
xor byte [esi + ecx + 0x160], al
movzx eax, byte [ebp + ecx - 0x13]
xor byte [esi + ecx + 0x161], al
movzx eax, byte [ebp + ecx - 0x12]
xor byte [esi + ecx + 0x162], al
movzx eax, byte [ebp + ecx - 0x11]
xor byte [esi + ecx + 0x163], al
add ecx, 4
cmp ecx, 0x10
jb 0x1018b190
push edi
push edi
push esi
call fcn.1018aaa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [esi + 0x150]
push eax
push 0x10
push edi
push esi
call fcn.10180070
add esp, 0x14
test eax, eax
jne 0x1018b237
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], eax
test ebx, ebx
je 0x1018b235
mov edx, dword [ebp - 0x1c]
mov esi, 0x10
cmp ebx, esi
cmovb esi, ebx
xor eax, eax
test esi, esi
je 0x1018b222
mov cl, byte [eax + edi]
xor byte [edx + eax], cl
inc eax
cmp eax, esi
jb 0x1018b217
push edx
push edx
push dword [ebp - 0x18]
call fcn.1018aaa0
add esp, 0xc
add edi, esi
sub ebx, esi
jne 0x1018b204
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x1018b8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x2c]
mov dword [ebp - 0x18], ebx
test edi, edi
jne 0x1018b900
lea eax, [edi - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebp - 0x14]
push edi
push ebx
push esi
push dword [ebp + 0x1c]
push edx
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0xc]
push 1
push eax
call fcn.1018b400
mov edi, dword [ebp + 0x2c]
add esp, 0x2c
test eax, eax
jne 0x1018ba10
mov ebx, dword [ebp + 0x28]
xor esi, esi
xor al, al
test edi, edi
je 0x1018b9c8
cmp edi, 8
jb 0x1018b9c8
mov edx, edi
xorps xmm4, xmm4
and edx, 0xfffffff8
xorps xmm3, xmm3
xor ecx, ecx
nop dword [eax]
movd xmm2, dword [ecx + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + ecx - 0x14]
lea ecx, [eax + 4]
punpcklbw xmm2, xmm0
add al, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, cl
por xmm4, xmm2
movd xmm2, dword [ecx + ebx]
movd xmm1, dword [ebp + ecx - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, al
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, edx
jb 0x1018b950
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
movzx ecx, al
cmp ecx, edi
jae 0x1018b9e6
nop
movzx edx, byte [ecx + ebx]
inc al
movzx ecx, byte [ebp + ecx - 0x14]
xor edx, ecx
movzx ecx, al
or esi, edx
cmp ecx, edi
jb 0x1018b9d0
test esi, esi
je 0x1018ba0e
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.101115e0
add esp, 8
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x1018e510
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov edx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [edx]
lea ecx, [edx + 8]
mov ebx, dword [edx + 4]
mov dword [ebp - 4], ecx
jbe 0x1018e573
push esi
mov esi, dword [ebp + 0x14]
sub dword [ebp + 0x10], esi
mov edx, dword [ebp - 4]
lea eax, [edi + 1]
movzx edi, al
lea esi, [esi + 1]
mov cl, byte [ecx + edi]
movzx eax, cl
add eax, ebx
movzx ebx, al
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov byte [edx + edi], al
add al, cl
mov byte [edx + ebx], cl
mov ecx, edx
mov edx, dword [ebp + 0x10]
movzx eax, al
movzx eax, byte [eax + ecx]
xor al, byte [edx + esi - 1]
sub dword [ebp + 0xc], 1
mov byte [esi - 1], al
jne 0x1018e531
mov edx, dword [ebp + 8]
pop esi
mov dword [edx], edi
xor eax, eax
pop edi
mov dword [edx + 4], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1018e630
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x101e3720]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + 0x101e3620]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x101e3820]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x101e3520]
or esi, eax
mov eax, ebx
shr eax, 0x10
mov edx, esi
movzx eax, al
rol edx, 8
movzx ecx, byte [eax + 0x101e3620]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x101e3520]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x101e3720]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x101e3820]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x1018ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ecx, dword [ecx]
mov eax, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, edi
mov dword [ebp + 8], ecx
mov dword [ebp - 8], 0x10
xor eax, dword [ecx]
mov edx, eax
mov ebx, eax
shr edx, 8
mov esi, eax
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, esi
xor eax, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [edi + ecx*4 + 0xc48]
mov ecx, dword [ebp + 8]
xor eax, dword [ebp - 4]
add ecx, 4
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
jne 0x10190005
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [edi + 0x44]
xor eax, edx
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10190590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push ebx
push esi
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
movzx esi, byte [edx + 4]
shl eax, 8
or eax, ecx
shl esi, 8
movzx ecx, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 5]
or esi, ecx
mov dword [ebp + 0x10], eax
movzx ecx, byte [edx + 6]
shl esi, 8
or esi, ecx
movzx ecx, byte [edx + 7]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], esi
jne 0x1019064a
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], 0x10
lea ecx, [edi + 0x44]
mov dword [ebp + 0x10], ecx
xor eax, dword [ecx]
mov edx, eax
mov dword [ebp - 4], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
movzx ecx, dl
xor eax, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [edi + ecx*4 + 0xc48]
mov ecx, dword [ebp + 0x10]
xor eax, esi
sub ecx, 4
mov esi, ebx
sub dword [ebp + 0xc], 1
mov dword [ebp + 0x10], ecx
jne 0x101905f3
mov edx, dword [edi]
xor edx, ebx
mov ebx, dword [edi + 4]
xor ebx, eax
pop edi
jmp 0x10190663
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1018ffe0
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov eax, edx
shr eax, 0x18
pop esi
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 1], al
mov eax, edx
shr eax, 8
mov byte [ecx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 5], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 6], al
xor eax, eax
mov byte [ecx + 7], bl
mov byte [ecx + 3], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101911b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102a8034]
test eax, eax
je 0x101911c6
inc eax
mov dword [0x102a8034], eax
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x102a8034], 1
push esi
test bl, 1
je 0x10191280
push str.iphlpapi.dll
mov dword [0x102a803c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x102a803c], eax
test eax, eax
jne 0x10191205
pop esi
mov eax, 0x16
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101e4a94
push eax
call esi
mov dword [0x102a8024], eax
test eax, eax
jne 0x10191231
push dword [0x102a803c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, 0x17
pop ebx
pop ebp
ret
push str.GetAdaptersAddresses
push dword [0x102a803c]
call esi
push str.GetBestRoute2
push dword [0x102a803c]
mov dword [0x102a802c], eax
call esi
push str.advapi32.dll
mov dword [0x102a8030], eax
mov dword [0x102a8040], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x102a8040], eax
test eax, eax
je 0x10191280
push str.SystemFunction036
push eax
call esi
mov dword [0x102a8028], eax
pop esi
mov dword [0x102a8038], ebx
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10191f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi], 0
call fcn.10196530
cmp eax, 3
jne 0x10191ff0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
mov dword [ebp + 8], 0
mov dword [esi], 0
call ebx
test eax, eax
jne 0x101920c7
push esi
push str.NameServer
push dword [ebp - 4]
call fcn.101920d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10191fda
push esi
push str.DhcpNameServer
push dword [ebp - 4]
call fcn.101920d0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10191fda
lea eax, [ebp + 8]
push eax
push 9
push edi
push str.Interfaces
push dword [ebp - 4]
call ebx
test eax, eax
je 0x10191fb0
push dword [ebp - 4]
mov dword [ebp + 8], edi
jmp 0x101920ac
push esi
push str.NameServer
push dword [ebp + 8]
call fcn.10192510
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10191fda
push esi
push str.DhcpNameServer
push dword [ebp + 8]
call fcn.10192510
add esp, 0xc
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10191fe8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
jmp 0x101920ac
cmp eax, 2
jne 0x101920c7
lea eax, [ebp - 8]
mov dword [esi], 0
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesVxDMSTCP
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101920c7
mov edi, dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
mov dword [esi], eax
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push str.NameServer
push edi
call ebx
test eax, eax
je 0x10192052
cmp eax, 0xea
jne 0x101920a7
mov eax, dword [ebp + 8]
test eax, eax
je 0x101920a7
inc eax
push eax
call dword [0x1026eabc]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x101920a7
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.NameServer
push edi
call ebx
test eax, eax
jne 0x10192096
mov ecx, dword [ebp + 8]
cmp ecx, 1
je 0x10192096
mov eax, dword [esi]
mov edi, 1
mov byte [ecx + eax], 0
jmp 0x101920a9
push dword [esi]
call dword [0x1026eac4]
add esp, 4
mov dword [esi], 0
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x101920c7
cmp dword [esi], 0
je 0x101920c7
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101920d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10192106
cmp eax, 0xea
jne 0x10192160
mov eax, dword [ebp - 4]
test eax, eax
je 0x10192160
inc eax
push eax
call dword [0x1026eabc]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x10192160
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1019214f
mov ecx, dword [ebp - 4]
cmp ecx, 1
je 0x1019214f
mov eax, dword [esi]
pop esi
mov byte [ecx + eax], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
push dword [esi]
call dword [0x1026eac4]
add esp, 4
mov dword [esi], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10192510
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 1
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push 0
push 0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x118], esi
push eax
push 0
push esi
mov dword [edi], 0
mov dword [ebp - 0x10c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10192677
lea eax, [ebp - 0x114]
push eax
push 1
push 0
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10192644
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x108], eax
mov dword [edi], eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0
push dword [ebp - 0x110]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x101925cb
cmp eax, 0xea
jne 0x1019262c
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x1019262c
inc eax
push eax
call dword [0x1026eabc]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x1019262c
lea ecx, [ebp - 0x108]
push ecx
push eax
push 0
push 0
push dword [ebp - 0x110]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1019261b
mov ecx, dword [ebp - 0x108]
cmp ecx, 1
je 0x1019261b
mov eax, dword [edi]
mov esi, 1
mov byte [ecx + eax], 0
jmp 0x1019262e
push dword [edi]
call dword [0x1026eac4]
add esp, 4
mov dword [edi], 0
xor esi, esi
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10192677
mov esi, dword [ebp - 0x118]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x100
push ecx
lea ecx, [ebp - 0x104]
mov eax, ebx
push ecx
push eax
push esi
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10192577
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x10193560
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov byte [ebp - 0x108], 0
call fcn.10196530
cmp eax, 3
jne 0x10193602
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1019361d
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.DatabasePath
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1019361d
cmp eax, 2
jne 0x1019376a
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10193624
mov eax, dword [str.hosts]
mov dword [ecx], eax
mov ax, word [0x101e4c6c]
mov word [ecx + 4], ax
mov al, byte [0x101e4c6e]
mov byte [ecx + 6], al
lea eax, [ebp - 0x108]
push 0x10209b78
push eax
call fcn.100e999d
add esp, 8
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x10193692
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1019376a
mov dword [edi], 0
mov eax, 0xe
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
push esi
push edi
push dword [ebp + 0xc]
push eax
call fcn.10197d80
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x210], esi
test esi, esi
jne 0x1019371c
nop dword [eax]
mov ecx, dword [edi]
push ebx
push dword [ecx]
call fcn.10197d60
add esp, 8
test eax, eax
je 0x1019371c
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x101936ef
nop dword [eax]
push ebx
push eax
call fcn.10197d60
add esp, 8
test eax, eax
je 0x101936ea
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x101936d0
jmp 0x101936ef
cmp dword [esi], 0
jne 0x10193716
push dword [edi]
call fcn.10197c30
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x214]
call fcn.10197d80
mov esi, eax
mov dword [ebp - 0x210], eax
add esp, 0x10
test esi, esi
je 0x101936b0
jmp 0x1019371c
mov esi, dword [ebp - 0x210]
push dword [ebp - 0x214]
call fcn.100e9749
add esp, 4
cmp esi, 0xd
jne 0x1019374d
mov esi, 4
mov dword [edi], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10193757
mov dword [edi], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 4
pop edi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret